GitHub - jonaslejon/linux-security-audit-plugin: Claude Code plugin: audits Linux hardening posture and produces a risk-ranked report. 249 checks — kernel, filesystem, privesc paths, egress, TLS/mTLS, secrets, image hygiene, config drift. Live host, mounted image, or container. · GitHub
/" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
jonaslejon
linux-security-audit-plugin
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>13 Commits<br>13 Commits
.claude-plugin
.claude-plugin
plugins/linux-security-audit
plugins/linux-security-audit
.gitignore
.gitignore
CHANGELOG.md
CHANGELOG.md
LICENSE
LICENSE
README.md
README.md
View all files
Repository files navigation
linux-security-audit
A Claude Code plugin that audits how hardened a Linux system is and produces a<br>risk-ranked report — what to fix, in what order, with the exact change and its blast radius.
It is an auditing tool, not a hardening script. It changes nothing by default.
Requires Linux. The collector refuses to run on any other kernel rather than emit a report<br>full of controls that only look absent because /proc, /sys and the GNU userland are missing.<br>Run it on the host, over SSH, or against a mounted Linux filesystem with --root.
Install
/plugin marketplace add jonaslejon/linux-security-audit-plugin<br>/plugin install linux-security-audit
Then ask Claude to audit a host, or point it at an image.
What it looks at
262 checks across 33 areas, including:
Kernel — sysctls, boot parameters, module blacklists, lockdown, CPU mitigations
Filesystem — mount options (nosuid/noexec/nodev), SUID/SGID, capabilities, world-writable paths
Access control — SELinux/AppArmor confinement (not just "enforcing"), sudoers, PAM, password and lockout policy
Privilege escalation — sudo GTFOBins-capable grants and env_keep, writable systemd units, writable PATH, NFS no_root_squash, exposed credentials
Boot and service-start trust chain — everything root reads on the way up: EnvironmentFile, ld.so search paths, udev RUN, plus what root processes currently hold open
Network — firewall policy per direction including egress , listener/rule reconciliation, bind-address discipline, exposed services
TLS — cipher and protocol validation by active probe, and whether mutual TLS is enforced rather than merely requested
eBPF — loaded programs by type, unattributed and pinned objects, XDP and tc attachments, BPF LSM programs, and CAP_BPF holders. modules_disabled=1 does not constrain eBPF, so an in-kernel implant needs no module
Services — SSH (public-key-only enforcement, forwarding channels, Match block overrides), web servers, databases, and insecure-by-default daemons
Secrets — cleartext credentials and private keys on disk, reported with values redacted
Containers and Docker — daemon hardening (userns-remap, icc, default no-new-privileges), running-container posture (privileged, mounted docker.sock, missing memory/PID limits, writable rootfs), and credentials baked into image layers
Images and templates — SSH host keys or entropy seeds baked into a golden image
Drift — where persisted config and running kernel disagree, and in which direction
Three collection modes
Mode<br>How<br>What is valid
Live host<br>run it directly<br>everything
Mounted image<br>--root /mnt<br>configuration only; runtime checks report NA
Container<br>run inside it<br>container-level checks; host-owned ones report NA
Running it
The plugin drives this for you, but the collector is a standalone script with no dependencies<br>beyond a POSIX shell and the tools it audits:
report.txt
# locally<br>sudo bash "$S" > report.txt
# a mounted image or golden template — configuration only<br>sudo bash "$S" --root /mnt/image > image-report.txt
# a container image<br>docker run --rm -i bash -s image-report.txt">S=~/.claude/plugins/.../skills/linux-security-audit/scripts/lsa-collect.sh
# a live host, over SSH, leaving nothing behind on the target<br>ssh -p 22 user@host 'sudo bash -s' "$S" > report.txt
# locally<br>sudo bash "$S" > report.txt
# a mounted image or golden template — configuration only<br>sudo bash "$S" --root /mnt/image > image-report.txt
# a container image<br>docker run --rm -i image> bash -s "$S" > image-report.txt
Flag<br>Effect
--quick<br>Skip whole-filesystem walks (SUID, world-writable, secrets). Use on large or slow storage
--passive (--no-probe)<br>Disable every active check — no loopback connections, no NTP queries
--root PATH<br>Offline mode against a mounted filesystem; runtime checks report NA
--apt-update<br>Also run...