Skip to content

LinFo v0.7

Latest
Latest

Choose a tag to compare

View all tags
@kaotickj kaotickj released this 04 Jul 18:32
· 6 commits to main since this release
v0.7
d5c3598

LinFo v0.7

  --     LinFo is a lightweight Linux system information and security enumeration tool designed for quick, comprehensive insights into a target system’s hardware, software, and security posture. It is intended for use by system administrators, penetration testers, and security researchers who need an efficient way to gather system details and identify potential security weaknesses.

Features

  • Collects detailed OS and kernel information.

  • Reports CPU, GPU, memory, disk usage, and package count.

  • Detects desktop environment and display resolution.

  • Enumerates network interfaces and IP/MAC addresses.

  • Provides an extensive security report covering firewall status, SELinux/AppArmor, kernel hardening features, SUID binaries, permissions, listening ports, and more.

  • Gathers "loot" relevant for red team operations: suspicious cron jobs, writable directories, SSH authorized keys, shell startup files, and recently modified binaries.

  • Interactive prompts for saving scan or loot reports to file.

  • Supports running with or without root privileges, with full functionality recommended under root.

  • Command-line options for scanning, loot gathering, hardening evaluation or all three combined.

Functional Enhancements

v0.6 → v0.7

07/4/2025

System Hardening Evaluation:

The run_hardening_check() function performs a comprehensive Linux system security assessment and makes hardening recommendations. Here's a breakdown of its features:

General Features

  • Colorized Output: Uses color codes for readability:

    • ${GREEN} – Success/good
    • ${RED} – Errors, misconfigurations
    • ${BLUE} – Recommendations
    • ${YELLOW} – Informational
    • ${LIGHT_MAGENTA} – Process prompts

  • OS Detection:

    • Determines package manager (apt, dnf, yum, zypper, pacman) to tailor checks accordingly.

Hardening Checks Performed

  • System Updates:

    • Checks for available package updates using check_updates_available.

  • Hardening Tools:

    • Checks if fail2ban, auditd, and aide are installed and active.
    • If not present or inactive, gives recommendations.

  • Firewall:

    • Calls firewall_check function to detect and evaluate firewalls (iptables, nftables, ufw, firewalld).
    • Recommends installing a firewall only if none are detected.

  • Mandatory Access Control:

    • For Debian/Ubuntu: checks for AppArmor directory and activity.
    • For RHEL-based systems: checks for SELinux and firewalld, and suggests enabling if inactive.

  • SSH Root Login:

    • Verifies if PermitRootLogin no is explicitly set and uncommented in sshd_config.
    • Flags and recommends changes if improperly configured.

  • PAM Password Policy:

    • Looks for pam_pwquality or pam_cracklib in /etc/pam.d/common-password.
    • Warns if no complexity enforcement is detected and recommends configuring it.

  • Intrusion Detection Systems:

    • Detects if aide is installed or if ossec is active via systemctl.
    • Recommends installation if neither is found.

  • Audit Logging:

    • Confirms if auditd is active.
    • Recommends installing and enabling auditd if not.

  • Automatic Security Updates:

    • Checks for:

      • unattended-upgrades (Debian/Ubuntu)
      • dnf-automatic (Fedora/RHEL)

    • Warns for Arch systems (unsupported).

    • Recommends installing if missing.

Installation

Clone or download the repository:

git clone https://github.com/kaotickj/LinFo.git
cd LinFo
chmod +x linfo.sh

Run the script directly on the target Linux system.

Usage

Usage: linfo.sh [OPTIONS]
​
Options:
​
--quiet               Run script in quiet mode (minimal output).
--no-ip               Skip displaying network interface IP addresses.
--raw                 Output raw, uncolored text for easier parsing.
--scan               Perform security scanning checks and display a security report.
--loot, --c2ready     Gather potential loot, indicators, and staging areas for C2 readiness.
--fullscan           Run both --scan and --loot checks; skips IP info for speed.
--help, -h           Show this help message and exit.
​
Examples:
​
./linfo.sh --scan
    Run only the security scan report.
​
./linfo.sh --loot
    Run loot gathering report.
​
./linfo.sh --fullscan
    Run full security and loot reports in one execution.

Assets 2
Loading