REFERENCE
Security checks
Every check LinSentry performs, with what it does and why it matters. Checks are organized by the area of system posture they examine.
01
Open port scanning
Lists active TCP and UDP listening ports on the system, giving you a baseline view of every service that is currently accepting connections.
02
Port exposure detection
Flags ports bound to 0.0.0.0 or [::] rather than only local interfaces. A port listening on all interfaces is reachable from the network, not just from localhost.
03
SSH configuration audit
Checks PermitRootLogin, PasswordAuthentication, and PermitEmptyPasswords — the three SSH settings most commonly exploited in brute-force attacks. Offers interactive fix prompts when a risky value is found.
04
SSH config file permission audit
Verifies that sshd_config is owned by root and is not group- or other-writable. A world-writable SSH config file could allow a local attacker to change server behavior.
05
World-writable file scanner
Finds files in the home directory (and beyond) that any local user can modify. World-writable files are a privilege-escalation vector: any account on the system can tamper with them.
06
User account audit
Flags duplicate UID 0 (root-level) accounts and accounts with no password set. A second UID 0 account means a second root-equivalent user — often an indicator of compromise or misconfiguration.
07
Sudo privilege audit
Lists members of the sudo group for manual review and detects NOPASSWD entries — accounts that can run administrative commands without a password prompt. This check is intentionally detection-only: sudo and privilege changes are left to the administrator's judgment, since an incorrect automated change could lock an admin out of sudo entirely.
08
Firewall status check
Detects whether ufw is installed and active. If it is not, LinSentry offers to install and enable it. It also cross-references ports flagged as exposed in the earlier port-exposure check and lets the user selectively close specific ports through an interactive, numbered selection.
09
Pending security update check
Checks for available package updates specifically tagged as security-related via apt. These are updates where upstream maintainers have designated a patch as addressing a known vulnerability. LinSentry offers to install them.
10
Security framework (AppArmor) status
Checks whether AppArmor — Linux's mandatory access control system — is installed and actively enforcing profiles. On WSL, it handles and explains a known limitation where WSL's kernel does not fully support AppArmor enforcement even when the module is loaded.
11
Malware / rootkit scanner presence
Checks whether a baseline scanning tool (rkhunter or chkrootkit) is installed. If neither is found, it offers to install rkhunter. Note: this checks for the presence of scanning tools, not active malware — LinSentry does not perform malware scanning itself.
12
Overall risk summary
Tallies warnings found across all checks in the run into a final result: Excellent (0 warnings), Good (1–2 warnings), or Needs Attention (3+ warnings). This gives you a single at-a-glance indicator of your system's posture after the full audit.