Distro support
Two-family skill. The 10-layer audit applies to both families; some layers inspect different tools. The body uses Debian/Ubuntu; substitute per this matrix.
| Audit layer | Debian/Ubuntu | RHEL family |
|---|---|---|
| Mandatory access control | AppArmor aa-status (profiles loaded/enforced) |
SELinux getenforce must be Enforcing; sestatus |
| Firewall | ufw status |
firewall-cmd --list-all |
| Installed packages | dpkg -l, apt list --installed |
rpm -qa, dnf list installed |
| Pending updates | apt list --upgradable |
dnf check-update |
| Auto updates | unattended-upgrades configured |
dnf-automatic.timer active |
| Sudo group membership | sudo group |
wheel group |
| Audit daemon | auditd |
auditd (also surfaces SELinux AVC denials) |
RHEL-family addition: a security audit must flag SELinux not Enforcing,
stray permissive domains, and unreviewed AVC denials (ausearch -m AVC). See
../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md
and docs/multi-distro/plan.md.
Use when
- Performing a deep, read-only security audit of an Ubuntu/Debian server.
- Building a prioritized findings list before hardening work.
- Re-checking security posture after provisioning or major changes.
Do not use when
- The task requires making changes; use
linux-server-hardening. - The task is limited to one narrower area such as secrets, firewalling, or access control.
Required Inputs
| Artefact | Source | Required? | If absent |
|---|---|---|---|
| Host, distro, role, and exposure | Inventory and system owner | yes | Audit visible state; qualify context-sensitive severity |
| Approved scope and read-only access | Assessment owner | yes | Stop rather than exceed scope |
| Accepted risks and prior findings | Risk register or prior report | no | Report current state without claiming regression |
| Service/config evidence | Host and approved configuration sources | per control | Mark the check not assessed |
Capability Contract
Default to read-only mode with read/search access only. Inspect files, services, packages, sockets, and logs without installing, reloading, rewriting, quarantining, or hardening. Mutation requires explicit authority in a separate linux-server-hardening task.
Degraded Mode
When privileges, logs, tools, or probes are unavailable, finish the narrow observable checks and list every unassessed control. Do not score inaccessible evidence as compliant.
Decision Rules
| Context | Action | Failure avoided |
|---|---|---|
| Internet-exposed exploitable weakness | Rank CRITICAL/HIGH with evidence | Understating immediate risk |
| Defence-in-depth gap without exposed path | Rank MEDIUM/LOW with rationale | Severity inflation |
| Control cannot be inspected | Mark not assessed |
False assurance |
| Active compromise indicator | Preserve evidence and invoke incident process | Destructive audit activity |
Workflow
- Confirm scope, role, distro, exposure, time, and read-only boundary; stop if authority is unclear.
- Collect command output across every applicable layer with family-specific tools.
- Correlate config, listeners, identities, logs, backups, and packages; separate fact from inference.
- Assign severity and confidence, recording every unassessed check.
- Review findings for duplication and reproducibility; do not apply fixes.
- Deliver the report and separate remediation handoff; recover from failed collection by retaining errors as evidence gaps and leaving system state unchanged.
Evidence Produced
| Artefact | Acceptance |
|---|---|
| Security assessment evidence | Includes timestamped commands/config references, package/service/socket state, severity rationale, coverage matrix, and redactions |
Quality standards
- Evidence must be concrete, reproducible, and severity-ranked.
- Keep audit and remediation separate.
- Cover every layer even if an early layer already exposes serious issues.
Anti-patterns
- Mixing fixes into the audit. Fix: create a separately authorised remediation task.
- Reporting vague risk. Fix: cite command or configuration evidence.
- Declaring a host secure after two layers. Fix: include the complete coverage matrix.
- Treating a missing tool as a pass. Fix: mark the check not assessed.
- Copying generic severity. Fix: tie it to exposure and impact.
- Dumping secrets into evidence. Fix: redact values and cite protected paths.
Outputs
| Artefact | Consumer | Acceptance condition |
|---|---|---|
| Severity-ranked report | Risk owner | Each finding has evidence, impact, confidence, and remediation |
| Evidence index | Reviewer | Commands and timestamps reproduce observations without secrets |
| Coverage statement | System owner | Lists passed, failed, and not-assessed layers |
Worked Example
On a public RHEL web host, record getenforce returning Permissive alongside external exposure and relevant config. Rate the finding from role and exposure, but do not run setenforce 1; hand remediation to linux-server-hardening with compatibility checks.
References
references/audit-layers.md../../07-security-and-hardening/linux-server-hardening/references/selinux-reference.md— SELinux audit checks (RHEL family)
This skill is self-contained. The 10 audit layers below work on a stock
Debian/Ubuntu or RHEL-family server using nothing but built-in tools (substitute
family-specific tools per the Distro support matrix). The sk-audit script
in the Optional fast path section is a convenience wrapper — never
required.
Read-only. This skill observes and reports. It never modifies anything.
Use linux-server-hardening to fix what this skill finds.
Work through all 10 layers in references/audit-layers.md.
For each finding output: [SEVERITY] Description
Levels: CRITICAL | HIGH | MEDIUM | LOW | INFO | PASS
Quick Start
# Optional: run the existing audit script first for a fast PASS/WARN/FAIL overview:
sudo bash ~/.claude/skills/scripts/server-audit.sh
# Then work through the 10 layers for the full deep analysis:
less ~/.claude/skills/linux-security-analysis/references/audit-layers.md
The 10 Layers
See references/audit-layers.md for the complete commands for each layer.
| Layer | Focus | Critical findings |
|---|---|---|
| 1 | System & kernel | ASLR off, pending CVEs |
| 2 | Users & auth | Extra UID-0, empty passwords, SSH config |
| 3 | Network exposure | Databases on 0.0.0.0 |
| 4 | Firewall | UFW inactive, unexpected open ports |
| 5 | Web server | TLS 1.0/1.1, PHP exposes version, expired certs |
| 6 | Databases | MySQL/Redis/PG on 0.0.0.0, anon users |
| 7 | File system | World-writable web files, cred files not 600 |
| 8 | IDS & monitoring | fail2ban down, AIDE missing |
| 9 | Backup integrity | No recent backup, rclone unreachable |
| 10 | Packages | Security updates pending, unexpected services |
Severity Guidelines
| Rating | Meaning | Example |
|---|---|---|
| CRITICAL | Exploitable right now | Database on 0.0.0.0, SSH with password auth |
| HIGH | Serious risk | No firewall, expired SSL cert |
| MEDIUM | Should fix soon | AIDE not installed, 20+ pending updates |
| LOW | Best practice gap | X11 forwarding enabled |
| INFO | Informational | Optional tools not installed |
| PASS | Correctly configured | — |
Report Format
After all 10 layers, output:
╔══════════════════════════════════════════════════════╗
║ SECURITY ANALYSIS REPORT ║
╠══════════════════════════════════════════════════════╣
║ Host: <hostname> OS: <distro> Date: <YYYY-MM-DD> ║
╚══════════════════════════════════════════════════════╝
[CRITICAL] ...
[HIGH] ...
[MEDIUM] ...
[PASS] ...
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CRITICAL: X HIGH: X MEDIUM: X LOW: X PASS: X
Security score: X%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Recommended: Run linux-server-hardening to fix CRITICAL and HIGH items first.
Optional fast path (when sk-* scripts are installed)
Running sudo install-skills-bin linux-security-analysis installs:
| Task | Fast-path script |
|---|---|
Full 14-section audit (same as the existing server-audit.sh) |
sudo sk-audit |
| AppArmor profile status + recent denials | sudo sk-apparmor-status |
These are optional wrappers. The 10-layer manual procedure above is the source of truth.
Scripts
This skill installs the following scripts to /usr/local/bin/. To install:
sudo install-skills-bin linux-security-analysis
| Script | Source | Core? | Purpose |
|---|---|---|---|
| sk-audit | scripts/sk-audit.sh | yes | Read-only 14-section security audit producing PASS/WARN/FAIL report with score. |
| sk-apparmor-status | scripts/sk-apparmor-status.sh | no | List all AppArmor profiles with enforce/complain/disabled status, recent denials from audit.log. |