A non-invasive Linux security auditing tool that auto-detects the OS distribution and runs multiple security scanners, consolidating all outputs into a timestamped directory.
- Auto-detection: Automatically detects OS family (Debian/Ubuntu, RHEL/CentOS/Fedora/Rocky, Arch)
- Multiple scanners: Runs Lynis, rkhunter, chkrootkit, and OpenSCAP
- Graceful degradation: Skips missing tools with warnings (or fails on request)
- Timestamped output: Creates
YYYYMMDD-HHMMSSsubdirectories for each run - Summary report: Generates a consolidated summary of all scan results
- Non-invasive: Read-only system access; writes only to specified output directory
| Family | Distributions | Package Manager |
|---|---|---|
| Debian | Ubuntu, Debian, Linux Mint, Pop!_OS | apt |
| RHEL | CentOS, RHEL, Rocky Linux, AlmaLinux, Fedora, Oracle Linux | dnf / yum |
| Arch | Arch Linux, Manjaro, EndeavourOS | pacman |
- Bash >= 5.0
- Root privileges (for accessing privileged system files)
| Tool | Purpose | Install |
|---|---|---|
| Lynis | Security auditing | apt install lynis / dnf install lynis / pacman -S lynis |
| rkhunter | Rootkit detection | apt install rkhunter / dnf install rkhunter / pacman -S rkhunter |
| chkrootkit | Rootkit detection | apt install chkrootkit / dnf install chkrootkit / paru -S chkrootkit |
| OpenSCAP | SCAP evaluation | apt install libopenscap8 / dnf install openscap-scanner / paru -S gconf openscap |
| scap-security-guide | SCAP content | apt install ssg-debian / dnf install scap-security-guide / paru -S scap-security-guide |
The fastest way to install audit-report:
curl -fsSL https://raw.githubusercontent.com/longcipher/audit-report/master/install.sh | sudo bashCustom installation prefix:
curl -fsSL https://raw.githubusercontent.com/longcipher/audit-report/master/install.sh | sudo bash -s -- --prefix ~/.localUninstall:
curl -fsSL https://raw.githubusercontent.com/longcipher/audit-report/master/install.sh | sudo bash -s -- --uninstallsudo install -m755 bin/audit-report /usr/local/bin/audit-report
sudo install -d /usr/local/lib/audit-report
sudo install -m644 lib/audit-report/*.sh /usr/local/lib/audit-report/# Install the audit-report skill for use with AI agents
npx skills add longcipher/audit-reportOnce installed, the audit-report skill can be triggered by AI agents with natural language requests.
You can ask an AI agent to run security audits using phrases like:
- "Run a security audit on this Linux system"
- "Scan for vulnerabilities and rootkits on this server"
- "Perform a Lynis security check"
- "Audit the system security configuration"
- "Check for security issues and generate a report"
- "Run rkhunter and chkrootkit scans"
- "Generate a security compliance report"
| Parameter | Type | Required | Description |
|---|---|---|---|
output |
string | Yes | Output directory path for reports |
modules |
string | No | Comma-separated list of modules to run (lynis,rkhunter,chkrootkit,openscap) |
skip_missing |
boolean | No | Skip missing tools (default: true) |
verbose |
boolean | No | Enable verbose output |
Basic Security Audit:
User: "Run a security audit on this Linux system and save reports to /var/log/audits"
Agent: [Executes] sudo ./bin/audit-report --output /var/log/audits
Specific Modules:
User: "Run Lynis and rkhunter scans on this server"
Agent: [Executes] sudo ./bin/audit-report --output /tmp/reports --modules lynis,rkhunter
Verbose Output:
User: "Perform a comprehensive security audit with detailed output"
Agent: [Executes] sudo ./bin/audit-report --output /tmp/reports --verbose
# Run all available scanners
sudo audit-report --output /var/log/audits
# Run specific modules only
sudo audit-report --output /tmp/reports --modules lynis,rkhunter
# Verbose output
sudo audit-report --output /tmp/reports --verbose
# Fail if any tool is missing (instead of skipping)
sudo audit-report --output /tmp/reports --no-skip-missing| Option | Description |
|---|---|
-o, --output DIR |
Output directory for reports (required) |
-m, --modules LIST |
Comma-separated list of modules to run |
--skip-missing |
Skip modules whose tools are not installed (default) |
--no-skip-missing |
Fail if a required tool is not installed |
-v, --verbose |
Enable verbose output |
-h, --help |
Show help message |
--version |
Show version information |
lynis— System security auditingrkhunter— Rootkit detectionchkrootkit— Rootkit detectionopenscap— SCAP evaluation with auto-detected profiles
<output-dir>/
└── YYYYMMDD-HHMMSS/
├── detect.txt # OS detection results
├── lynis-YYYYMMDD-HHMMSS.log
├── lynis-YYYYMMDD-HHMMSS.dat
├── rkhunter-YYYYMMDD-HHMMSS.log
├── chkrootkit-YYYYMMDD-HHMMSS.txt
├── oscap-results-YYYYMMDD-HHMMSS.xml
├── oscap-report-YYYYMMDD-HHMMSS.html
└── summary-YYYYMMDD-HHMMSS.txt
# Run all tests
bats tests/
# Run specific test file
bats tests/core.bats
# Run all checks (format, lint, test)
just checkaudit-report/
├── bin/
│ └── audit-report # Main entry point
├── lib/
│ └── audit-report/
│ ├── core.sh # Logging, error handling, utilities
│ ├── detect.sh # OS detection functions
│ ├── lynis.sh # Lynis wrapper
│ ├── rkhunter.sh # rkhunter wrapper
│ ├── chkrootkit.sh # chkrootkit wrapper
│ ├── openscap.sh # OpenSCAP wrapper
│ └── report.sh # Summary report generation
├── tests/
│ ├── core.bats # CLI and core function tests
│ ├── detect.bats # OS detection tests
│ ├── lynis.bats # Lynis module tests
│ ├── rkhunter.bats # rkhunter module tests
│ ├── chkrootkit.bats # chkrootkit module tests
│ ├── openscap.bats # OpenSCAP module tests
│ ├── report.bats # Report generation tests
│ └── test_helper.bash # Shared test utilities
├── features/
│ └── audit.feature # BDD acceptance scenarios
└── specs/ # Design specifications
"must be run as root" error
The tool requires root privileges for accurate audit results. Run with sudo.
Module skipped unexpectedly
Use --verbose to see which tools are detected. Install missing tools or use --modules to select only available ones.
SCAP content not found
Install the scap-security-guide package for your distribution:
- Debian/Ubuntu:
apt install ssg-debian ssg-app - RHEL/CentOS:
dnf install scap-security-guide
- Fork the repository
- Create a feature branch
- Make your changes following the project conventions (
set -euo pipefail,[[ ]],local,printf) - Run
just checkto verify - Submit a pull request
Apache-2.0 License