linux-security-analysis

name	linux-security-analysis
description	Use when performing a read-only, evidence-backed Linux security assessment across kernel, identity, network, services, storage, backups, and packages; use linux-server-hardening to remediate.
license	MIT
metadata	{"portable":true,"compatible_with":["claude-code","codex"],"author":"Peter Bamuhigire","author_url":"techguypeter.com","author_contact":"[phone]"}

Linux Security Analysis

Distro support

Two-family skill. The 10-layer audit applies to both families; some layers inspect different tools. The body uses Debian/Ubuntu; substitute per this matrix.

Audit layer	Debian/Ubuntu	RHEL family
Mandatory access control	AppArmor aa-status (profiles loaded/enforced)	SELinux getenforce must be Enforcing; sestatus
Firewall	ufw status	firewall-cmd --list-all
Installed packages	dpkg -l, apt list --installed	rpm -qa, dnf list installed
Pending updates	apt list --upgradable	dnf check-update
Auto updates	unattended-upgrades configured	dnf-automatic.timer active
Sudo group membership	sudo group	wheel group
Audit daemon	auditd	auditd (also surfaces SELinux AVC denials)

RHEL-family addition: a security audit must flag SELinux not Enforcing, stray permissive domains, and unreviewed AVC denials (ausearch -m AVC). See ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md and docs/multi-distro/plan.md.

Use when

• Performing a deep, read-only security audit of an Ubuntu/Debian server.
• Building a prioritized findings list before hardening work.
• Re-checking security posture after provisioning or major changes.

Do not use when

• The task requires making changes; use linux-server-hardening.
• The task is limited to one narrower area such as secrets, firewalling, or access control.

Required Inputs

Artefact	Source	Required?	If absent
Host, distro, role, and exposure	Inventory and system owner	yes	Audit visible state; qualify context-sensitive severity
Approved scope and read-only access	Assessment owner	yes	Stop rather than exceed scope
Accepted risks and prior findings	Risk register or prior report	no	Report current state without claiming regression
Service/config evidence	Host and approved configuration sources	per control	Mark the check not assessed

Capability Contract

Default to read-only mode with read/search access only. Inspect files, services, packages, sockets, and logs without installing, reloading, rewriting, quarantining, or hardening. Mutation requires explicit authority in a separate linux-server-hardening task.

Degraded Mode

When privileges, logs, tools, or probes are unavailable, finish the narrow observable checks and list every unassessed control. Do not score inaccessible evidence as compliant.

Decision Rules

Context	Action	Failure avoided
Internet-exposed exploitable weakness	Rank CRITICAL/HIGH with evidence	Understating immediate risk
Defence-in-depth gap without exposed path	Rank MEDIUM/LOW with rationale	Severity inflation
Control cannot be inspected	Mark not assessed	False assurance
Active compromise indicator	Preserve evidence and invoke incident process	Destructive audit activity

Workflow

1. Confirm scope, role, distro, exposure, time, and read-only boundary; stop if authority is unclear.
2. Collect command output across every applicable layer with family-specific tools.
3. Correlate config, listeners, identities, logs, backups, and packages; separate fact from inference.
4. Assign severity and confidence, recording every unassessed check.
5. Review findings for duplication and reproducibility; do not apply fixes.
6. Deliver the report and separate remediation handoff; recover from failed collection by retaining errors as evidence gaps and leaving system state unchanged.

Evidence Produced

Artefact	Acceptance
Security assessment evidence	Includes timestamped commands/config references, package/service/socket state, severity rationale, coverage matrix, and redactions

Quality standards

• Evidence must be concrete, reproducible, and severity-ranked.
• Keep audit and remediation separate.
• Cover every layer even if an early layer already exposes serious issues.

Anti-patterns

• Mixing fixes into the audit. Fix: create a separately authorised remediation task.
• Reporting vague risk. Fix: cite command or configuration evidence.
• Declaring a host secure after two layers. Fix: include the complete coverage matrix.
• Treating a missing tool as a pass. Fix: mark the check not assessed.
• Copying generic severity. Fix: tie it to exposure and impact.
• Dumping secrets into evidence. Fix: redact values and cite protected paths.

Outputs

Artefact	Consumer	Acceptance condition
Severity-ranked report	Risk owner	Each finding has evidence, impact, confidence, and remediation
Evidence index	Reviewer	Commands and timestamps reproduce observations without secrets
Coverage statement	System owner	Lists passed, failed, and not-assessed layers

Worked Example

On a public RHEL web host, record getenforce returning Permissive alongside external exposure and relevant config. Rate the finding from role and exposure, but do not run setenforce 1; hand remediation to linux-server-hardening with compatibility checks.

References

• references/audit-layers.md
• ../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md — SELinux audit checks (RHEL family)

This skill is self-contained. The 10 audit layers below work on a stock Debian/Ubuntu or RHEL-family server using nothing but built-in tools (substitute family-specific tools per the Distro support matrix). The sk-audit script in the Optional fast path section is a convenience wrapper — never required.

Read-only. This skill observes and reports. It never modifies anything. Use linux-server-hardening to fix what this skill finds.

Work through all 10 layers in references/audit-layers.md. For each finding output: [SEVERITY] Description Levels: CRITICAL | HIGH | MEDIUM | LOW | INFO | PASS

---

Quick Start

# Optional: run the existing audit script first for a fast PASS/WARN/FAIL overview:
sudo bash ~/.claude/skills/scripts/server-audit.sh

# Then work through the 10 layers for the full deep analysis:
less ~/.claude/skills/linux-security-analysis/references/audit-layers.md

The 10 Layers

See references/audit-layers.md for the complete commands for each layer.

Layer	Focus	Critical findings
1	System & kernel	ASLR off, pending CVEs
2	Users & auth	Extra UID-0, empty passwords, SSH config
3	Network exposure	Databases on 0.0.0.0
4	Firewall	UFW inactive, unexpected open ports
5	Web server	TLS 1.0/1.1, PHP exposes version, expired certs
6	Databases	MySQL/Redis/PG on 0.0.0.0, anon users
7	File system	World-writable web files, cred files not 600
8	IDS & monitoring	fail2ban down, AIDE missing
9	Backup integrity	No recent backup, rclone unreachable
10	Packages	Security updates pending, unexpected services

Severity Guidelines

Rating	Meaning	Example
CRITICAL	Exploitable right now	Database on 0.0.0.0, SSH with password auth
HIGH	Serious risk	No firewall, expired SSL cert
MEDIUM	Should fix soon	AIDE not installed, 20+ pending updates
LOW	Best practice gap	X11 forwarding enabled
INFO	Informational	Optional tools not installed
PASS	Correctly configured	—

Report Format

After all 10 layers, output:

╔══════════════════════════════════════════════════════╗
║           SECURITY ANALYSIS REPORT                  ║
╠══════════════════════════════════════════════════════╣
║ Host: <hostname>  OS: <distro>  Date: <YYYY-MM-DD>  ║
╚══════════════════════════════════════════════════════╝

[CRITICAL] ...
[HIGH]     ...
[MEDIUM]   ...
[PASS]     ...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 CRITICAL: X  HIGH: X  MEDIUM: X  LOW: X  PASS: X
 Security score: X%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Recommended: Run linux-server-hardening to fix CRITICAL and HIGH items first.

Optional fast path (when sk-* scripts are installed)

Running sudo install-skills-bin linux-security-analysis installs:

Task	Fast-path script
Full 14-section audit (same as the existing server-audit.sh)	sudo sk-audit
AppArmor profile status + recent denials	sudo sk-apparmor-status

These are optional wrappers. The 10-layer manual procedure above is the source of truth.

Scripts

This skill installs the following scripts to /usr/local/bin/. To install:

sudo install-skills-bin linux-security-analysis

Script	Source	Core?	Purpose
sk-audit	scripts/sk-audit.sh	yes	Read-only 14-section security audit producing PASS/WARN/FAIL report with score.
sk-apparmor-status	scripts/sk-apparmor-status.sh	no	List all AppArmor profiles with enforce/complain/disabled status, recent denials from audit.log.