Linux Security Auditor 🔍

• Version: 2.0.0
• Last Updated: 2026-07-27
• Author: SudoShea
• License: MIT

A non-destructive, read-only Linux security auditing and compliance suite designed to inspect host OS configurations, evaluate runtime OpenSSH settings, audit rootless Podman containers, parse authentication logs for brute-force attacks, and detect security drift over time.

---

⚡ Key Features

• Evaluates Live Runtime SSH (sshd -T): Evaluates the active, merged OpenSSH configuration directly, correctly catching drop-in files (/etc/ssh/sshd_config.d/*.conf).
• CIS Benchmark Alignment: Verifies kernel network stack parameters (sysctl), shadow file permissions (/etc/shadow), active host firewalls (ufw / firewalld), and audit logging (auditd).
• Rootless Podman Inspection: Audits running containers for privileged execution (--privileged), root user execution (UID 0), host network bindings (--net=host), and sensitive host volume mounts.
• Systemd Journal Integration: Streams auth logs dynamically via journalctl -u sshd with fallback to /var/log/auth.log or /var/log/secure.
• Security Drift Detection: Compares historic JSON audit reports to instantly highlight new regressions or resolved findings.

---

🛠️ Repository Structure

linux-security-auditor/
├── audit.py              # Unified CLI wrapper entrypoint
├── CHANGELOG.md          # Version history
├── LICENSE               # MIT License
├── README.md             # Project documentation
├── VERSION               # Current release version (2.0.0)
├── modules/              # Core security auditor package
│   ├── __init__.py
│   ├── container.py      # Podman container security inspector
│   ├── diff.py           # JSON audit report drift analyzer
│   ├── ssh.py            # SSH log & journalctl brute-force parser
│   └── system.py         # OS & CIS compliance security scanner
└── scripts/
    └── bump_version.py   # Repository version & header sync tool

---

Prerequisites

• OS: Linux (Debian, Ubuntu, RHEL, Fedora, Rocky Linux, AlmaLinux)
• Python: Python 3.8+ (Standard library only — no pip install required!)
• Privileges: Root / sudo access (required for /etc/shadow, sshd -T, and systemd checks)
• Optional: Podman (for container security inspection via audit.py container)

---

🚀 Quick Start & Usage

Clone the Repository & Make the CLI Wrapper Executable:

git clone https://github.com/SudoShea/linux-security-auditor.git
cd linux-security-auditor
chmod +x audit.py

1. System CIS Compliance Audit

Evaluates SSH, active firewalls, unencrypted listening ports, kernel sysctl rules, /etc/shadow permissions, and auditd:

sudo ./audit.py system

2. Container Security Audit

Inspects active Podman containers for high-risk flags and sensitive volume mounts:

./audit.py container

3. SSH Anomaly & Brute-Force Scan

Parses systemd auth logs for failed login attempts exceeding a threshold:

sudo ./audit.py ssh -t 3 --since "12 hours ago"

4. Security Drift Analysis

Compares two JSON audit reports generated by system audits to detect regressions:

./audit.py diff audit_report_baseline.json audit_report_target.json

5. Full Security Suite Execution

Runs OS compliance, container risk, and SSH log audits sequentially in a single pass:

sudo ./audit.py all

---

Auditing Remote Systems

audit.py evaluates the local host where it is executed. To audit remote servers across your infrastructure without installing the repository on every host, use one of the following methods:

Method A: Execute Remotely via SSH

Stream and execute the audit suite directly on a target host over SSH without leaving files behind:

# Run full system audit on a remote host
ssh -t user@remote-host "git clone https://github.com/SudoShea/linux-security-auditor.git /tmp/auditor && sudo /tmp/auditor/audit.py system && rm -rf /tmp/auditor"

Method B: Dispatch via Ansible Ad-Hoc Command

If you maintain an Ansible inventory (e.g., in ansible-system-hardening or homelab-infrastructure), dispatch audit.py across all target hosts in a single command:

# Run audit.py across all hosts in your inventory
ansible all -i inventory.ini -m script -a "audit.py system" --become

---

📊 JSON Report Export

Executing ./audit.py system automatically generates a timestamped JSON report (audit_report_YYYYMMDD_HHMMSS.json) formatted for automated compliance tracking and drift analysis:

{
    "timestamp": "2026-07-27T17:40:00.000000",
    "summary": {
        "total_checks": 12,
        "passed": 12,
        "failed": 0,
        "score_percentage": 100.0
    },
    "results": [
        {
            "category": "SSH",
            "check": "Directive: permitrootlogin",
            "status": "PASS",
            "details": "Evaluated runtime as 'no'"
        }
    ]
}

---

📄 License

Distributed under the MIT License. See LICENSE for details.