LinSentry is complete — v1.0.0

LinSentry started as a way for me to actually learn Bash. Not just read tutorials about loops and subshells and parameter expansion, but build something real with them — something that had to work correctly, handle edge cases, and behave safely when it touched a live system. A security hardening auditor turned out to be the perfect project: every check is a small, self-contained problem with a clear goal, and the whole thing composes into a tool that's useful on its own.

Today I'm tagging v1.0.0 — the release that completes the original 10-check roadmap. Here's what the full audit looks like end to end.

The checks

A LinSentry run works through each area of system posture — port exposure, SSH hardening, file permissions, user accounts, sudo privileges, firewall status, pending updates, AppArmor, malware scanner presence, and an overall risk summary that ties it together.

1. Port exposure — scans listening TCP and UDP ports, then flags any bound to 0.0.0.0 or [::]. A port on all interfaces is reachable from the network, not just localhost.
2. SSH hardening — audits PermitRootLogin, PasswordAuthentication, and PermitEmptyPasswords, plus the sshd_config file's ownership and write permissions.
3. File permissions — scans the home directory for world-writable files that any local user could tamper with.
4. User accounts — flags duplicate UID 0 (root-level) accounts and any account with an empty password.
5. Sudo privileges — lists sudo group members and detects NOPASSWD entries: accounts that can run admin commands without a password prompt.
6. Firewall status — checks whether ufw is installed and active, offers to install or enable it, and lets you selectively close exposed ports.
7. Pending security updates — checks for apt packages tagged specifically as security-related, and offers to install them.
8. AppArmor — verifies Linux's mandatory access control system is installed and actively enforcing profiles, with WSL-specific handling for the kernel's known enforcement limitations.
9. Malware scanner presence — confirms a baseline scanning tool (rkhunter or chkrootkit) is installed, and offers to install one if not.
10. Overall risk summary — tallies warnings across every check into a final result: Excellent, Good, or Needs Attention.

What LinSentry is not

The more I built, the more I wanted to be honest about the boundaries. LinSentry audits configuration and access control. It is not a rootkit detector or a supply-chain verifier — and those aren't gaps I'm hiding from. They're structural limits of any configuration-based auditor: if the kernel lies to userspace, every tool that asks the kernel inherits the lie, and a compromised package that ships correct permissions looks identical to a clean one.

I wrote all of this up properly in the new Scope & Limitations documentation page — the kernel-rootkit case, the supply-chain case (I use the 2024 xz-utils backdoor as the example), and the tools that actually address those categories.

What's next

The Bash version has reached a natural end point. The next real step is a cross-platform rewrite in Rust — the same audit logic compiled for Linux, macOS, Windows, and Termux. A lot of what was painful in Bash (portable privilege checks, structured output, safe interactive prompts on terminals that differ platform to platform) gets much more tractable in a compiled language.

For now: if you're on Linux or WSL, grab the script from the GitHub repo, run it, and look at the risk summary at the end. Then go fix the things it flags — that's the whole point.