Linux Security Lab

A Bash-based security auditing toolkit for inspecting common Linux host configuration issues, including SSH settings, user privileges, filesystem permissions, system resources, and exposed network services.

The audit scripts can be executed individually or through a single runner that collects the results into reports for later review.

Checks

SSH Configuration

The SSH audit inspects the host's OpenSSH configuration for:

• Root login configuration
• Password authentication
• Public-key authentication
• SSH directory and key permissions

Results are reported as PASS, WARNING, or INFO depending on the detected configuration.

Users and Permissions

The user audit inspects local account and filesystem permissions, including:

• User accounts
• Sudo-group membership
• World-writable files and directories
• Security-sensitive file permissions

These checks are intended to identify unnecessarily broad privileges or filesystem access.

Network Exposure

The port audit examines services reachable through the host's network stack using Linux networking utilities and Nmap.

Checks include:

• Listening TCP sockets
• Open ports
• Detected network services
• Expected SSH exposure

System Status

The system audit collects basic host information and resource usage, including:

• Disk utilization
• Memory utilization
• System information

Project Structure

linux-security-lab/
├── scripts/
│   ├── port_audit.sh
│   ├── system_audit.sh
│   ├── ssh_audit.sh
│   ├── user_audit.sh
│   └── run_all.sh
├── reports/
├── .gitignore
└── README.md

Requirements

The scripts are intended for a Linux environment with:

• Bash
• OpenSSH
• Nmap
• Standard Linux command-line utilities

Some checks may require elevated privileges depending on the host configuration.

Usage

Make the audit scripts executable:

chmod +x scripts/*.sh

Run the complete audit:

./scripts/run_all.sh

Individual audit modules can also be executed directly:

./scripts/system_audit.sh
./scripts/ssh_audit.sh
./scripts/user_audit.sh
./scripts/port_audit.sh

Generated audit output is stored under:

reports/

Example Output

[PASS] Root login is disabled
[PASS] Password authentication is disabled
[PASS] Public-key authentication is enabled
[PASS] No world-writable files found in home directory
[PASS] ~/.ssh permissions are secure (700)
[PASS] Root filesystem usage is 26%
[INFO] 4 TCP listening socket(s) detected
[PASS] Port 22/tcp is open (expected SSH service)

PASS indicates that a checked configuration matches the expected security condition. WARNING identifies a configuration that may require review, while INFO reports system state without assigning a security judgment.

Audit Workflow

                 run_all.sh
                     |
       +-------------+-------------+
       |             |             |
       v             v             v
 system_audit   ssh_audit     user_audit
                                     |
                                     v
                                port_audit
                                     |
                                     v
                              Audit Reports

Each script focuses on a specific area of the host so checks can be run independently or combined into a complete audit.

Security Considerations

This project performs lightweight configuration and exposure checks and is not a comprehensive vulnerability scanner or compliance framework.

A PASS result indicates only that the specific condition tested by the script was satisfied. It does not establish that the host or service is secure.

Network scanning should only be performed against systems the user owns or is explicitly authorized to test.

License

See LICENSE for licensing information.