skyvanguard Security Auditor
Overview
Audit system security configuration by checking for common misconfigurations, exposed services, weak permissions, and missing patches. Produces a security posture report with severity ratings.
Process
Step 1: Scope the Audit
Determine what to audit based on user request:
| Scope | What to check |
|---|---|
| Full system | All categories below |
| Network exposure | Open ports, listening services, firewall |
| User/permissions | Accounts, sudo, file permissions |
| Updates/patches | Missing security updates |
| Services | Running services, unnecessary daemons |
| SSH/Remote | SSH config, remote access |
| File system | World-writable, SUID, sensitive files |
Step 2: Open Ports and Services
Listening services:
| Platform | Command |
|---|---|
| Windows | Get-NetTCPConnection -State Listen | Select LocalAddress, LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} | Sort LocalPort |
| Linux | ss -tlnp |
| macOS | lsof -iTCP -sTCP:LISTEN -n -P |
Firewall status:
| Platform | Command |
|---|---|
| Windows | Get-NetFirewallProfile | Select Name, Enabled |
| Linux | ufw status 2>/dev/null || iptables -L -n 2>/dev/null || firewall-cmd --state 2>/dev/null |
| macOS | pfctl -s info 2>/dev/null | head -5 |
External exposure check:
# Check if common dangerous ports are exposed
# 21 (FTP), 23 (Telnet), 3389 (RDP), 5900 (VNC), 6379 (Redis), 27017 (MongoDB)
Step 3: User Accounts and Privileges
User accounts:
| Platform | Command |
|---|---|
| Windows | Get-LocalUser | Select Name, Enabled, LastLogon, PasswordRequired |
| Linux | `awk -F: '$3 >= 1000 |
| macOS | `dscl . list /Users UniqueID | awk '$2 >= 500 |
Privileged access:
| Platform | Command |
|---|---|
| Windows | Get-LocalGroupMember -Group "Administrators" |
| Linux | getent group sudo wheel 2>/dev/null and cat /etc/sudoers.d/* 2>/dev/null | grep -v "^#" |
| macOS | dscl . -read /Groups/admin GroupMembership |
Password policy:
| Platform | Command |
|---|---|
| Windows | Get-ADDefaultDomainPasswordPolicy 2>/dev/null || net accounts |
| Linux | cat /etc/login.defs | grep -E "^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_MIN_LEN" |
Step 4: SSH Configuration (Linux/macOS)
# SSH config issues
grep -E "^(PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords|X11Forwarding|Protocol)" /etc/ssh/sshd_config 2>/dev/null
# Authorized keys (check for unexpected)
find /home -name "authorized_keys" -exec wc -l {} \; 2>/dev/null
cat ~/.ssh/authorized_keys 2>/dev/null | wc -l
Security checks:
| Setting | Secure Value | Risk if Wrong |
|---|---|---|
| PermitRootLogin | no | Direct root access |
| PasswordAuthentication | no | Brute force attacks |
| PermitEmptyPasswords | no | No-password login |
| Protocol | 2 | Weak protocol |
Step 5: System Updates
Pending security updates:
| Platform | Command |
|---|---|
| Windows | Get-HotFix | Sort-Object InstalledOn -Descending | Select -First 5 |
| Ubuntu/Debian | apt list --upgradable 2>/dev/null | grep -i securi |
| RHEL/CentOS | yum check-update --security 2>/dev/null || dnf check-update --security 2>/dev/null |
| macOS | softwareupdate -l 2>&1 |
Last update date:
| Platform | Command |
|---|---|
| Windows | (Get-HotFix | Sort InstalledOn -Desc | Select -First 1).InstalledOn |
| Linux | stat /var/cache/apt/pkgcache.bin 2>/dev/null || rpm -qa --last | head -1 |
Step 6: File System Security
World-writable files (Linux/macOS):
find / -type f -perm -o+w -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null | head -20
SUID/SGID binaries (Linux/macOS):
find / -type f \( -perm -4000 -o -perm -2000 \) -not -path "/proc/*" 2>/dev/null | head -20
Sensitive file permissions:
# Check critical file permissions
ls -la /etc/shadow /etc/passwd /etc/sudoers ~/.ssh/id_* 2>/dev/null
Windows sensitive locations:
# Check for credentials in common locations
Get-ChildItem -Path $env:USERPROFILE -Include *.pem,*.key,*.pfx,id_rsa -Recurse -ErrorAction SilentlyContinue | Select FullName
Step 7: Running Services Audit
Unnecessary services check:
| Platform | Command |
|---|---|
| Windows | Get-Service | Where-Object {$_.Status -eq 'Running'} | Select Name, DisplayName | Sort DisplayName |
| Linux | systemctl list-units --type=service --state=running |
Common risky services to flag:
| Service | Risk | Recommendation |
|---|---|---|
| telnet | HIGH | Replace with SSH |
| ftp | HIGH | Replace with SFTP |
| rsh/rlogin | HIGH | Remove immediately |
| unbound Redis | HIGH | Add auth, bind localhost |
| unbound MongoDB | HIGH | Add auth, bind localhost |
| SMBv1 | MEDIUM | Disable, use SMBv2+ |
| SNMP v1/v2 | MEDIUM | Upgrade to v3 |
Step 8: Present Security Report
## Security Audit Report
**Host:** [hostname] | **OS:** [os] | **Date:** [timestamp]
### Security Score: [X/10]
### Findings by Severity
#### CRITICAL
- [ ] [finding with evidence]
#### HIGH
- [ ] [finding with evidence]
#### MEDIUM
- [ ] [finding with evidence]
#### LOW / Informational
- [ ] [finding]
### Summary
| Category | Status | Issues |
|----------|--------|--------|
| Network Exposure | [PASS/WARN/FAIL] | [count] |
| User Accounts | [PASS/WARN/FAIL] | [count] |
| SSH Config | [PASS/WARN/FAIL] | [count] |
| Updates | [PASS/WARN/FAIL] | [count] |
| File Permissions | [PASS/WARN/FAIL] | [count] |
| Services | [PASS/WARN/FAIL] | [count] |
### Remediation Priority
1. [Critical items first]
2. [High items]
3. [Medium items]
Rules
- NEVER attempt to exploit any vulnerability found
- NEVER modify security settings without explicit user permission
- NEVER access or display password hashes or private keys content
- Report findings objectively with evidence
- Flag false positives when context suggests they're intentional (e.g., dev machine)
- If audit requires elevated privileges, ask user to run specific commands
- Do NOT install scanning tools; use only built-in OS commands