Linux Security Analysis

Linux Security Analysis

Distro support

Two-family skill. The 10-layer audit applies to both families; some layers inspect different tools. The body uses Debian/Ubuntu; substitute per this matrix.

RHEL-family addition: a security audit must flag SELinux not Enforcing, stray permissive domains, and unreviewed AVC denials (ausearch -m AVC). See ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md and docs/multi-distro/plan.md.

Use when

• Performing a deep, read-only security audit of an Ubuntu/Debian server.
• Building a prioritized findings list before hardening work.
• Re-checking security posture after provisioning or major changes.

Do not use when

• The task requires making changes; use linux-server-hardening.
• The task is limited to one narrower area such as secrets, firewalling, or access control.

Required Inputs

Capability Contract

Default to read-only mode with read/search access only. Inspect files, services, packages, sockets, and logs without installing, reloading, rewriting, quarantining, or hardening. Mutation requires explicit authority in a separate linux-server-hardening task.

Degraded Mode

When privileges, logs, tools, or probes are unavailable, finish the narrow observable checks and list every unassessed control. Do not score inaccessible evidence as compliant.

Decision Rules

Workflow

1. Confirm scope, role, distro, exposure, time, and read-only boundary; stop if authority is unclear.
2. Collect command output across every applicable layer with family-specific tools.
3. Correlate config, listeners, identities, logs, backups, and packages; separate fact from inference.
4. Assign severity and confidence, recording every unassessed check.
5. Review findings for duplication and reproducibility; do not apply fixes.
6. Deliver the report and separate remediation handoff; recover from failed collection by retaining errors as evidence gaps and leaving system state unchanged.

Evidence Produced

Quality standards

• Evidence must be concrete, reproducible, and severity-ranked.
• Keep audit and remediation separate.
• Cover every layer even if an early layer already exposes serious issues.

Anti-patterns

• Mixing fixes into the audit. Fix: create a separately authorised remediation task.
• Reporting vague risk. Fix: cite command or configuration evidence.
• Declaring a host secure after two layers. Fix: include the complete coverage matrix.
• Treating a missing tool as a pass. Fix: mark the check not assessed.
• Copying generic severity. Fix: tie it to exposure and impact.
• Dumping secrets into evidence. Fix: redact values and cite protected paths.

Outputs

Worked Example

On a public RHEL web host, record getenforce returning Permissive alongside external exposure and relevant config. Rate the finding from role and exposure, but do not run setenforce 1; hand remediation to linux-server-hardening with compatibility checks.

References

• references/audit-layers.md
• ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md — SELinux audit checks (RHEL family)

This skill is self-contained. The 10 audit layers below work on a stock Debian/Ubuntu or RHEL-family server using nothing but built-in tools (substitute family-specific tools per the Distro support matrix). The sk-audit script in the Optional fast path section is a convenience wrapper — never required.

Read-only. This skill observes and reports. It never modifies anything. Use linux-server-hardening to fix what this skill finds.

Work through all 10 layers in references/audit-layers.md. For each finding output: [SEVERITY] Description Levels: CRITICAL | HIGH | MEDIUM | LOW | INFO | PASS

Quick Start

# Optional: run the existing audit script first for a fast PASS/WARN/FAIL overview:
sudo bash ~/.claude/skills/scripts/server-audit.sh

# Then work through the 10 layers for the full deep analysis:
less ~/.claude/skills/linux-security-analysis/references/audit-layers.md

The 10 Layers

See references/audit-layers.md for the complete commands for each layer.

Severity Guidelines

Report Format

After all 10 layers, output:

╔══════════════════════════════════════════════════════╗
║           SECURITY ANALYSIS REPORT                  ║
╠══════════════════════════════════════════════════════╣
║ Host: <hostname>  OS: <distro>  Date: <YYYY-MM-DD>  ║
╚══════════════════════════════════════════════════════╝

[CRITICAL] ...
[HIGH]     ...
[MEDIUM]   ...
[PASS]     ...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 CRITICAL: X  HIGH: X  MEDIUM: X  LOW: X  PASS: X
 Security score: X%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Recommended: Run linux-server-hardening to fix CRITICAL and HIGH items first.

Optional fast path (when sk-* scripts are installed)

Running sudo install-skills-bin linux-security-analysis installs:

These are optional wrappers. The 10-layer manual procedure above is the source of truth.

Scripts

This skill installs the following scripts to /usr/local/bin/. To install:

sudo install-skills-bin linux-security-analysis