Frequently Asked Questions (FAQ)

Frequently Asked Questions (FAQ)

This page answers common questions about the Linux Security Audit Project, its capabilities, usage, and security concepts.

Table of Contents

• General Questions
• Installation and Setup
• Usage Questions
• Security Frameworks
• Results and Reporting
• Remediation Questions
• Technical Questions
• Comparison Questions

General Questions

What is the Linux Security Audit Project?

The Linux Security Audit Project is a comprehensive, modular security assessment framework for Linux systems. It audits systems against multiple security frameworks including CIS Benchmarks, NIST standards, DISA STIGs, and more, providing detailed reports and automated remediation capabilities.

Key Features:

• 8 security framework modules (1,207 validated checks)
• Compliance scoring (weighted, simple, severity-adjusted) with pass/fail thresholds
• Interactive HTML reports with 18+ features (dashboard filtering, export, compliance overview)
• Performance engine: shared caching (~50% hit rate), parallel execution, /proc reads
• Structured logging with configurable levels and JSON output
• Multiple output formats (HTML, CSV, JSON, XML, Console) with companion JSON
• Automated and selective remediation
• Privilege-aware execution (works with or without root)

Is this tool free to use?

Yes, completely free and open source under the MIT License. You can:

• Use it for personal or commercial purposes
• Modify it to suit your needs
• Distribute it (with attribution)
• Include it in proprietary software

License: MIT - See LICENSE

Who should use this tool?

Ideal Users:

• System Administrators: Regular security assessments
• Security Teams: Compliance auditing and hardening
• DevOps Engineers: CI/CD security integration
• Compliance Officers: Framework compliance verification
• IT Auditors: Security posture assessment
• Hobbyists: Learning Linux security

Organizations:

• Enterprises requiring compliance (ISO 27001, SOX, etc.)
• Government agencies (federal, state, local)
• Defense contractors (NIST 800-171, STIG compliance)
• Healthcare organizations (HIPAA security requirements)
• Financial institutions (PCI-DSS, regulatory compliance)

Does this replace professional security audits?

No. This tool is a security assessment aid, not a replacement for professional audits.

What it does:

• Automated technical security checks
• Configuration compliance verification
• Known vulnerability identification
• Best practice validation

What it doesn't do:

• Manual security testing (penetration testing)
• Risk assessment and analysis
• Policy and procedure review
• Business context evaluation
• Legal compliance interpretation

Best Practice: Use this tool as part of a comprehensive security program that includes professional audits, penetration testing, and security expertise.

Is this tool safe to run on production systems?

Yes, for auditing. The audit functionality is read-only and safe.

Audit Mode (Default):

• ✅ Safe - Only reads system information
• ✅ No modifications made
• ✅ No service interruptions
• ✅ Can run during business hours

Remediation Mode (Optional):

• ⚠️ Use caution - Makes system changes
• ⚠️ Test in non-production first
• ⚠️ Review commands before executing
• ⚠️ Have backups and rollback plan

Recommendation:

1. Run audit first in production (safe)
2. Review results carefully
3. Test remediation in development/staging
4. Apply selected fixes during maintenance window

Installation and Setup

What are the system requirements?

Minimum Requirements:

• OS: Linux (any modern distribution)
• Python: Version 3.7 or higher
• Disk: 100 MB free space
• Memory: 512 MB RAM (1 GB recommended)
• Privileges: Root/sudo recommended (not required)

Supported Distributions:

• Ubuntu 18.04+, Debian 9+, Linux Mint 19+
• RHEL 7+, CentOS 7+, Fedora 28+
• Rocky Linux 8+, AlmaLinux 8+
• SUSE/openSUSE, Arch Linux

Do I need to install additional packages?

No. All required Python modules are part of the standard library.

No external dependencies:

• No pip install needed
• No third-party packages required
• Works out-of-the-box with Python 3.7+

Optional packages (only if you want to check for their presence):

• Security tools: auditd, aide, fail2ban, rkhunter
• These are checked but not required to run the audit

How do I update to the latest version?

Using Git:

cd Linux-Security-Audit-Project
git pull origin main

Manual Download:

# Download latest release
wget https://github.com/Sandler73/Linux-Security-Audit-Project/archive/refs/heads/main.zip
unzip main.zip
cd Linux-Security-Audit-Project-main

Version Check:

grep "SCRIPT_VERSION = " linux_security_audit.py

Can I run this on Windows/Mac?

Windows: Not directly supported

• Linux security checks are not applicable to Windows
• Use WSL (Windows Subsystem for Linux) if you want to audit WSL instances
• For Windows auditing, see equivalent Windows security audit tools

Mac: Not directly supported

• Some checks may work on macOS (Unix-based)
• Many Linux-specific checks won't apply
• Not officially tested or supported on macOS

Best Use: Run on Linux systems or Linux VMs/containers

Usage Questions

Do I need root/sudo access?

Short answer: Recommended but not required.

With Root/Sudo (Recommended):

• ✅ Complete security assessment
• ✅ Access to all system files
• ✅ Full check coverage
• ✅ Remediation capabilities
• Results: ~1000+ checks

Without Root/Sudo (Limited):

• ⚠️ Limited security assessment
• ⚠️ Some checks will fail with "Error" status
• ⚠️ Cannot read privileged files (/etc/shadow, etc.)
• ⚠️ No remediation available
• Results: ~60-70% of checks complete

Command Examples:

# With root (recommended)
sudo python3 linux_security_audit.py

# Without root (limited)
python3 linux_security_audit.py

How long does an audit take?

Typical Execution Times:

Configuration	Time	Checks
Single module (Core)	20-30 seconds	150
Three modules (Core,CIS,NIST)	1-2 minutes	500+
All modules	3-5 minutes	1000+
Large system (1000+ users)	5-10 minutes	1000+

Factors Affecting Speed:

• Number of modules selected
• System size (users, files, services)
• Network filesystem mounts
• System load
• Disk I/O speed

Fastest Test:

python3 linux_security_audit.py -m Core -f Console
# ~20-30 seconds

Can I schedule automated audits?

Yes, using cron or systemd timers.

Cron Example (Daily at 2 AM):

# Edit crontab
sudo crontab -e

# Add line:
0 2 * * * /usr/bin/python3 /opt/security-audit/linux_security_audit.py -f JSON -o /var/log/audit-$(date +\%Y\%m\%d).json

# For email notifications
0 2 * * * /usr/bin/python3 /opt/security-audit/linux_security_audit.py -f Console | mail -s "Security Audit" admin@example.com

Systemd Timer Example:

# Create service
sudo nano /etc/systemd/system/security-audit.service

# Create timer
sudo nano /etc/systemd/system/security-audit.timer

# Enable and start
sudo systemctl enable security-audit.timer
sudo systemctl start security-audit.timer

Best Practices:

• Use JSON format for automated runs
• Store reports with date in filename
• Set up log rotation
• Monitor for significant changes
• Alert on increased failure counts

Can I run this on multiple systems?

Yes, several approaches:

1. Manual Execution via SSH:

for server in server1 server2 server3; do
    ssh $server "sudo python3 /opt/audit/linux_security_audit.py -f JSON -o /tmp/audit.json"
    scp $server:/tmp/audit.json ./reports/$server-audit.json
done

2. Ansible Playbook:

- name: Run security audit
  hosts: all
  tasks:
    - name: Execute audit
      command: python3 /opt/audit/linux_security_audit.py -f JSON
      become: yes

3. Parallel Execution:

# Use GNU parallel
parallel -j 10 ssh {} "sudo python3 /opt/audit/linux_security_audit.py" ::: server1 server2 server3

4. Configuration Management:

• Puppet, Chef, Salt, Ansible
• Deploy script to all systems
• Schedule via cron
• Collect results centrally

What output format should I use?

Choose based on your use case:

HTML - For manual review:

• ✅ Interactive filtering and search
• ✅ Visual presentation
• ✅ Best for human consumption
• ✅ Management reporting

CSV - For spreadsheet analysis:

• ✅ Excel/Google Sheets import
• ✅ Trending and graphing
• ✅ Custom reporting
• ✅ Historical comparison

JSON - For automation:

• ✅ API integration
• ✅ SIEM ingestion
• ✅ Custom scripting
• ✅ Selective remediation
• ✅ Programmatic processing

XML - For enterprise tools:

• ✅ SIEM ingestion (Splunk, QRadar)
• ✅ GRC platforms
• ✅ Legacy system integration

Console - For quick checks:

• ✅ Real-time viewing
• ✅ SSH sessions
• ✅ Quick validation
• ✅ Terminal-only environments

Multiple Formats:

# Generate multiple formats
sudo python3 linux_security_audit.py -f HTML -o report.html
sudo python3 linux_security_audit.py -f JSON -o report.json
sudo python3 linux_security_audit.py -f CSV -o report.csv

Security Frameworks

Which security framework should I use?

Depends on your requirements:

For Everyone:

• Start with: Core + CIS
• Provides: Baseline security + industry best practices
• Time: ~1-2 minutes

For Compliance:

• Financial/Healthcare: ISO27001 + NIST + CIS
• Government/Federal: NIST + STIG + CISA
• EU Organizations: ISO27001 + ENISA + CIS
• Defense Contractors: STIG + NIST 800-171 + NSA

For Security Hardening:

• Standard: Core + CIS + NSA
• Maximum: All modules

Recommendation: Run all modules once to establish baseline, then focus on relevant frameworks.

What's the difference between the frameworks?

Quick Comparison:

Framework	Focus	Prescriptive	Certification	Best For
Core	Baseline security	Low	No	Everyone
CIS	Best practices	Medium	No	General hardening
CISA	Critical infrastructure	Medium	No	Government, critical sectors
ENISA	EU standards	Low	No	EU organizations
ISO27001	ISMS	Medium	Yes	Compliance certification
NIST	Federal standards	High	No	Government, contractors
NSA	Advanced hardening	High	No	High-security environments
STIG	DoD requirements	Very High	No	Defense, contractors

Detailed comparison: See Framework Reference

Do I need to comply with all frameworks?

No. Choose frameworks based on your requirements:

Legal Requirements:

• Some frameworks are legally required (NIST 800-171 for CUI)
• Some are contractually required (STIG for DoD contracts)
• Some are industry requirements (PCI-DSS for payment cards)

Voluntary Standards:

• CIS Benchmarks: Recommended best practices
• ISO 27001: Optional certification
• NIST CSF: Voluntary framework

Best Practice: Implement what's required, consider what's recommended.

Can I create custom checks?

Yes. The tool is designed for extensibility.

Process:

1. Create new module file: modules/module_custom.py
2. Implement required interface: run_module(shared_data)
3. Add your security checks
4. Place in project directory
5. Run: python3 linux_security_audit.py -m CUSTOM

Documentation: See Development Guide for complete instructions.

Example Template: Included in Development Guide with detailed comments.

Results and Reporting

What do the status codes mean?

Status	Meaning	Action Required	Priority
Pass	Check passed	None	✅ Good
Fail	Security issue detected	Yes - Fix	🔴 High
Warning	Potential concern	Review and consider	🟡 Medium
Info	Informational	Awareness only	🔵 Low
Error	Check couldn't run	Investigate	⚪ Variable

Detailed Explanation: See Output Reference

What's a good pass rate?

General Guidelines:

Excellent (80%+ pass):

• Strong security posture
• Well-maintained system
• Regular updates applied

Good (60-79% pass):

• Acceptable security
• Some improvements needed
• Address failures first

Needs Attention (<60% pass):

• Significant security gaps
• Immediate action required
• Prioritize critical failures

Important Notes:

• Pass rate varies by framework
• Newly installed systems typically have lower rates
• Focus on fixing failures, not just improving numbers
• Some failures may be acceptable for your environment

How do I interpret the results?

Step-by-Step Process:

1. Review Summary Statistics:

   • Total checks performed
   • Pass/Fail/Warning/Info/Error counts
   • Identify which modules had most failures

2. Prioritize Failures:

   • Start with "Fail" status items
   • Focus on security-critical issues
   • Consider business impact

3. Understand Context:

   • Read the "Details" field
   • Understand why it's a security concern
   • Determine if it applies to your environment

4. Review Remediation:

   • Check the remediation command
   • Understand what it changes
   • Assess potential impact

5. Plan Action:

   • Group related findings
   • Create remediation plan
   • Schedule fixes appropriately

Example Workflow: See Usage Guide

Can I export only certain results?

Yes, multiple methods:

Method 1: Filter in HTML Report:

1. Open HTML report
2. Filter by status (show only "Fail")
3. Select specific issues (checkboxes)
4. Click "Export Selected"
5. Save JSON file

Method 2: Command-line filtering (using jq):

# Export only failures
jq '.results[] | select(.status=="Fail")' audit.json > failures-only.json

# Export specific module
jq '.results[] | select(.module=="CIS")' audit.json > cis-only.json

Method 3: Spreadsheet filtering:

1. Export to CSV
2. Open in Excel/Sheets
3. Use filter function
4. Copy/export filtered results

How do I track changes over time?

Approaches:

1. Regular Audits with Date Stamps:

# Weekly audits
sudo python3 linux_security_audit.py -f JSON -o audit-$(date +%Y%m%d).json

2. Compare JSON Files:

# Compare two audit results
python3 -c "
import json
with open('audit-20250101.json') as f1, open('audit-20250107.json') as f2:
    old = json.load(f1)
    new = json.load(f2)
    print(f'Before: {old[\"execution_info\"][\"fail_count\"]} failures')
    print(f'After: {new[\"execution_info\"][\"fail_count\"]} failures')
"

3. Track Key Metrics:

• Total checks
• Fail count
• Pass rate percentage
• Specific high-priority findings

4. Visualization:

• Import CSV into graphing tool
• Plot pass rate over time
• Track failure trends by module

Remediation Questions

Is automated remediation safe?

It depends on your approach:

Safest Approach (Recommended):

1. Run audit without remediation
2. Review HTML report carefully
3. Select specific issues to fix
4. Export selected to JSON
5. Review exported JSON
6. Test in non-production
7. Run selective auto-remediation

# Selective remediation
sudo python3 linux_security_audit.py --auto-remediate --remediation-file selected.json

Risky Approach (Not Recommended):

# Auto-remediate everything - DON'T DO THIS in production
sudo python3 linux_security_audit.py --auto-remediate

Safety Measures:

• ✅ Test in development/staging first
• ✅ Backup configurations
• ✅ Have rollback plan
• ✅ Schedule during maintenance window
• ✅ Have console access (in case SSH breaks)

What if remediation breaks something?

Prevention:

Before Remediation:

# Backup critical configs
sudo cp -r /etc/ssh /etc/ssh.backup.$(date +%Y%m%d)
sudo cp -r /etc/pam.d /etc/pam.d.backup.$(date +%Y%m%d)
sudo cp /etc/sysctl.conf /etc/sysctl.conf.backup

# Document current state
sudo systemctl list-units --state=active > services-before.txt

Recovery:

If you still have access:

# Restore backup
sudo cp -r /etc/ssh.backup.20250107 /etc/ssh
sudo systemctl restart sshd

If SSH is broken:

1. Connect via console (physical or virtual)
2. Restore configurations from backups
3. Restart affected services
4. Verify functionality

If system won't boot:

1. Boot from rescue media
2. Mount root filesystem
3. Restore backed-up files
4. Reboot

Best Practice: Always have out-of-band access (console, IPMI, remote KVM).

Can I undo remediations?

Partial. Some remediations are reversible, others are not.

Easily Reversible:

• File permission changes: chmod, chown
• Configuration changes: Restore from backup
• Service enable/disable: systemctl disable/enable
• Sysctl parameters: Edit /etc/sysctl.conf and reload

Difficult to Reverse:

• Installed packages: Can uninstall but may affect dependencies
• Password changes: Can't recover old passwords
• Deleted data: May be unrecoverable

Not Reversible:

• Security updates: Generally shouldn't reverse
• Kernel patches: Require downgrade (not recommended)

Recommendation:

• Keep detailed logs of changes
• Maintain configuration backups
• Document remediation actions
• Test rollback procedures

How do I remediate only critical issues?

Method 1: Use Status Filters:

# Remediate only FAIL status
sudo python3 linux_security_audit.py --remediate-fail --auto-remediate

Method 2: Selective Export:

1. Open HTML report
2. Filter by status: "Fail"
3. Review each failure
4. Select only critical issues (checkboxes)
5. Export to JSON
6. Run selective remediation

Method 3: Manual Review and Apply:

# Generate report
sudo python3 linux_security_audit.py -o report.html

# Review report
# Manually copy and run critical remediation commands

Prioritization:

1. Critical: Remote access (SSH), authentication, authorization
2. High: Unpatched vulnerabilities, weak cryptography
3. Medium: Logging, monitoring, file permissions
4. Low: Documentation, informational settings

Technical Questions

Does this tool use the internet?

No. The tool is completely offline.

Network Activity: None

• No external connections
• No data transmission
• No "phone home" functionality
• No update checks

Dependencies: All local

• Python standard library only
• No pip packages
• No internet required

Note: The tool itself doesn't use internet, but some checks verify internet-dependent configurations (like checking if updates are available via the configured package manager).

Does it collect or transmit data?

No. Zero data collection or transmission.

Privacy:

• No telemetry
• No analytics
• No usage tracking
• No data sent anywhere

Data Stays Local:

• All results saved locally
• You control all output files
• No cloud services
• No external APIs

Can this tool harm my system?

Audit Mode: No

• Read-only operations
• No system changes
• Cannot harm system

Remediation Mode: Potentially

• Makes system changes
• Could misconfigure services
• Could break functionality if misused

Best Practices:

• Test in non-production first
• Review remediation commands
• Have backups
• Have rollback plan
• Use selective remediation

What Python version do I need?

Minimum: Python 3.7

Recommended: Python 3.8+

Check Your Version:

python3 --version

Why Python 3.7+:

• Uses f-strings (3.6+)
• Uses dataclasses (3.7+ or backport)
• Type hints
• Modern standard library features

Compatibility:

• ✅ Python 3.7 (minimum)
• ✅ Python 3.7
• ✅ Python 3.8
• ✅ Python 3.9
• ✅ Python 3.10
• ✅ Python 3.11
• ✅ Python 3.12+

Does it support Python 2?

No. Python 2 is not supported.

Reasons:

• Python 2 reached end-of-life January 1, 2020
• No security updates
• Missing modern features
• Industry has moved to Python 3

Migration: If you only have Python 2, install Python 3:

# Ubuntu/Debian
sudo apt install python3

# RHEL/CentOS
sudo yum install python3

Comparison Questions

How does this compare to commercial tools?

Advantages of This Tool:

• ✅ Free and open source
• ✅ No licensing costs
• ✅ Fully transparent (review source code)
• ✅ Customizable and extendable
• ✅ No vendor lock-in
• ✅ Community-driven development

Advantages of Commercial Tools:

• ✅ Professional support
• ✅ Regular updates by dedicated team
• ✅ Advanced features (dashboards, alerting, etc.)
• ✅ Compliance reporting
• ✅ Integration with other enterprise tools

Best Use:

• Small/Medium organizations: This tool is excellent
• Large enterprises: Consider this + commercial tools
• Budget-conscious: This tool provides significant value at zero cost

How does this compare to OpenSCAP?

Linux Security Audit Project:

• Broader framework coverage (8 frameworks)
• Easier to use (Python scripts, no SCAP content)
• Better reporting (interactive HTML)
• Simpler remediation
• More accessible to non-experts

OpenSCAP:

• Official SCAP compliance
• NIST certified
• Better for strict compliance requirements
• More established (longer history)
• Used by government/defense

Recommendation:

• Use this tool for broader security assessment
• Use OpenSCAP if SCAP compliance is required
• Consider using both for comprehensive coverage

How does this compare to Lynis?

Linux Security Audit Project:

• Multiple framework modules
• Interactive HTML reports
• Multiple output formats
• Automated remediation
• Framework-focused

Lynis:

• System hardening focus
• Detailed system analysis
• Malware detection
• Kernel parameter audit
• More granular checks

Recommendation:

• This tool: Framework compliance and remediation
• Lynis: Deep system analysis and hardening
• Use both for comprehensive security

Can I use this with Ansible/Puppet/Chef?

Yes. Several integration methods:

1. As a Task:

# Ansible example
- name: Run security audit
  command: python3 /opt/audit/linux_security_audit.py -f JSON -o /tmp/audit.json
  become: yes

2. As a Custom Fact/Module:

• Parse results into Ansible facts
• Use in conditional tasks

3. As a Reporting Tool:

• Run after configuration management
• Verify desired state
• Alert on drift

4. As a Compliance Check:

• Pre-deployment validation
• Post-configuration verification

Best Practice: Use configuration management for remediation, this tool for verification.

Additional Help

Where can I find more documentation?

Wiki Pages:

• Home: Project overview
• Quick Start Guide: Get started quickly
• Usage Guide: Comprehensive usage
• Module Documentation: Module details
• Framework Reference: Framework standards
• Development Guide: Extending the tool
• Troubleshooting Guide: Problem solving
• Output Reference: Understanding output

External Resources:

• GitHub Repository: https://github.com/Sandler73/Linux-Security-Audit-Project
• Security Standards: See Framework Reference

How do I report bugs or request features?

GitHub Issues: https://github.com/Sandler73/Linux-Security-Audit-Project/issues

Before Submitting:

1. Search existing issues
2. Try troubleshooting steps
3. Collect diagnostic information
4. Prepare clear description

Bug Report Should Include:

• Clear description
• Steps to reproduce
• Expected vs actual behavior
• Environment (OS, Python version, etc.)
• Error output
• Relevant configuration

Feature Request Should Include:

• Use case description
• Why it's needed
• Proposed implementation (if applicable)
• Benefit to other users

How can I contribute?

Ways to Contribute:

1. Report Issues: Bug reports help improve the tool
2. Suggest Features: Share ideas for improvements
3. Improve Documentation: Fix errors, add examples
4. Write Code: Implement features, fix bugs
5. Create Modules: Add new security framework checks
6. Share Experience: Write blog posts, tutorials
7. Spread the Word: Tell others about the project

Getting Started:

• Read Development Guide
• Check open issues for "good first issue" label
• Fork repository
• Make improvements
• Submit pull request

Where can I get help?

Primary Support:

• Documentation: Start with wiki pages
• Troubleshooting: See Troubleshooting Guide
• FAQ: This page!
• GitHub Issues: For bugs and feature requests

Community:

• GitHub Discussions (if enabled)
• Issue comments
• Pull request discussions

Professional Support:

• This is a community project
• No official commercial support
• Consider hiring Linux security consultants for complex issues

Is training available?

Self-Guided Learning:

• Complete documentation in wiki
• Security framework references
• Example workflows and use cases

External Resources:

• CIS Benchmarks documentation
• NIST publications
• Linux security guides
• System administration courses

Recommended Learning Path:

1. Read Quick Start Guide
2. Run basic audit
3. Review Output Reference
4. Learn about specific frameworks in Framework Reference
5. Practice remediation in test environment
6. Review Development Guide for customization

---

Have a question not answered here?

Open an issue on GitHub with the "question" label, and we'll add it to this FAQ!

---

← Back to Troubleshooting Guide | Home