Linux Config Auditor

Linux Config Auditor

Overview

Audits any Linux configuration file against security best practices, performance recommendations, and common compliance baselines (CIS, STIG-inspired). Outputs a structured findings report with severity ratings, explanations, and ready-to-apply fix snippets.

Language: Respond in the user's language. Config snippets always use the native config syntax.

When to Use

• User pastes or references a config file and wants it reviewed
• User asks "is my nginx config secure?", "check my sshd_config", "audit my firewall rules"
• User wants hardening recommendations for a specific service
• User wants to know why a service behaves unexpectedly (misconfiguration hunt)
• User asks for CIS benchmark or security best-practice review

When NOT to Use

• User wants a script to automate the fix → use /linux-shell-scriptor
• User wants to generate a config from scratch → generate directly without this skill
• User wants to harden the whole OS (not just one config) → use /linux-security-hardener

Supported Config Types

Audit Framework

Run findings through three lenses in order:

1. Security

Look for settings that increase attack surface, weaken encryption, allow privilege escalation, or violate least-privilege.

2. Performance

Look for settings that limit throughput, cause unnecessary latency, misuse resources, or have known bottleneck defaults.

3. Compliance / Best Practice

Check against CIS Benchmark guidance (where applicable), vendor hardening docs, and widely accepted defaults.

Output Format

Structure every audit as follows:

Summary Header

Config: <filename or type>
Findings: X critical · Y warnings · Z info · N passed

Findings Table

Severity scale:

• 🔴 Critical — actively exploitable or violates fundamental security principle
• 🟠 Warning — weakens security posture or common attack vector
• 🟡 Info — performance gap, minor misconfiguration, or style deviation
• ✅ OK — explicitly confirmed as correct, shown for reassurance

What to include in the table:

• 🔴 Critical: always include every finding
• 🟠 Warning: always include every finding
• 🟡 Info: include only if 3 or more items; otherwise merge into summary
• ✅ OK: include 1–2 highlights only (the most important security settings that are correctly configured)

Fixed Config Snippet

After the table, output a corrected config snippet containing only the changed lines with brief inline comments:

# Fixed settings — replace in your config
ssl_protocols TLSv1.2 TLSv1.3;          # Remove deprecated TLS 1.0/1.1
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
worker_processes auto;

Next Steps

Always close with:

Apply fixes: Review each change before applying — test in staging first Full script: Use /linux-shell-scriptor to automate applying these changes OS hardening: Use /linux-security-hardener for a full system-level review Monitor: Use /linux-monitoring-setup to detect anomalies after reconfiguring

File Output

Write findings to ./audit/ in the current working directory:

audit/
  report-<type>-<YYYY-MM-DD>.md    ← full findings report
  fixed-<filename>                 ← corrected config (changed lines only)

Print the findings table and corrected snippet directly in chat — they are concise and immediately useful. The full written report is for archiving and diffing over time.

Nginx-Specific Rules

Check all of the following when auditing any nginx config:

SSH-Specific Rules

Systemd Unit Rules

Iptables / Nftables Rules

Security Checklist Reminders

Flag these patterns in any config type as 🔴 Critical:

• Hardcoded passwords, API keys, or tokens in config values
• World-readable permissions on config files with secrets (chmod 644 on /etc/ssl/private/)
• NOPASSWD: ALL in sudoers
• Wildcard (*) in AllowUsers or command grants
• Empty or commented-out authentication requirements

Sudoers-specific critical patterns:

• Cmnd_Alias containing /usr/bin/bash, /bin/sh, /bin/bash, sudoedit, su → shell escape for full root
• %group ALL=(ALL) NOPASSWD: ALL on a broad group (e.g. %wheel, %sudo, %docker) → unrestricted group sudo
• ALL=(ALL:ALL) NOPASSWD: /path/to/script * with wildcard arguments → argument injection
• visudo not being used to edit sudoers (syntax errors in sudoers can lock out all sudo access)