Linux Health & Security Audit

Read-only Bash audit tool for Debian, Ubuntu, Linux Mint and LMDE systems.

The script creates timestamped TXT, HTML and JSON reports for Linux workstation or small server baseline checks. It is designed as a practical maintenance and security review tool: simple enough to run on a laptop, useful enough to document real sysadmin work.

What it checks

• OS, kernel, uptime and boot time
• Failed systemd units and enabled services
• Journal errors/warnings and kernel warnings
• CPU vulnerabilities and microcode status
• Memory, top CPU/memory processes
• Disk usage, inode usage, mounts and fstab
• SMART disk health when smartctl is installed
• APT repositories, kernel policy and package update state
• Network interfaces, routes, DNS and listening ports
• UFW/nftables firewall state
• Users with login shells and sudo/admin group membership
• SSH exposure and effective SSH daemon configuration
• SUID/SGID files, world-writable directories and timers
• AppArmor, Secure Boot, TPM and firmware update status
• Battery health, temperatures, hardware drivers, USB, Bluetooth and audio
• Flatpak updates and large log/cache directories

Improvements in v1.1

• Generic project name instead of host-specific naming
• Automated OK / INFO / WARN findings section
• JSON summary output for easier parsing
• Better HTML report with finding cards and counters
• Privacy mode for public sharing
• CLI options for output directory, ping targets and ping disabling
• More robust checks for missing commands
• Safer read-only behavior, no package installs or system changes

Usage

chmod +x scripts/linux-health-security-audit.sh
./scripts/linux-health-security-audit.sh

Reports are written to:

~/audit-reports/

Open the newest HTML report:

xdg-open "$(ls -t ~/audit-reports/*linux-health-security-audit*.html | head -1)"

Options

-o, --output-dir DIR     Output directory
-p, --privacy MODE       Privacy mode: off, basic, full
    --no-ping            Skip internet ping tests
    --ping-ip IP         IP target for connectivity test
    --ping-dns HOST      DNS target for connectivity test
-h, --help               Show help

Examples:

./scripts/linux-health-security-audit.sh --privacy basic
./scripts/linux-health-security-audit.sh --privacy full --no-ping
./scripts/linux-health-security-audit.sh --output-dir /tmp/audit

Privacy modes

Mode	Behavior
off	No redaction. Best for private local troubleshooting.
basic	Redacts common IP and MAC address patterns.
full	Also redacts obvious emails, serial fields and /home/<user> paths.

Privacy mode is best-effort text redaction, not a legal-grade anonymizer. Review public reports manually before publishing, because computers are creative little privacy hazards.

Optional packages

The script works without these, but the report is richer with them:

sudo apt install smartmontools lm-sensors mokutil efibootmgr apparmor-utils

Safety

This script is intended to be read-only. It does not install packages, remove files, modify firewall rules or change services.

Some commands use sudo to read richer system status. If sudo is not available, those sections may show partial output or warnings.

Portfolio use

This project demonstrates practical Linux administration, Bash automation, security baseline thinking and readable technical reporting.

Links

• Repository: https://github.com/Jarnon404/linux-health-security-audit
• GitHub Pages: https://jarnon404.github.io/linux-health-security-audit/
• Portfolio hub: https://github.nousiainen.eu/

Public safety note

This repository is intended to contain only public-safe material. Do not commit customer-specific data, tenant identifiers, credentials, generated audit reports, internal hostnames, private IP addresses or environment-specific exports.