# Linux Health & Security Audit

[![CI](https://github.com/Jarnon404/linux-health-security-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/Jarnon404/linux-health-security-audit/actions/workflows/ci.yml) [![Pages](https://github.com/Jarnon404/linux-health-security-audit/actions/workflows/pages.yml/badge.svg)](https://github.com/Jarnon404/linux-health-security-audit/actions/workflows/pages.yml)


Read-only Bash audit tool for Debian, Ubuntu, Linux Mint and LMDE systems.

The script creates timestamped **TXT**, **HTML** and **JSON** reports for Linux workstation or small server baseline checks. It is designed as a practical maintenance and security review tool: simple enough to run on a laptop, useful enough to document real sysadmin work.

## What it checks

- OS, kernel, uptime and boot time
- Failed systemd units and enabled services
- Journal errors/warnings and kernel warnings
- CPU vulnerabilities and microcode status
- Memory, top CPU/memory processes
- Disk usage, inode usage, mounts and fstab
- SMART disk health when `smartctl` is installed
- APT repositories, kernel policy and package update state
- Network interfaces, routes, DNS and listening ports
- UFW/nftables firewall state
- Users with login shells and sudo/admin group membership
- SSH exposure and effective SSH daemon configuration
- SUID/SGID files, world-writable directories and timers
- AppArmor, Secure Boot, TPM and firmware update status
- Battery health, temperatures, hardware drivers, USB, Bluetooth and audio
- Flatpak updates and large log/cache directories

## Improvements in v1.1

- Generic project name instead of host-specific naming
- Automated OK / INFO / WARN findings section
- JSON summary output for easier parsing
- Better HTML report with finding cards and counters
- Privacy mode for public sharing
- CLI options for output directory, ping targets and ping disabling
- More robust checks for missing commands
- Safer read-only behavior, no package installs or system changes

## Usage

```bash
chmod +x scripts/linux-health-security-audit.sh
./scripts/linux-health-security-audit.sh
```

Reports are written to:

```text
~/audit-reports/
```

Open the newest HTML report:

```bash
xdg-open "$(ls -t ~/audit-reports/*linux-health-security-audit*.html | head -1)"
```

## Options

```text
-o, --output-dir DIR     Output directory
-p, --privacy MODE       Privacy mode: off, basic, full
    --no-ping            Skip internet ping tests
    --ping-ip IP         IP target for connectivity test
    --ping-dns HOST      DNS target for connectivity test
-h, --help               Show help
```

Examples:

```bash
./scripts/linux-health-security-audit.sh --privacy basic
./scripts/linux-health-security-audit.sh --privacy full --no-ping
./scripts/linux-health-security-audit.sh --output-dir /tmp/audit
```

## Privacy modes

| Mode | Behavior |
|---|---|
| `off` | No redaction. Best for private local troubleshooting. |
| `basic` | Redacts common IP and MAC address patterns. |
| `full` | Also redacts obvious emails, serial fields and `/home/<user>` paths. |

Privacy mode is best-effort text redaction, not a legal-grade anonymizer. Review public reports manually before publishing, because computers are creative little privacy hazards.

## Optional packages

The script works without these, but the report is richer with them:

```bash
sudo apt install smartmontools lm-sensors mokutil efibootmgr apparmor-utils
```

## Safety

This script is intended to be read-only. It does not install packages, remove files, modify firewall rules or change services.

Some commands use `sudo` to read richer system status. If sudo is not available, those sections may show partial output or warnings.

## Portfolio use

This project demonstrates practical Linux administration, Bash automation, security baseline thinking and readable technical reporting.


## Links

- Repository: https://github.com/Jarnon404/linux-health-security-audit
- GitHub Pages: https://jarnon404.github.io/linux-health-security-audit/
- Portfolio hub: https://github.nousiainen.eu/

## Public safety note

This repository is intended to contain only public-safe material. Do not commit customer-specific data, tenant identifiers, credentials, generated audit reports, internal hostnames, private IP addresses or environment-specific exports.