Linux Security Audit Project

A comprehensive, modular security audit framework for Linux systems supporting multiple compliance frameworks with automated remediation capabilities, compliance scoring, and interactive reporting.

🚀 Quick Start

# Clone the repository
git clone https://github.com/Sandler73/Linux-Security-Audit-Project.git
cd Linux-Security-Audit-Project

# Run a complete security audit (requires sudo)
sudo python3 linux_security_audit.py

# View the interactive HTML report
# Opens automatically in your default browser

That's it! The tool will audit your system against all 8 security frameworks and generate a comprehensive report.

✨ Features

Core Capabilities

🔍 1,207 Security Checks: Comprehensive assessment across 8 compliance frameworks
📊 Compliance Scoring: Weighted, simple, and severity-adjusted scores with pass/fail thresholds
🎨 Interactive HTML Reports: 18+ features including SVG charts, clickable dashboard, column resizing, multi-format export
⚡ Performance Engine: Shared caching (~50% hit rate), parallel execution, direct /proc reads
🔧 Automated Remediation: Fix security issues with single commands or selective batch operations
📁 Multi-Format Output: HTML, CSV, JSON, XML, and Console with companion JSON metadata
🔐 Privilege-Aware: Works with or without root (graceful degradation)
📝 Structured Logging: Dual console/file output, configurable levels, JSON log format for SIEMs

Advanced Features

Dynamic Module Discovery: Automatically detects and validates modules from modules/ directory
OS-Aware Checks: Distribution-specific optimizations (Debian, Red Hat, SUSE, Arch families)
IP Address Identification: Paired host identification (hostname + OS + IPs) for SIEM attribution
Smart Privilege Detection: Identifies what can/can't be checked without root
Comprehensive Error Handling: Graceful failures with detailed error reporting
Zero Dependencies: Uses only Python standard library (Python 3.7+, no pip install needed)
Completely Offline: No internet connection required, no data transmitted

🛡️ Security Frameworks

The project includes 8 specialized security modules:

Module	Checks	Description	Best For
Core	153	Industry best practices, OS-specific security	Everyone
CIS	212	CIS Benchmarks compliance	General hardening, compliance
CISA	147	Critical infrastructure protection	Government, critical sectors
ENISA	97	EU cybersecurity guidelines	European organizations
ISO27001	115	Information security management	ISMS certification
NIST	172	NIST 800-53, CSF 2.0, 800-171	Federal, contractors
NSA	144	Advanced security hardening	High-security environments
STIG	167	DoD security requirements	Defense, contractors

Total: 1,207 comprehensive security checks (validated)

Framework Selection Guidance

General Organizations: Start with Core + CIS
Financial/Healthcare: Use ISO27001 + NIST + CIS
Government/Federal: Use NIST + STIG + CISA
EU Organizations: Use ISO27001 + ENISA + CIS
Defense Contractors: Use STIG + NIST + NSA

📖 Complete Framework Reference →

💻 System Requirements

Minimum Requirements

Operating System: Linux (any modern distribution)
Python: Version 3.7 or higher
Disk Space: 100 MB free
Memory: 512 MB RAM (1 GB recommended)
Privileges: Root/sudo recommended for complete results

Supported Distributions

Fully Tested

Ubuntu 18.04+, 20.04 LTS, 22.04 LTS, 24.04 LTS
Debian 9+, 10, 11, 12
RHEL 7, 8, 9
CentOS 7, 8 Stream
Fedora 28+, 35+, 38+
Rocky Linux 8, 9
AlmaLinux 8, 9

Also Supported

Linux Mint 19+
Kali Linux 2020+
SUSE/openSUSE Leap 15+
Arch Linux (rolling release)

Prerequisites

No installation required! All dependencies are part of Python's standard library:

os, sys, json, csv, argparse, subprocess
platform, socket, datetime, pathlib, typing
xml.etree.ElementTree, html, dataclasses (Python 3.7+)
concurrent.futures, ipaddress, logging

📦 Installation

Option 1: Git Clone (Recommended)

# Clone the repository
git clone https://github.com/Sandler73/Linux-Security-Audit-Project.git

# Navigate to directory
cd Linux-Security-Audit-Project

# Verify installation
python3 linux_security_audit.py --list-modules

Option 2: Download ZIP

# Download latest release
wget https://github.com/Sandler73/Linux-Security-Audit-Project/archive/refs/heads/main.zip

# Extract
unzip main.zip
cd Linux-Security-Audit-Project-main

# Make executable
chmod +x linux_security_audit.py

Option 3: Direct Download

Download and preserve the directory structure:

linux_security_audit.py (main script)
modules/module_*.py (all 8 module files)
shared_components/audit_common.py (shared library)

🎯 Basic Usage

Simple Commands

# List available modules
python3 linux_security_audit.py --list-modules

# Run complete audit (all modules)
sudo python3 linux_security_audit.py

# Run specific modules
sudo python3 linux_security_audit.py -m Core,CIS,NIST

# Generate CSV report
sudo python3 linux_security_audit.py -f CSV -o security-audit.csv

# Quick console output
sudo python3 linux_security_audit.py -f Console

Common Use Cases

Security Baseline Assessment

# Establish initial security baseline
sudo python3 linux_security_audit.py -m Core,CIS -o baseline-$(date +%Y%m%d).html

Compliance Auditing

# Generate compliance report
sudo python3 linux_security_audit.py -m ISO27001,NIST,CIS -f HTML -o compliance-report.html

Automated Monitoring

# Daily automated audit (add to crontab)
0 2 * * * /usr/bin/python3 /opt/audit/linux_security_audit.py -f JSON -o /var/log/audit-$(date +\%Y\%m\%d).json

SIEM Integration

# Generate XML for SIEM ingestion
sudo python3 linux_security_audit.py -f XML -o siem-feed.xml

Command-Line Options

Option	Description	Example
`-m, --modules`	Specify modules to run	`-m Core,CIS,NIST`
`-f, --output-format`	Output format	`-f HTML`
`-o, --output-path`	Output file path	`-o report.html`
`--list-modules`	List available modules
`--parallel`	Execute modules in parallel
`--workers N`	Number of parallel workers	`--workers 4`
`--profile`	Show performance statistics
`--log-level LEVEL`	Set log level	`--log-level DEBUG`
`--log-file PATH`	Custom log file path
`--json-log`	JSON-structured log output
`--verbose` / `--quiet`	Control console verbosity
`--remediate`	Interactive remediation
`--remediate-fail`	Fix only FAIL status
`--auto-remediate`	Automatic remediation
`--remediation-file`	Fix specific issues from JSON

📖 Complete Usage Guide →

📚 Documentation

Quick Links

🏠 Wiki Home - Complete documentation hub
⚡ Quick Start - Get started in minutes
📖 Usage Guide - Comprehensive usage instructions
🔍 Module Documentation - Detailed module capabilities
📊 Output Reference - Understanding reports and formats
🛡️ Framework Reference - Security standards details
💻 Development Guide - Contributing and extending
🔧 Troubleshooting - Common issues and solutions
❓ FAQ - Frequently asked questions

Documentation Highlights

For Users

Installation: Quick Start Guide
First Run: Quick Start Guide
Understanding Results: Output Reference
Remediation: Usage Guide
Common Issues: Troubleshooting Guide

For Developers

Architecture: Development Guide
Creating Modules: Development Guide
Code Standards: Development Guide
Contributing: Development Guide

For Compliance

Framework Details: Framework Reference
Module Coverage: Module Documentation
Compliance Mapping: Framework Reference

📁 Output Formats

HTML (Default)

Interactive, browser-based report with:

✅ Sortable and filterable tables
✅ Full-text search across all fields
✅ Dark/Light theme toggle
✅ Export selected issues to JSON
✅ Inline remediation commands
✅ Summary statistics dashboard

sudo python3 linux_security_audit.py -f HTML

CSV

Spreadsheet-compatible format for:

✅ Excel/Google Sheets analysis
✅ Custom reporting and graphing
✅ Historical trend analysis
✅ Data manipulation

sudo python3 linux_security_audit.py -f CSV -o audit.csv

JSON

Structured data for:

✅ API integration
✅ SIEM ingestion
✅ Automation workflows
✅ Selective remediation
✅ Custom scripting

sudo python3 linux_security_audit.py -f JSON -o audit.json

XML

Enterprise tool integration:

✅ SIEM systems (Splunk, QRadar)
✅ GRC platforms
✅ Configuration management
✅ Legacy system compatibility

sudo python3 linux_security_audit.py -f XML -o audit.xml

Console

Real-time terminal output:

✅ Color-coded status
✅ No file creation
✅ SSH-friendly
✅ Quick validation

sudo python3 linux_security_audit.py -f Console

📖 Complete Output Reference →

🔧 Remediation

The tool provides multiple remediation approaches for fixing security issues:

Interactive Remediation

Review and approve each fix individually:

sudo python3 linux_security_audit.py --remediate

Workflow:

Shows each issue with details
Displays remediation command
Prompts for confirmation
Executes if approved
Reports results

Filtered Remediation

Fix only specific severity levels:

# Fix only critical FAIL issues
sudo python3 linux_security_audit.py --remediate-fail

# Fix WARNING level issues
sudo python3 linux_security_audit.py --remediate-warning

# Combine with auto-remediation
sudo python3 linux_security_audit.py --remediate-fail --auto-remediate

Selective Remediation

Most precise approach - fix only specific issues:

Run audit and generate HTML report
Review findings in browser
Select specific issues using checkboxes
Click "Export Selected" button
Run remediation with exported file:

sudo python3 linux_security_audit.py --auto-remediate --remediation-file Selected-Report.json

Automated Remediation

Batch fix all issues with confirmation:

sudo python3 linux_security_audit.py --auto-remediate

⚠️ Safety Notes:

Always test in non-production first
Review remediation commands before executing
Backup critical configurations
Have console access in case SSH breaks
Schedule during maintenance windows

📖 Remediation Guide →

📂 Project Structure

Linux-Security-Audit-Project/
├── linux_security_audit.py           # Main orchestrator (3,487 lines)
├── modules/                          # Security framework modules
│   ├── module_core.py                # Core baseline (153 checks)
│   ├── module_cis.py                 # CIS Benchmarks (212 checks)
│   ├── module_cisa.py                # CISA guidance (147 checks)
│   ├── module_enisa.py               # ENISA guidelines (97 checks)
│   ├── module_iso27001.py            # ISO 27001 controls (115 checks)
│   ├── module_nist.py                # NIST frameworks (172 checks)
│   ├── module_nsa.py                 # NSA hardening (144 checks)
│   └── module_stig.py                # DISA STIGs (167 checks)
├── shared_components/                # Shared library
│   └── audit_common.py              # Caching, parallel, /proc reads (2,174 lines)
├── logs/                             # Structured log files (auto-created)
├── reports/                          # Generated reports (auto-created)
├── README.md                         # This file
├── LICENSE                           # MIT License
├── CHANGELOG.md                      # Version history
├── SECURITY.md                       # Security policy
├── CONTRIBUTING.md                   # Contribution guidelines
└── .gitignore                        # Git ignore rules

🤝 Contributing

We welcome contributions! Here's how you can help:

Ways to Contribute

🐛 Report Bugs: Open an issue
💡 Suggest Features: Request enhancements
📝 Improve Documentation: Fix errors, add examples
💻 Write Code: Implement features, fix bugs
🛡️ Add Checks: Create new security checks
🔍 Review PRs: Help review pull requests

Contribution Process

Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Make your changes
Test thoroughly (root and non-root)
Commit with clear messages (git commit -m 'Add amazing feature')
Push to your fork (git push origin feature/amazing-feature)
Open a Pull Request

Development Setup

# Clone your fork
git clone https://github.com/YOUR_USERNAME/Linux-Security-Audit-Project.git
cd Linux-Security-Audit-Project

# Create development branch
git checkout -b feature/your-feature

# Verify directory structure
ls modules/ shared_components/

# Make changes and test
python3 linux_security_audit.py --list-modules
sudo python3 linux_security_audit.py -m YourModule --profile

# Run tests (if available)
python3 -m pytest tests/

Coding Standards

Follow PEP 8 style guide
Use type hints where applicable
Write comprehensive docstrings
Add inline comments for complex logic
Include error handling
Test both root and non-root execution

📖 Complete Development Guide →

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

MIT License Summary

✅ Permissions:

Commercial use
Modification
Distribution
Private use

✅ Conditions:

License and copyright notice

✅ Limitations:

No liability
No warranty

🆘 Support

Getting Help

📖 Check Documentation: Start with Wiki
🔍 Search Issues: Look for existing issues
❓ Read FAQ: Check Frequently Asked Questions
🔧 Troubleshooting: Review Troubleshooting Guide
💬 Open Issue: Create new issue

Issue Guidelines

When opening an issue, please include:

For Bug Reports:

Clear description of the issue
Steps to reproduce
Expected vs actual behavior
Environment details (OS, Python version)
Error messages and logs
Screenshots (if applicable)

For Feature Requests:

Use case description
Why it's needed
Proposed implementation
Benefit to other users

Community

GitHub Issues: Bug reports and feature requests
Pull Requests: Code contributions
Discussions: Questions and ideas (if enabled)
Wiki: Comprehensive documentation

🌟 Acknowledgments

Standards Organizations

This project implements guidance from:

CIS - Center for Internet Security
NIST - National Institute of Standards and Technology
DISA - Defense Information Systems Agency
NSA - National Security Agency
CISA - Cybersecurity and Infrastructure Security Agency
ENISA - European Union Agency for Cybersecurity
ISO - International Organization for Standardization

Security Community

Thanks to the open-source security community for:

Security research and vulnerability disclosure
Framework development and maintenance
Best practices documentation
Tool development and testing

📊 Project Stats

Version: 2.0
Release Date: March 2026
Total Checks: 1,207 (validated)
Modules: 8 security frameworks
Output Formats: 5 (HTML, CSV, JSON, XML, Console)
Scoring Methods: 3 (simple, weighted, severity-adjusted)
Python Version: 3.7+
License: MIT
Status: Active Development

🔗 Quick Links

Documentation

Project

Standards

⭐ If this project helps you secure Linux systems, please consider giving it a star! ⭐

⬆ Back to Top

Made with ❤️ for the Linux security community

📖 Documentation • 🐛 Report Bug • ✨ Request Feature

Name		Name	Last commit message	Last commit date
Latest commit History 81 Commits
.github		.github
modules		modules
shared_components		shared_components
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
linux_security_audit.py		linux_security_audit.py

Folders and files

Latest commit

History

Repository files navigation