security-audit
Audit system security configuration for vulnerabilities. Use when the user says "audit security", "harden server", "check security", "is my server secure", "security review", or asks about server hardening.
When & Why to Use This Skill
This Claude skill automates comprehensive Linux system security audits by analyzing SSH configurations, firewall rules, user permissions, and service vulnerabilities. It identifies critical risks and provides actionable remediation commands to help administrators harden their servers against unauthorized access and potential exploits.
Use Cases
- Initial Server Hardening: Run a full security sweep on a newly deployed Linux instance to ensure industry-standard configurations for SSH, firewalls, and user access.
- Compliance and Vulnerability Assessment: Periodically audit production environments to identify weak file permissions, unauthorized sudo access, or pending security patches.
- Incident Response and Investigation: Quickly analyze system configurations during a security review to detect misconfigurations or potential entry points used by attackers.
| name | security-audit |
|---|---|
| description | Audit system security configuration for vulnerabilities. Use when the user says "audit security", "harden server", "check security", "is my server secure", "security review", or asks about server hardening. |
| allowed-tools | Bash, Read, Grep |
Security Audit
Audit Linux system security configurations and recommend hardening measures.
Instructions
- Check each security category below
- Document findings with severity
- Provide specific remediation steps
- Prioritize critical issues
SSH configuration
# Check SSH config
grep -E "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|Port)" /etc/ssh/sshd_config
# Recommended settings
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Critical: Flag if PermitRootLogin yes or PasswordAuthentication yes
Firewall
# UFW status
ufw status verbose
# iptables
iptables -L -n -v
ip6tables -L -n -v
# nftables
nft list ruleset
Critical: Flag if firewall is disabled or allows 0.0.0.0/0 on sensitive ports
User accounts
# Users with login shells
grep -v '/nologin\|/false' /etc/passwd
# Users with empty passwords
awk -F: '($2 == "") {print $1}' /etc/shadow
# Sudoers
grep -v '^#' /etc/sudoers /etc/sudoers.d/* 2>/dev/null
# Check for unauthorized sudo
grep NOPASSWD /etc/sudoers /etc/sudoers.d/*
File permissions
# World-writable files
find / -type f -perm -002 2>/dev/null
# SUID/SGID binaries
find / -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null
# SSH key permissions
ls -la ~/.ssh/
Services and ports
# Listening services
ss -tuln
# Enabled services
systemctl list-unit-files --state=enabled
# Running services
systemctl list-units --type=service --state=running
Updates
# Pending security updates
apt list --upgradable 2>/dev/null | grep -i security
dnf check-update --security 2>/dev/null
# Kernel version
uname -r
Output format
## Critical Issues
- [ ] SSH allows root login with password
## Warnings
- [ ] Firewall allows port 22 from any IP
## Recommendations
- [ ] Enable automatic security updates
- [ ] Configure fail2ban
## Passed Checks
- [x] No users with empty passwords
Rules
- MUST check all categories before concluding
- MUST prioritize by severity (critical > warning > info)
- MUST provide specific remediation commands
- Never disable security features without explicit approval
- Never expose found credentials or sensitive data
- Always recommend backup before making changes