ubuntu-sys-audit
v0.1.18GitHub

What it checks

Twelve sectors.
One pass.

Every scan walks the same twelve categories, from missing CVE fixes to processes posing as kernel threads. Each finding has a severity, the evidence it is based on and what to do about it.

Run a scan

01 / 12

CVE

Missing fixes, with backports accounted for.

  • Installed packages and the running kernel against Ubuntu Security Notices (USN) OVAL data
  • Fixes available only through ESM, with the exact pro fix command
  • The LXD snap, which USN does not cover, against Canonical’s LXD advisories
  • Single CVEs on demand with --cve, including ones with no fix released yet

Example findings

●lua-cjson: 1 security notice missing, 3 CVEsHigh

●LXD 4.0.9 is on a branch that no longer gets fixesHigh

●imagemagick: 15 security notices missing, 77 CVEsMedium

02 / 12

Web

nginx, PHP and Caddy, inside and out.

  • nginx and PHP versions and origin; non-Ubuntu builds against nginx.org and php.net
  • Caddy’s version, Go toolchain and plugins read from the binary; xcaddy builds against Go’s vulnerability database
  • Dangerous settings such as Caddy’s admin API open to the network and directory listing
  • The certificate HTTPS gives without a server name, which ties the host’s address to its domains
  • Webshell signatures in nginx, Apache and Caddy site roots; PHP files in upload directories

Example findings

●HTTPS without a server name gets a certificate that names this host’s domains (2)High

●PHP files in upload directories (3)High

●nginx has directory listing enabled (autoindex on)Medium

03 / 12

Network

Every listener, socket and tunnel.

  • Port 53 listeners and their owners; traffic to DNS servers the system is not configured to use
  • All listening ports, packet and raw sockets, and BPF filters carrying BPFDoor magic values
  • Promiscuous interfaces, MPTCP, rarely used protocols (DCCP, SCTP, RDS, TIPC)
  • ufw’s default policy and IPv6 gaps; Docker and container ports that bypass ufw
  • Tunnel interfaces and their programs, unexplained IP forwarding, default routes
  • /etc/hosts overrides of Ubuntu domains, LXD API exposure and privileged LXD containers

Example findings

●Packet socket BPF filter contains BPFDoor magic valuesCritical

●Redis is bound to a non-loopback addressHigh

●Published container ports bypass ufwMedium

04 / 12

Processes

What is running, and what it pretends to be.

  • Processes posing as kernel threads or system services
  • Execution from temporary directories or from memory (memfd)
  • Reverse shells, and shells running under web services
  • Crypto miners, LD_PRELOAD injection and hidden processes
  • Libraries replaced on disk but still in use

Example findings

●Process poses as a system serviceCritical

●Possible reverse shellCritical

●Shell running under a web serviceHigh

05 / 12

Integrity

System files that are not what dpkg shipped.

  • System binaries against the hashes dpkg recorded at install time
  • /etc/ld.so.preload, core_pattern and the modprobe path
  • Kernel modules hidden from /proc/modules, and unsigned or out-of-tree modules
  • PAM modules and configuration; NSS modules outside package management

Example findings

●Key system files do not match package hashes (2)Critical

●/etc/ld.so.preload has entriesCritical

●Unsigned or out-of-tree kernel modules are loadedMedium

06 / 12

Persistence

Everything that is set to run again.

  • cron, anacron, at, rc.local, init.d, profile scripts and motd
  • apt hooks, udev rules, logrotate scripts, network interface and DHCP hooks
  • Desktop autostart entries, login scripts in home directories, TCP Wrappers commands
  • systemd services, user units, generators, transient units and lingering users
  • LD_PRELOAD and similar variables in units; drop-ins that replace a package’s ExecStart

Example findings

●Scheduled job or login script lines with malicious signs (1)Critical

●Scheduled jobs or login scripts run programs from temp directoriesHigh

●TCP Wrappers rules run a command on connectionHigh

07 / 12

Accounts

Who can get in, and who has root.

  • Account count and list, and UID 0 accounts other than root
  • Empty passwords, weak hashes and system accounts with a usable password
  • sudo rules, including passwordless ones, and members of privileged groups
  • Login history and SSH brute-force attempts

Example findings

●UID 0 accounts other than root (1)Critical

●root logged in from a public IPHigh

●Passwordless sudo rules (1)Medium

08 / 12

SSH

The front door, and every key to it.

  • Effective sshd_config settings, Match blocks included
  • Authorized keys with fingerprints, forced commands and deprecated DSA keys
  • Keys on system accounts, ~/.ssh/rc and /etc/ssh/sshrc
  • Host key permissions

Example findings

●Root can log in over SSH with a passwordHigh

●System accounts have SSH authorized keysHigh

●SSH allows password loginMedium

09 / 12

Filesystem

Privilege-escalation leftovers on disk.

  • SUID and SGID files, and files with dangerous capabilities
  • Executables, scripts and hidden directories in temporary directories
  • Regular files in /dev
  • World-writable system files and system binaries no package manages

Example findings

●Dangerous SUID/SGID files (1)Critical

●Files with dangerous capabilities (1)High

●Regular files in /dev (2)High

10 / 12

Packages

Updates waiting, and where packages come from.

  • Pending security updates and stale apt lists
  • Whether automatic security updates are installed and enabled
  • Packages on apt hold and third-party package sources
  • Versions of key software

Example findings

●Security updates not yet installed (9)High

●unattended-upgrades is installed but not enabledMedium

●Packages on apt hold (2)Medium

11 / 12

Stack

Databases, runtimes and servers, and their end of life.

  • Databases: PostgreSQL, MySQL, MariaDB, Redis, Valkey, MongoDB, SQLite
  • Language runtimes: Node.js, Python, Ruby, Java, PHP, Go
  • Servers: nginx, Apache, HAProxy, Docker, containerd
  • Found in packages, version managers (nvm, pyenv, SDKMAN!), hand-unpacked installs, containers and processes
  • Whether each listens beyond loopback, and whether its release is past end of life

Example findings

●Node.js 16 is past end of lifeHigh

○Node.js 22 reaches end of life on 2027-04-30Info

○Tech stack (8 components)Info

12 / 12

System

The release, the kernel, and the machine itself.

  • Release support dates and ESM status
  • Kernel version, and whether the running kernel is the newest installed
  • Pending reboots
  • Kernel security parameters and unprivileged user namespaces
  • CPU vulnerability mitigations

Example findings

●Ubuntu 18.04 is past standard support and ESM is not enabledHigh

●Running kernel is not the newest installedHigh

●Unmitigated CPU vulnerabilities (1)Medium

Severity

Six levels,
one exit code.

Severities match the terminal UI’s colours. The exit code is set by the most serious result, and an incomplete scan never passes for a clean one.

  • ● CriticalA likely sign of compromise or a direct path to root. Isolate and investigate first.Exit code 2
  • ● HighA serious exposure or missing fix that an attacker can use. Fix soon.Exit code 2
  • ● MediumRisky configuration or a lower-priority missing fix. Plan a change.Exit code 1
  • ○ InfoContext about the host: inventories, versions, listening ports, who logged in.Exit code 0
  • ✓ PassedThe check ran and found nothing to act on.Exit code 0
  • – Not checkedNo permission, a timeout or no network. Never counts as passed.Exit code 3, unless critical or high findings

On demand

A new CVE drops.
Ask every host.

--cve runs only the lookup. It reads Canonical’s CVE data for the release, which also lists CVEs with no fix released yet, and answers each one.

look up specific CVEs
sudo ./ubuntu-sys-audit-linux-amd64 --cve CVE-2026-98432,CVE-2024-6387

Affected, fix available

The host runs a vulnerable version and a fix has been released. Severity is the CVE’s own priority.

Affected, no fix released

Ubuntu lists the CVE but has not shipped a fix yet. It may still turn out not to apply.

Fixed in the installed version

The installed package already contains the fix, backports included.

Not affected

The CVE does not apply to this release or to anything installed.

In an SSH loop, exit code 2 marks the hosts a high or critical CVE reaches. Inside a container, or with a kernel Ubuntu does not ship, the kernel is not checked and the answer says so.