v1.0.0 is live
Audit your system.
Know what needs attention.
LinSentry is a lightweight security hardening auditor. It audits configuration and access-control posture across the areas attackers target first — currently for Linux with a cross-platform Rust rewrite planned.
Quick Install
Linux / WSLRun from the directory containing linsentry.sh.
$ chmod +x linsentry.sh && ./linsentry.shWhat it checks
Focus on the risks that matter.
LinSentry runs twelve focused checks that mirror the areas attackers target first, then tallies the results into a single risk summary.
Open port scanning
Lists active TCP and UDP listening ports to establish a baseline of every service accepting connections.
Port exposure detection
Flags ports bound to 0.0.0.0 or [::], revealing services reachable from the network rather than localhost only.
SSH configuration audit
Checks PermitRootLogin, PasswordAuthentication, and PermitEmptyPasswords with interactive fix prompts.
SSH file permission audit
Verifies sshd_config is root-owned and not group- or other-writable by any local account.
World-writable scanner
Finds files in the home directory any local user can modify — a common privilege-escalation vector.
User account audit
Flags duplicate UID 0 accounts and empty passwords, each a root-level access risk.
Sudo privilege audit
Lists sudo group members and flags NOPASSWD entries so accounts that skip the password prompt are visible.
Firewall status check
Detects ufw installation and activity, and lets you close exposed ports through an interactive selection.
Pending security update check
Finds apt packages tagged as security-related and offers to install them.
Security framework (AppArmor) status
Confirms AppArmor is installed and enforcing profiles, with WSL-specific handling.
Malware scanner presence
Checks whether rkhunter or chkrootkit is installed; offers to install one when neither is found.
Overall risk summary
Tallies warnings across every check into Excellent, Good, or Needs Attention.
Documentation
Everything you need to get started.
Install LinSentry, learn the command-line workflow, and understand exactly what each of its checks inspects.
Current Status
- • Bash-based auditor runs anywhere Bash does — no compiled binary required.
- • Interactive fix prompts walk you through closing the risks it flags.
- • 12 checks covering ports, SSH, accounts, sudo, firewall, and updates.
Ready to dive into the details?
Explore the full documentation for setup guides and a complete walkthrough of every audit check.