# Linux Security Analysis

> Use when performing a read-only, evidence-backed Linux security assessment across kernel, identity, network, services, storage, backups, and packages; use linux-server-hardening to remediate.

- Skill: `peterbamuhigire/linux-security-analysis` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add peterbamuhigire/linux-security-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/peterbamuhigire/linux-security-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: peterbamuhigire (https://skillmd.com/u/peterbamuhigire)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/peterbamuhigire/linux-security-analysis

---

# Linux Security Analysis

## Distro support

Two-family skill. The 10-layer audit applies to both families; some layers
inspect different tools. The body uses Debian/Ubuntu; substitute per this matrix.

| Audit layer | Debian/Ubuntu | RHEL family |
|---|---|---|
| Mandatory access control | AppArmor `aa-status` (profiles loaded/enforced) | SELinux `getenforce` must be **Enforcing**; `sestatus` |
| Firewall | `ufw status` | `firewall-cmd --list-all` |
| Installed packages | `dpkg -l`, `apt list --installed` | `rpm -qa`, `dnf list installed` |
| Pending updates | `apt list --upgradable` | `dnf check-update` |
| Auto updates | `unattended-upgrades` configured | `dnf-automatic.timer` active |
| Sudo group membership | `sudo` group | `wheel` group |
| Audit daemon | `auditd` | `auditd` (also surfaces SELinux AVC denials) |

**RHEL-family addition:** a security audit must flag SELinux not Enforcing,
stray `permissive` domains, and unreviewed AVC denials (`ausearch -m AVC`). See
[`../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md`](../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md)
and [`docs/multi-distro/plan.md`](../../docs/multi-distro/plan.md).

<!-- dual-compat-start -->

## Use when

- Performing a deep, read-only security audit of an Ubuntu/Debian server.
- Building a prioritized findings list before hardening work.
- Re-checking security posture after provisioning or major changes.

## Do not use when

- The task requires making changes; use `linux-server-hardening`.
- The task is limited to one narrower area such as secrets, firewalling, or access control.

## Required Inputs

| Artefact | Source | Required? | If absent |
|---|---|---|---|
| Host, distro, role, and exposure | Inventory and system owner | yes | Audit visible state; qualify context-sensitive severity |
| Approved scope and read-only access | Assessment owner | yes | Stop rather than exceed scope |
| Accepted risks and prior findings | Risk register or prior report | no | Report current state without claiming regression |
| Service/config evidence | Host and approved configuration sources | per control | Mark the check `not assessed` |

## Capability Contract

Default to read-only mode with read/search access only. Inspect files, services, packages, sockets, and logs without installing, reloading, rewriting, quarantining, or hardening. Mutation requires explicit authority in a separate linux-server-hardening task.

## Degraded Mode

When privileges, logs, tools, or probes are unavailable, finish the narrow observable checks and list every unassessed control. Do not score inaccessible evidence as compliant.

## Decision Rules

| Context | Action | Failure avoided |
|---|---|---|
| Internet-exposed exploitable weakness | Rank CRITICAL/HIGH with evidence | Understating immediate risk |
| Defence-in-depth gap without exposed path | Rank MEDIUM/LOW with rationale | Severity inflation |
| Control cannot be inspected | Mark `not assessed` | False assurance |
| Active compromise indicator | Preserve evidence and invoke incident process | Destructive audit activity |

## Workflow

1. Confirm scope, role, distro, exposure, time, and read-only boundary; stop if authority is unclear.
2. Collect command output across every applicable layer with family-specific tools.
3. Correlate config, listeners, identities, logs, backups, and packages; separate fact from inference.
4. Assign severity and confidence, recording every unassessed check.
5. Review findings for duplication and reproducibility; do not apply fixes.
6. Deliver the report and separate remediation handoff; recover from failed collection by retaining errors as evidence gaps and leaving system state unchanged.

## Evidence Produced

| Artefact | Acceptance |
|---|---|
| Security assessment evidence | Includes timestamped commands/config references, package/service/socket state, severity rationale, coverage matrix, and redactions |

## Quality standards

- Evidence must be concrete, reproducible, and severity-ranked.
- Keep audit and remediation separate.
- Cover every layer even if an early layer already exposes serious issues.

## Anti-patterns

- Mixing fixes into the audit. Fix: create a separately authorised remediation task.
- Reporting vague risk. Fix: cite command or configuration evidence.
- Declaring a host secure after two layers. Fix: include the complete coverage matrix.
- Treating a missing tool as a pass. Fix: mark the check not assessed.
- Copying generic severity. Fix: tie it to exposure and impact.
- Dumping secrets into evidence. Fix: redact values and cite protected paths.

## Outputs

| Artefact | Consumer | Acceptance condition |
|---|---|---|
| Severity-ranked report | Risk owner | Each finding has evidence, impact, confidence, and remediation |
| Evidence index | Reviewer | Commands and timestamps reproduce observations without secrets |
| Coverage statement | System owner | Lists passed, failed, and not-assessed layers |

## Worked Example

On a public RHEL web host, record `getenforce` returning `Permissive` alongside external exposure and relevant config. Rate the finding from role and exposure, but do not run `setenforce 1`; hand remediation to linux-server-hardening with compatibility checks.

<!-- dual-compat-end -->

## References

- [`references/audit-layers.md`](references/audit-layers.md)
- [`../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md`](../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md) — SELinux audit checks (RHEL family)

**This skill is self-contained.** The 10 audit layers below work on a stock
Debian/Ubuntu or RHEL-family server using nothing but built-in tools (substitute
family-specific tools per the Distro support matrix). The `sk-audit` script
in the **Optional fast path** section is a convenience wrapper — never
required.

**Read-only.** This skill observes and reports. It never modifies anything.
Use `linux-server-hardening` to fix what this skill finds.

Work through all 10 layers in `references/audit-layers.md`.
For each finding output: `[SEVERITY] Description`
Levels: **CRITICAL** | **HIGH** | **MEDIUM** | **LOW** | **INFO** | **PASS**

---

## Quick Start

```bash
# Optional: run the existing audit script first for a fast PASS/WARN/FAIL overview:
sudo bash ~/.claude/skills/scripts/server-audit.sh

# Then work through the 10 layers for the full deep analysis:
less ~/.claude/skills/linux-security-analysis/references/audit-layers.md
```

## The 10 Layers

See `references/audit-layers.md` for the complete commands for each layer.

| Layer | Focus | Critical findings |
|-------|-------|-------------------|
| 1 | System & kernel | ASLR off, pending CVEs |
| 2 | Users & auth | Extra UID-0, empty passwords, SSH config |
| 3 | Network exposure | Databases on 0.0.0.0 |
| 4 | Firewall | UFW inactive, unexpected open ports |
| 5 | Web server | TLS 1.0/1.1, PHP exposes version, expired certs |
| 6 | Databases | MySQL/Redis/PG on 0.0.0.0, anon users |
| 7 | File system | World-writable web files, cred files not 600 |
| 8 | IDS & monitoring | fail2ban down, AIDE missing |
| 9 | Backup integrity | No recent backup, rclone unreachable |
| 10 | Packages | Security updates pending, unexpected services |

## Severity Guidelines

| Rating | Meaning | Example |
|--------|---------|---------|
| CRITICAL | Exploitable right now | Database on 0.0.0.0, SSH with password auth |
| HIGH | Serious risk | No firewall, expired SSL cert |
| MEDIUM | Should fix soon | AIDE not installed, 20+ pending updates |
| LOW | Best practice gap | X11 forwarding enabled |
| INFO | Informational | Optional tools not installed |
| PASS | Correctly configured | — |

## Report Format

After all 10 layers, output:

```
╔══════════════════════════════════════════════════════╗
║           SECURITY ANALYSIS REPORT                  ║
╠══════════════════════════════════════════════════════╣
║ Host: <hostname>  OS: <distro>  Date: <YYYY-MM-DD>  ║
╚══════════════════════════════════════════════════════╝

[CRITICAL] ...
[HIGH]     ...
[MEDIUM]   ...
[PASS]     ...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 CRITICAL: X  HIGH: X  MEDIUM: X  LOW: X  PASS: X
 Security score: X%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Recommended: Run linux-server-hardening to fix CRITICAL and HIGH items first.
```

## Optional fast path (when sk-* scripts are installed)

Running `sudo install-skills-bin linux-security-analysis` installs:

| Task | Fast-path script |
|---|---|
| Full 14-section audit (same as the existing `server-audit.sh`) | `sudo sk-audit` |
| AppArmor profile status + recent denials | `sudo sk-apparmor-status` |

These are optional wrappers. The 10-layer manual procedure above is the
source of truth.

## Scripts

This skill installs the following scripts to `/usr/local/bin/`. To install:

```bash
sudo install-skills-bin linux-security-analysis
```

| Script | Source | Core? | Purpose |
|---|---|---|---|
| sk-audit | scripts/sk-audit.sh | yes | Read-only 14-section security audit producing PASS/WARN/FAIL report with score. |
| sk-apparmor-status | scripts/sk-apparmor-status.sh | no | List all AppArmor profiles with enforce/complain/disabled status, recent denials from audit.log. |