Security auditor

Security Auditor

Overview

Audit system security configuration by checking for common misconfigurations, exposed services, weak permissions, and missing patches. Produces a security posture report with severity ratings.

Process

Step 1: Scope the Audit

Determine what to audit based on user request:

Scope	What to check
Full system	All categories below
Network exposure	Open ports, listening services, firewall
User/permissions	Accounts, sudo, file permissions
Updates/patches	Missing security updates
Services	Running services, unnecessary daemons
SSH/Remote	SSH config, remote access
File system	World-writable, SUID, sensitive files

Step 2: Open Ports and Services

Listening services:

Platform	Command
Windows	Get-NetTCPConnection -State Listen | Select LocalAddress, LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} | Sort LocalPort
Linux	ss -tlnp
macOS	lsof -iTCP -sTCP:LISTEN -n -P

Firewall status:

Platform	Command
Windows	Get-NetFirewallProfile | Select Name, Enabled
Linux	ufw status 2>/dev/null || iptables -L -n 2>/dev/null || firewall-cmd --state 2>/dev/null
macOS	pfctl -s info 2>/dev/null | head -5

External exposure check:

# Check if common dangerous ports are exposed
# 21 (FTP), 23 (Telnet), 3389 (RDP), 5900 (VNC), 6379 (Redis), 27017 (MongoDB)

Step 3: User Accounts and Privileges

User accounts:

Platform	Command
Windows	Get-LocalUser | Select Name, Enabled, LastLogon, PasswordRequired
Linux	`awk -F: '$3 >= 1000
macOS	`dscl . list /Users UniqueID | awk '$2 >= 500

Privileged access:

Platform	Command
Windows	Get-LocalGroupMember -Group "Administrators"
Linux	getent group sudo wheel 2>/dev/null and cat /etc/sudoers.d/* 2>/dev/null | grep -v "^#"
macOS	dscl . -read /Groups/admin GroupMembership

Password policy:

Platform	Command
Windows	Get-ADDefaultDomainPasswordPolicy 2>/dev/null || net accounts
Linux	cat /etc/login.defs | grep -E "^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_MIN_LEN"

Step 4: SSH Configuration (Linux/macOS)

# SSH config issues
grep -E "^(PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords|X11Forwarding|Protocol)" /etc/ssh/sshd_config 2>/dev/null

# Authorized keys (check for unexpected)
find /home -name "authorized_keys" -exec wc -l {} \; 2>/dev/null
cat ~/.ssh/authorized_keys 2>/dev/null | wc -l

Security checks:

Setting	Secure Value	Risk if Wrong
PermitRootLogin	no	Direct root access
PasswordAuthentication	no	Brute force attacks
PermitEmptyPasswords	no	No-password login
Protocol	2	Weak protocol

Step 5: System Updates

Pending security updates:

Platform	Command
Windows	Get-HotFix | Sort-Object InstalledOn -Descending | Select -First 5
Ubuntu/Debian	apt list --upgradable 2>/dev/null | grep -i securi
RHEL/CentOS	yum check-update --security 2>/dev/null || dnf check-update --security 2>/dev/null
macOS	softwareupdate -l 2>&1

Last update date:

Platform	Command
Windows	(Get-HotFix | Sort InstalledOn -Desc | Select -First 1).InstalledOn
Linux	stat /var/cache/apt/pkgcache.bin 2>/dev/null || rpm -qa --last | head -1

Step 6: File System Security

World-writable files (Linux/macOS):

find / -type f -perm -o+w -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null | head -20

SUID/SGID binaries (Linux/macOS):

find / -type f \( -perm -4000 -o -perm -2000 \) -not -path "/proc/*" 2>/dev/null | head -20

Sensitive file permissions:

# Check critical file permissions
ls -la /etc/shadow /etc/passwd /etc/sudoers ~/.ssh/id_* 2>/dev/null

Windows sensitive locations:

# Check for credentials in common locations
Get-ChildItem -Path $env:USERPROFILE -Include *.pem,*.key,*.pfx,id_rsa -Recurse -ErrorAction SilentlyContinue | Select FullName

Step 7: Running Services Audit

Unnecessary services check:

Platform	Command
Windows	Get-Service | Where-Object {$_.Status -eq 'Running'} | Select Name, DisplayName | Sort DisplayName
Linux	systemctl list-units --type=service --state=running

Common risky services to flag:

Service	Risk	Recommendation
telnet	HIGH	Replace with SSH
ftp	HIGH	Replace with SFTP
rsh/rlogin	HIGH	Remove immediately
unbound Redis	HIGH	Add auth, bind localhost
unbound MongoDB	HIGH	Add auth, bind localhost
SMBv1	MEDIUM	Disable, use SMBv2+
SNMP v1/v2	MEDIUM	Upgrade to v3

Step 8: Present Security Report

## Security Audit Report
**Host:** [hostname] | **OS:** [os] | **Date:** [timestamp]

### Security Score: [X/10]

### Findings by Severity

#### CRITICAL
- [ ] [finding with evidence]

#### HIGH
- [ ] [finding with evidence]

#### MEDIUM
- [ ] [finding with evidence]

#### LOW / Informational
- [ ] [finding]

### Summary
| Category | Status | Issues |
|----------|--------|--------|
| Network Exposure | [PASS/WARN/FAIL] | [count] |
| User Accounts | [PASS/WARN/FAIL] | [count] |
| SSH Config | [PASS/WARN/FAIL] | [count] |
| Updates | [PASS/WARN/FAIL] | [count] |
| File Permissions | [PASS/WARN/FAIL] | [count] |
| Services | [PASS/WARN/FAIL] | [count] |

### Remediation Priority
1. [Critical items first]
2. [High items]
3. [Medium items]

Rules

• NEVER attempt to exploit any vulnerability found
• NEVER modify security settings without explicit user permission
• NEVER access or display password hashes or private keys content
• Report findings objectively with evidence
• Flag false positives when context suggests they're intentional (e.g., dev machine)
• If audit requires elevated privileges, ask user to run specific commands
• Do NOT install scanning tools; use only built-in OS commands