ubuntu-sys-audit
v0.1.18GitHub
v0.1.18New Stack tab: databases, runtimes and end-of-life dates

One lap.Twelve checks.Nothing written.

ubuntu-sys-audit checks an Ubuntu server for missing CVE fixes, signs of compromise and risky configuration in one read-only pass. A single static binary: no agent, no packages, and it never runs a program from the host.

Get started View on GitHub
sudo ./ubuntu-sys-audit-linux-amd64
check categories
12
Ubuntu LTS releases
18.04 → 26.04
static binary, amd64 + arm64
1
programs run from the host
0

Scroll to start the lap

Lap01/01Sector01/12
Scan00:00.00

The scan, as a lap

Twelve sectors.
One read-only pass.

Keep scrolling to drive it. Each checkpoint is a check category, lit with its result on a demo host.

Lap complete

Questions it answers,
on one server or a fleet.

  1. 01

    Which hosts still lack the fix for a new nginx, PHP or Linux kernel CVE?

    CVEWeb

  2. 02

    Does this host show signs of a backdoor, such as BPFDoor, a webshell, a reverse shell or a crypto miner?

    NetworkProcessesWeb

  3. 03

    Who has root, sudo or SSH key access, and what is set to run at startup?

    AccountsSSHPersistence

  4. 04

    Which hosts have pending security updates, need a reboot or run a release past its support date?

    PackagesSystem

  5. 05

    Which databases, runtimes and servers does each host run, and which are past their end of life?

    Stack

●BPFDoor magic values●webshells●reverse shells●crypto miners●LD_PRELOAD injection●hidden processes●hidden kernel modules●processes posing as kworker●memfd execution●rogue cron jobs●systemd generators●SUID backdoors●dangerous capabilities●UID 0 accounts●PAM backdoors●/etc/hosts tampering●Docker ports bypassing ufw●Caddy admin API exposed●certificates that unmask your origin
◆nginx◆PHP◆Caddy + xcaddy plugins◆Redis◆Valkey◆PostgreSQL◆MySQL◆MariaDB◆MongoDB◆SQLite◆Node.js◆Python◆Ruby◆Java◆Go◆Docker◆containerd◆HAProxy◆Apache◆LXD

Design

Read-only,
all the way down.

It runs as root, so it was built like a forensic tool rather than an agent. It reads the host and leaves it as it found it: no files written unless you ask, and no program from the host ever executed, so a replaced ps or ss cannot feed it false output.

How it stays read-only →

CVE

Results that account for backports

Packages and the running kernel are compared against Canonical’s Ubuntu Security Notices, ESM fixes included. Ubuntu backports fixes into older versions, so a version number alone says little.

Version-only scannernginx 1.18.0 < upstream fix “Vulnerable”
ubuntu-sys-audit1.18.0-0ubuntu1.x vs Canonical OVAL Fix installed

Read-only

Versions are read from the contents of binaries instead of running nginx -v. The end-to-end tests check this with strace.

Nothing to install

One static binary for amd64 or arm64. No agent, no daemon, no compiler, no packages on the host.

Built for fleets

Without a TTY it writes JSON. Collect reports over SSH and act on the exit code.

Works offline

Point it at a local copy of Canonical’s OVAL file. It warns you when the data is over 14 days old.

Gentle on production

Low CPU priority, idle I/O, at most 2 CPUs. Most test scans finished in 5 to 60 seconds.

Verifiable releases

GitHub Actions builds both binaries and publishes build provenance attestations, so you can prove a binary came from this repository’s workflow, even on the host itself with the bundled Sigstore file.

SLSA provenanceOpenSSF ScorecardOpenSSF Best PracticesCodeQLgovulncheck gateFuzzed parsers

Terminal UI

Findings you can
actually act on.

Every finding says what it means, how to fix it and what it saw. This is the real layout with a demo report: click into it and drive it with the same keys.

◆ ubuntu-sys-auditUbuntu 22.04.5 LTSkernel 5.15.0-202-generic

Read-only scan finished in 35.9s · A rootkit can falsify local results, so a clean result does not prove a clean host

1 Critical6 High13 Medium25 Info18 Passed0 Not checked
  • ●All20
  • ●CVE13
  • ✓Web
  • ●Network1
  • ●Processes1
  • ✓Integrity
  • ✓Persistence
  • ●Accounts1
  • ●SSH2
  • ●Filesystem1
  • ✓Packages
  • ✓Stack
  • ●System1
  • ●Process poses as a system service
  • ●lua-bitop: 1 security notice missing, 3 CVEs
  • ●lua-cjson: 1 security notice missing, 3 CVEs
  • ●lua5.1: 1 security notice missing, 3 CVEs
  • ●Redis is bound to a non-loopback address
  • ●Root can log in over SSH with a password
  • ●Files with dangerous capabilities (1)
  • ●aom: 1 security notice missing, 4 CVEs
  • ●gsl: 1 security notice missing, 1 CVE
  • ●haveged: 1 security notice missing, 1 CVE
  • ●imagemagick: 15 security notices missing, 77 CVEs
  • ●libde265: 3 security notices missing, 14 CVEs
  • ●libheif: 5 security notices missing, 8 CVEs
  • ●libmatio: 1 security notice missing, 1 CVE
  • ●openexr: 2 security notices missing, 3 CVEs
  • ●ruby-rack: 2 security notices missing, 11 CVEs
  • ●vips: 2 security notices missing, 2 CVEs
  • ●Passwordless sudo rules (1)
  • ●SSH allows password login
  • ●Unmitigated CPU vulnerabilities (1)
  • ○Packages with missing fixes: 13 (34 USNs, 125 CVEs)
  • ○nginx copies found (1)
  • ○PHP copies found (1)
  • ○Web roots scanned
  • ○Listening ports (17, 11 non-loopback)
  • ○Firewall: ufw enabled
  • ○Docker is installed with no containers
  • ○Packet sockets held by known programs (1)
  • ○The kernel auto-loaded af_packet_diag while BPF filters were read
  • ○Processes, excluding kernel threads (142)
  • ○Package files are missing (2)
  • ○Scheduled and startup items that belong to no package (3)
  • ○systemd services that belong to no package (2)
  • ○Accounts: 37 total, 1 regular, 2 can log in
  • ○Members of privileged groups
  • ○Failed SSH logins in auth.log (89740, from 566 source IPs)
  • ○SSH authorized keys (3)
  • ○sshd uses custom port: 2222
  • ○Scanned 184213 files
  • ○Key software versions (1037 packages installed)
  • ○Last package upgrade: 2026-10-02 06:14
  • ○Tech stack (6 components)
  • ○Node.js 22 reaches end of life on 2027-04-30
  • ○Operating system: Ubuntu 22.04.5 LTS (jammy)
  • ○Running kernel: 5.15.0-202-generic
  • ✓Scanned 1284 PHP files, no webshell signatures
  • ✓HTTPS without a server name gets no certificate that names a domain
  • ✓systemd-resolved local stub on port 53 (normal)
  • ✓No interfaces in promiscuous mode
  • ✓No signs of tampering in /etc/hosts, nsswitch.conf or TCP Wrappers
  • ✓No hidden processes across 4194304 PIDs
  • ✓No processes use replaced libraries
  • ✓Verified 41213 system files against package hashes, all match
  • ✓/proc/modules matches /sys/module
  • ✓Scanned 412 scheduled and startup files, no malicious signs
  • ✓Scanned 214 systemd units and generators, no malicious signs
  • ✓Only root uses UID 0
  • ✓No accounts with an empty password
  • ✓All 34 SUID/SGID files come from packages
  • ✓No pending security updates according to the local apt lists
  • ✓Automatic security updates are enabled
  • ✓Only official Ubuntu package sources are used
  • ✓Kernel security parameters match recommendations

CriticalProcesses

Process poses as a system service

argv[0] names a system service, but the real binary is something else. Backdoors such as BPFDoor hide this way.

Remediation

Preserve /proc/<pid>/exe and connection details, then isolate the host and investigate. Do not kill the process first.

Evidence (1)

  • pid=2241 uid=0 dbus-daemon exe=/usr/local/bin/hald command: dbus-daemon --system
1/63↑↓ movetab switch panef filter/ searchs save JSONq quit
  • ↑↓Move
  • tabSwitch pane
  • fFilter by severity
  • /Search
  • sSave JSON to the current directory
  • qQuit

Demo data from an illustrative Ubuntu 22.04 host. Without a TTY, the tool writes the same report as JSON.

Fleets

Every host.
One loop.

With no TTY it writes JSON, so a plain SSH loop collects a report from every host. dpkg --print-architecture runs on each one, so the same loop covers amd64 and arm64 machines.

collect reports over SSH
for h in web-01 web-02 db-01; do  ssh "$h" 'sudo "./ubuntu-sys-audit-linux-$(dpkg --print-architecture)"' > "audit-$h.json"  echo "$h exit=$?"done

Then let the exit code decide. Each host in the grid is coloured by its own.

  • 0CleanNothing to act on.17 hosts
  • 1MediumMedium findings.4 hosts
  • 2Critical / HighCritical or high findings.2 hosts
  • 3IncompleteSome items could not be checked, so do not treat the host as clean.1 host
  • 130AbortedThe scan was aborted.

How it compares

A triage tool,
not a replacement.

It complements the tools you already run. Use it when you need to know, quickly and without installing anything, where an Ubuntu host stands.

ToolMain focus
◆ ubuntu-sys-auditUbuntu CVE status, signs of compromise and risky configuration in one read-only run
LynisSystem hardening and compliance auditing on Linux and Unix
rkhunter, chkrootkitRootkit detection
TrivyVulnerabilities and misconfigurations in container images, filesystems and code repositories

Run it

Take your server
for a lap.

Download, verify, run. Pick the binary that matches dpkg --print-architecture on the host.

install · amd64
curl -fsSLO https://github.com/guanting112/ubuntu-sys-audit/releases/latest/download/ubuntu-sys-audit-linux-amd64curl -fsSLO https://github.com/guanting112/ubuntu-sys-audit/releases/latest/download/SHA256SUMSsha256sum --ignore-missing -c SHA256SUMSchmod +x ubuntu-sys-audit-linux-amd64sudo ./ubuntu-sys-audit-linux-amd64
Full guide All releases

SHA256SUMS only catches a corrupted download. To prove a binary was built by this repository’s workflow, verify its build provenance attestation.