SysAudit

A security audit for the machine you're sitting at. Run it, get a score out of 100 and a single HTML file listing everything it didn't like. Linux and macOS.

Install

pip install sysaudit-cli

The distribution is sysaudit-cli because sysaudit was taken on PyPI. The command it installs is still sysaudit.

From source:

git clone https://github.com/Xyness/SysAudit.git
cd SysAudit
pip install -e .

Use

sysaudit run                                   # full audit, HTML report
sysaudit run --output report.html              # pick the filename
sysaudit run --format json --output out.json   # machine-readable
sysaudit run --modules system,network          # subset
sysaudit run --no-cve                          # skip the OSV lookup, much faster
sysaudit run --quiet                           # no terminal output
sysaudit modules                               # what's available

Output looks like this:

  SysAudit v1.0.0

  ▸ System audit...       ✓  (2.1s)
  ▸ Network audit...      ✓  (0.8s)
  ▸ Auth audit...         ✓  (1.2s)
  ▸ Files audit...        ✓  (3.4s)
  ▸ CVE matching...       ✓  (4.7s)

  Score : 67/100   ████████░░░░░░░░  MEDIUM RISK

  2 Critical, 5 High, 8 Medium, 3 Low

  Report saved to sysaudit_report_2025-01-01.html

About sudo

Plenty of the interesting checks need root: reading /etc/shadow, pulling failed login attempts, walking system directories. Without it the audit still runs, skips what it can't reach and tells you which checks were skipped, so a non-root score is optimistic by construction. For the real picture:

sudo sysaudit run

What it checks

system covers OS and kernel version, running services, cron jobs, SUID binaries, packages that are behind.

network covers listening sockets (and specifically which ones are bound to 0.0.0.0), whether any of ufw/iptables/nftables is actually active, established connections, interfaces.

auth covers accounts with UID 0, accounts with no password, SSH keys and their permissions, failed login history, sudoers rules, password policy.

files covers recently modified files under system paths, world-writable files, permissions on things like /etc/shadow and SSH keys, shell history files.

cve sends installed package names and versions to OSV.dev and reports known vulnerabilities. This is the slow part, hence --no-cve.

The report

One .html file with the CSS and JS inlined. No CDN, no network access needed to open it, which matters when the point is to hand it to someone or archive it. Score circle, per-module breakdown, and findings you can filter by severity and expand for the details and the recommendation.

--format json gives you the same data without the presentation layer.

Scoring

Score = 100 - (sum of penalties)

CRITICAL : -20 each (capped at -40)
HIGH     : -10 each (capped at -30)
MEDIUM   :  -5 each (capped at -20)
LOW      :  -2 each (capped at -10)

The per-severity caps are there so that one noisy check can't drag a machine to zero on its own. Twenty world-writable files in a temp directory is one problem, not twenty. Same formula is applied per module to get the breakdown.

Development

pip install -e ".[dev]"
pytest

Python 3.10+. The only runtime dependencies are psutil, typer, httpx, jinja2 and rich. Everything else is stdlib, and every external command is called through a wrapper that returns an empty string rather than raising when the binary isn't there.

License

MIT, see LICENSE.