TuxAudit - Linux configuration audit and security review tool

项目说明

TuxAudit 1.0

> Linux configuration audit and security review tool — for ethical and defensive use only.

---
<a href="
<img src="
alt="TuxAudit Menu"
width="500">
</a>
<br> <br>
<a href="
<img src="
alt="TuxAudit Menu"
width="500">
</a>

Objective

TuxAudit is a Bash script designed for Blue Team analysts, system administrators, and security auditors. It provides a rapid snapshot of a Linux machine's configuration, identifies de from security best practices, and generates an interactive HTML report ready for immediate use.

The script contains no write, modify, or exploitation commands. It relies exclusively on read-only calls (cat, find, ss, ps, systemctl, etc.) and does not alter the audited system in any way.

---

Dashboard

<a href="
<img src="
alt="TuxAudit Dashboard"
width="900">
</a>
<br> <br>
<a href="
<img src="
alt="TuxAudit Dashboard"
width="900">
</a>

MITRE Matrix

<a href="
<img src="
alt="TuxAudit MITRE Matrix"
width="900">
</a>

Remediation

<a href="
<img src="
alt="TuxAudit Remediation"
width="900">
</a>

Audit Logs

<a href="
<img src="
alt="TuxAudit Remediation"
width="900">
</a>

---

Legal Disclaimer

> The author of this script cannot be held responsible for its use.
> TuxAudit is designed to be used only on systems you own or for which you ha written authorization.
> Any use on a third-party system without authorization is illegal and unethical.
> This script contains only read commands and does not modify, exfiltrate, or alter any system data.

---

Prerequisites

Bash and root rights

The script requires root pri to access certain system information (shadow file, audit logs, kernel parameters, etc.).

> The script must be run as root or via sudo. It will refuse to start otherwise.

Minimum requirements

Supported operating systems

| # | OS | |
|---|----|---------|
| 1 | Raspberry Pi OS | Debian 12 Bookworm / 13 Trixie |
| 2 | Debian | 11 Bullseye / 12 Bookworm |
| 3 | Ubuntu | 22.04 Jammy / 24.04 Noble |
| 4 | RHEL / CentOS | 8 / 9 |
| 5 | Fedora | 39 / 40 |

---

Usage

Recommended workflow

The report is saved in /tmp/ as:

To open the report from another machine on the network:

---

Menus

[ALL] — Full Audit

Runs all 23 audit modules sequentially. Each module's output scrolls live in the terminal while being captured simultaneously. The HTML report is generated automatically at the end without any additional step.

[R] — HTML Report Generator

Lets you generate the report from data already captured by [ALL], or re-run all modules on demand.

| Choice | Action |
|--------|--------|
| ALL | Re-run all 23 modules and generate report |
| SEL | Use already-captured data from the current session |
| Q | Cancel |

[01]–[23] — Indi Module

Runs a single module and displays the result directly in the terminal, without generating an HTML report. Useful for quick checks or targeted diagnostics.

[D] — Machine O

Displays a full machine o in the console:

[O] — Change OS

Re-runs OS detection and lets you select the target OS manually if auto-detection fails.

---

Audit Modules (23)

| # | Description | Category |
|---|-------------|----------|
| 01 | OS Information — kernel, CPU, RAM, uptime, disks | System |
| 02 | Users & Groups — local accounts, UID=0, sudo, sudoers | Security |
| 03 | Process List — top CPU, suspicious paths | Processes |
| 04 | Network Interfaces — IP, routes, promiscuous mode | Network |
| 05 | Open Ports & Connections — listening services, established | Network |
| 06 | Firewall Status — UFW / iptables / firewalld | Security |
| 07 | SSH Configuration — sshd_config, authorized_keys | Security |
| 08 | Scheduled Tasks (Cron) — all cron entries, suspicious jobs | Security |
| 09 | SUID / SGID Files — pri escalation (host only, Docker layers excluded) | Security |
| 10 | Installed Packages — suspicious tools, recent installs | Packages |
| 11 | Services — enabled/running systemd units | Packages |
| 12 | System Logs Summary — auth failures, sudo usage | Security |
| 13 | Wi-Fi Configuration — sa, PSK, scan | Network |
| 14 | Time Source (NTP) — chrony, ntpd, drift | Network |
| 15 | Kernel & Boot Security — ASLR, sysctl, boot config (Pi) | System |
| 16 | Bash History & IOCs — /tmp files, deleted FDs, suspicious commands | Forensics |
| 17 | Kernel Modules & Rootkits — lsmod, dmesg, chkrootkit, rkhunter | Forensics |
| 18 | File Integrity — debsums, rpm -Va, AIDE, recently modified binaries | Forensics |
| 19 | Web Stack Audit — Apache/Nginx, PHP, webshell detection | Services |
| 20 | Database Audit — MySQL/PostgreSQL, exposure, accounts | Services |
| 21 | Container Audit — Docker, Kubernetes, pri containers | Services |
| 22 | File & Mail Services — FTP, Samba, NFS, Postfix | Services |
| 23 | Network Recon — ARP, DNS, hosts, fail2ban | Network |

---

HTML Report

The generated report is a self-contained HTML file (no external dependencies, no internet required) containing:

---

Security Score Calculation

The score is not a simple a. It is calculated using a formula inspired by CVSS:

Puniti — certain critical domains in failure lock the global score regardless of other modules:

| Condition | Ceiling | Meaning |
|-----------|---------|---------|
| Critical domain (weight ≥ 4) at ≤ 2/10 | 3.9 | e.g. Webshell detected → Critical certain |
| Critical domain (weight ≥ 4) at ≤ 4/10 | 4.9 | Severe failure on vital domain |
| Critical domain (weight ≥ 4) at ≤ 6/10 | 6.4 | Partial failure on vital domain |
| Important domain (weight ≥ 3) at ≤ 2/10 | 4.9 | Major failure |
| Important domain (weight ≥ 3) at ≤ 4/10 | 5.9 | Significant failure |

Critical domains (weight 4): SSH, Firewall, Integrity, Web, Database.

Co penalty — a partial audit (few modules analyzed) pulls the score toward 5/10 to reflect uncertainty.

Display thresholds:

| Score | Label | Color |
|-------|-------|-------|
| 0 – 4.9 | Critical | Red |
| 5.0 – 7.9 | Warning | Orange |
| 8.0 – 10 | Good | Green |

---

Security References

The report includes a collapsible reference panel in the sidebar linking to:

---

License

Apache 2.0 — see LICENSE file.

---

Authors

Anadema

项目信息

开发语言：Shell

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Linux configuration audit and security review tool — for ethical and defensive use only.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。