Linux Security Audit

Audit a Linux host's security hardening posture and produce a risk-ranked report, using both passive config inspection and active service probing. Covers kernel sysctls, boot parameters, mount options (nosuid/noexec/nodev), module blacklists, core dumps, SUID/SGID files, SELinux/AppArmor including unconfined domains, processes running as root, local privilege-escalation paths (sudoers Defaults and GTFOBins-capable grants, sudo env_keep, writable systemd units, writable PATH, NFS no_root_squash, exposed credentials, shell-history anti-forensics), root cron jobs reading or globbing user-writable data, the boot and service-start trust chain (systemd EnvironmentFile/Exec/Condition paths, ld.so search paths, udev RUN targets, files currently open in and libraries mapped into root processes), insecure-by-default services (telnet, rsh, FTP, TFTP, rsync daemon anonymous write, Samba guest shares and SMB1, open mail relay, open DNS resolver, open proxy, memcached, VNC, xinetd/inetd), database and SNMP authentication, USB device restriction (USBGuard), firewall rules, exposed listening ports, TLS cipher and protocol validation, mutual-TLS enforcement on internal tunnels, web server hardening (nginx/Apache/PHP/certs/security headers/webroot exposure), repository GPG verification, prohibited packages on hardened hosts (compilers, tcpdump/wireshark, network and debug tooling), image and template hygiene (SSH host keys or entropy seeds baked into a golden image, uninitialised machine-id, cloud-init state, per-instance enrolment material), cleartext secrets on disk (.env files, API keys such as sk-ant-*/AWS/GitHub/Stripe, connection-string credentials, embedded and standalone private keys) reported with values redacted, .htaccess and .user.ini contents, NTP and time-source security, SSH server and client config, sudoers, GRUB password, disk encryption, remote logging, log retention periods, log file readability by unprivileged users, auditd, file-integrity monitoring, package checksum verification (dpkg --verify/debsums/rpm -Va, separating config drift from modified binaries), cron, and writable directories. Use when asked to security-audit, hardening-review, CIS-check, or harden a Linux server or web server (local, over SSH, in a container, or against a mounted image), or to verify a specific hardening control is in place.

mkdir -p ~/.claude/skills/linux-security-audit
curl -L https://claudskills.com/skills/linux-security-audit/SKILL.md \
  -o ~/.claude/skills/linux-security-audit/SKILL.md

@misc{linux-security-audit-2026,
  author    = {jonaslejon},
  title     = {Linux Security Audit [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/linux-security-audit/}
}