🔐 Linux Security Audit Script

This Bash script performs a comprehensive security audit of a Linux system. It checks executables, running processes, installed packages, file permissions, firewall status, network activity, kernel integrity, and more. It’s ideal for system administrators looking for a quick snapshot of a system’s security state.

---

📋 Features

The script includes the following security checks:

🔧 System & Process Auditing

• Permissions of executables in /bin, /usr/bin, /sbin, and /usr/sbin
• Top memory-consuming running processes
• Running systemd services
• User and group accounts on the system
• SUID/SGID files

📦 Package Management

• Installed packages and their versions (supports dpkg, rpm, and pacman)
• Alerts for sensitive packages like rsync, samba-common, and python3-yaml

🔐 File & System Integrity

• Checksums for critical binaries (/bin/ls, /bin/bash, etc.)
• Permissions of sensitive files like /etc/passwd, /etc/shadow, /etc/sudoers
• Kernel image checksum validation
• dmesg logs for kernel warnings and errors
• Loaded kernel modules and their metadata

🌐 Network & Firewall

• Open ports and listening processes (via ss)
• Active network connections
• Port scanning (1–1024) using nc
• Firewall rules from ufw and/or iptables
• Protocol restriction via custom iptables rules

📡 DNS, Backups, and Temporary Files

• DNS configuration (/etc/resolv.conf and resolvectl)
• Available backups in /var/backups
• Files in /tmp, with cleanup of old temporary files
• Crontab entries related to backup tasks

---

🛠️ Usage

1. Give execute permissions:

   chmod +x audit_script.sh

2. Run the script with root privileges:

   sudo ./audit_script.sh

⚠️ Some checks require root access (e.g., firewall status, kernel file access, and /tmp cleanup).

---

🗂️ Output

The script will generate multiple .txt output files in the current directory, such as:

• output_executables_permissions.txt
• output_running_processes.txt
• output_firewall.txt
• output_kernel_checksum.txt
• output_module_checksums.txt
• output_scan_ports.txt
• ...and more

These files contain detailed logs and results for each check performed.

---

📎 Notes

• Make sure the system has common tools like ps, awk, dpkg, rpm, iptables, ufw, sha256sum, etc.
• You can safely delete or archive the output .txt files after review.
• Some modules or binaries might not be available depending on your Linux distribution.

---