360 Secure SkillHub
360 安全技能中心

Linux Security Scanner

提供基于 Bash 的 Linux 安全态势检查脚本，可一次运行全部检查或按项执行 SSH 配置、监听端口、防火墙规则、失败登录、sudoers 权限、全局可写文件与 SUID 二进制的审计，并输出彩色终端报告和结构化 Markdown 结果。

laolaoqi
laolaoqi
热度 26.36
最近更新 2026-05-12 06:56:47
分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add linux-security-scanner
Metadata
name
linux-security-scanner
description
Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID binaries. Use when a user needs a security posture assessment, hardening audit, or compliance check on a Linux host — run individual checks or a full comprehensive audit with a formatted report.

Linux Security Scanner

Script

scripts/security-audit.sh — the single entry point for all checks.

The script is self-contained, portable, and works on any modern Linux system. It auto-detects available tools (ss/netstat, ufw/iptables/nftables, journalctl) and gracefully skips unavailable ones.

Quick Start

Run a full audit:

bash scripts/security-audit.sh --all

Or with no arguments (same as --all):

bash scripts/security-audit.sh

Individual Checks

Run any single check by name:

Command What it checks
--ssh PermitRootLogin, PasswordAuthentication, Port, Protocol in sshd_config
--ports Listening TCP ports (ss or netstat)
--firewall ufw status, iptables filter rules, nftables ruleset
--failed-logins lastb output and journalctl SSH auth failures (last 24h)
--sudoers Sudoers file permissions (must be 440), files present, NOPASSWD entries, full sudo access grants
--world-writable World-writable files in /etc, /tmp, /var, /home, /opt (depth 3)
--suid All SUID binaries, risk assessment, unusual path detection

Example:

bash scripts/security-audit.sh --ssh --failed-logins

Full Audit Workflow

  1. Run bash scripts/security-audit.sh --all
  2. The script outputs a colorized report to stdout
  3. A structured markdown report is stored in the $REPORT variable (accessible within the same shell session)
  4. For programmatic use, redirect output to a file

Common Findings & Recommendations

  • SSH hardening: Disable root login, disable password auth, use key-only auth, change default port
  • Firewall: Ensure only necessary ports are open; prefer deny-by-default
  • Sudoers: Avoid NOPASSWD where possible; keep permissions at 440; audit who has full sudo access
  • SUID: Review unusual SUID paths; minimize SUID binaries; check for known CVEs on common ones (pkexec, sudo, etc.)
  • World-writable files: These are security risks — investigate why they're writable and restrict permissions

Notes

  • Requires root/sudo for some checks (failed-logins reads /var/log/btmp, ss shows process info)
  • Runs entirely in the shell — no external dependencies beyond standard Linux tools
  • Respects permission boundaries — non-accessible checks are noted, not forced