# Accounts with interactive shell
grep -v '/nologin\|/false' /etc/passwd | cut -d: -f1,3,7
# UID 0 — must be root ONLY
awk -F: '($3 == 0) {print}' /etc/passwd
# Accounts without password (DANGER)
sudo awk -F: '($2 == "" || $2 == "!!") {print $1}' /etc/shadow

# Active sudo rules
sudo cat /etc/sudoers /etc/sudoers.d/* 2>/dev/null | grep -v '^#\|^$'
# Who can use sudo?
getent group sudo wheel | cut -d: -f4
# NOPASSWD : dangerous rule
sudo grep -r 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null

last -n 20                    # successful logins
sudo lastb -n 20              # failed attempts
sudo faillock --user $(whoami) # pam_faillock lockout

sudo sshd -T | grep -E \
  'permitrootlogin|passwordauth|pubkeyauth|maxauthtries|x11forward|permitempty'
# Expected results :
# permitrootlogin no
# passwordauthentication no
# pubkeyauthentication yes
# maxauthtries 3
# x11forwarding no

ssh -V   # must be ≥ 9.9p2 or distro‑patched
# CVE-2025-26465 CLIENT side
grep -r 'VerifyHostKeyDNS' /etc/ssh/ssh_config ~/.ssh/config 2>/dev/null
# Mitigation CVE-2025-26466
sudo sshd -T | grep -E 'maxstartups|logingracetime|persourcepenalties'

# Fingerprint and type of local keys
for f in ~/.ssh/*.pub; do
  echo "$f:"; ssh-keygen -l -f "$f" 2>/dev/null
done
# Order: Ed25519 > ECDSA > RSA 4096 > RSA 2048
# RSA 1024 or DSA = compromised, regenerate
# Generate an Ed25519 key (recommended 2026)
ssh-keygen -t ed25519 -a 100 -C "$(whoami)@$(hostname)-$(date +%Y)"

systemctl is-active firewalld   # openSUSE, RHEL, Fedora
systemctl is-active ufw         # Ubuntu, Debian
systemctl is-active nftables    # modern distros
sudo ufw status verbose
sudo firewall-cmd --state && sudo firewall-cmd --list-all

# INPUT policy (must be DROP)
sudo iptables -L | grep 'Chain INPUT'
sudo ip6tables -L -n | grep 'Chain INPUT'  # IPv6 often forgotten
# Listening ports with process
sudo ss -tlnup
# Ports exposed to the outside
sudo ss -tlnup | grep -v '127.0.0.1\|::1'

systemctl list-unit-files --type=service --state=enabled
# Clear‑text protocols to remove
dpkg -l telnet rsh-client rsh-server ftp 2>/dev/null | grep '^ii'
rpm -qa telnet rsh rlogin ftp 2>/dev/null
# Compilers (post‑exploit risk)
which gcc g++ cc make 2>/dev/null

# Top 15 by CPU (cryptominers often here)
ps aux --sort=-%cpu | head -15
# Processes without executable on disk (memory rootkits)
ls -la /proc/*/exe 2>/dev/null | grep deleted
# Crontabs for all users
for u in $(cut -f1 -d: /etc/passwd); do
  cron=$(crontab -u $u -l 2>/dev/null)
  [ -n "$cron" ] && echo "=== $u ===" && echo "$cron"
done

sudo sysctl \
  kernel.randomize_va_space \
  kernel.kptr_restrict \
  kernel.dmesg_restrict \
  kernel.unprivileged_bpf_disabled \
  net.core.bpf_jit_harden \
  net.ipv4.tcp_syncookies \
  fs.protected_hardlinks \
  fs.protected_symlinks \
  fs.suid_dumpable 2>/dev/null
# Expected: 2 / 2 / 1 / 1 / 2 / 1 / 1 / 1 / 0

mokutil --sb-state 2>/dev/null           # Secure Boot active?
[ -d /sys/firmware/efi ] && echo "UEFI" || echo "BIOS legacy"
stat -c '%a %U %G %n' /boot/grub*/grub.cfg 2>/dev/null
# Expected: 600 root root
sudo bpftool prog list 2>/dev/null | wc -l # loaded eBPF

# Files with SUID bit (privilege escalation)
sudo find / -perm -4000 -type f -ls 2>/dev/null | \
  grep -v '/proc\|/sys'
# Extended capabilities on binaries
getcap -r / 2>/dev/null
# World‑writable directories outside /tmp
sudo find / -type d -perm -0002 -ls 2>/dev/null | \
  grep -v '/proc\|/sys\|/dev\|/run\|/tmp\|/var/tmp'

# /tmp must have noexec,nosuid,nodev
findmnt -o TARGET,OPTIONS | grep -E 'noexec|nosuid|nodev'
mount | grep ' /tmp '
# File system integrity (AIDE)
sudo aide --check 2>/dev/null | head -20

sestatus
getenforce
# enforcing  = active protection ✓
# permissive = NO protection
# Recent alerts
sudo ausearch -m avc -ts recent 2>/dev/null | tail -20
sudo journalctl -b | grep 'avc:  denied' | tail -10

sudo aa-status
sudo aa-status | grep -E 'enforce|complain'
# 0 profile in "complain" for critical services
sudo aa-enforce /etc/apparmor.d/PROFIL   # enable

systemctl is-active auditd
sudo auditctl -s | grep enabled
# 1 = active  /  2 = immutable (optimal)
systemctl is-active systemd-journald
journalctl --disk-usage
ls -lh /var/log/audit/audit.log 2>/dev/null

# Failed SSH attempts
sudo journalctl -u sshd | grep "Failed\|Invalid" | tail -20
# sudo escalations
sudo journalctl | grep "sudo:" | \
  grep -v 'session opened\|session closed' | tail -20
sudo fail2ban-client status sshd 2>/dev/null

sudo ss -tunap | grep ESTABLISHED       # established connections
sudo ss -tlnup                          # active listeners
# Unexpected outgoing connections
sudo ss -tunap | grep ESTABLISHED | \
  grep -v '127.0.0.1\|::1\|192.168\|10\.'

cat /etc/resolv.conf                    # DNS resolver
# DNS-over-TLS active?
resolvectl status 2>/dev/null | grep -i 'dns\|tls\|protocol'
ip -6 addr show                         # IPv6 enabled?
sudo ip6tables -L -n 2>/dev/null | head -5  # IPv6 firewall

# Check if Falco is installed and active
systemctl is-active falco 2>/dev/null || systemctl is-active falco-kmod 2>/dev/null
# Latest alerts
journalctl -u falco --since "1 hour ago" | grep -i "alert\|warning"
# For Kubernetes environments:
kubectl get pods -n falco 2>/dev/null || echo "Falco not deployed in K8s"

# Check running containers
docker ps 2>/dev/null || podman ps 2>/dev/null || echo "No container runtime"
# Containers running as root (dangerous)
docker ps -q 2>/dev/null | xargs -I {} docker inspect {} | grep -E '"User":""|"User":"0"'

# Active LUKS volumes
sudo lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT | grep -i crypt
# Root partition encrypted?
sudo cryptsetup isLuks /dev/sda3 2>/dev/null && \
  echo "LUKS ✓" || echo "Not encrypted"
# Adapt /dev/sda3 (lsblk)
sudo cryptsetup luksDump /dev/YOUR_PARTITION 2>/dev/null | \
  grep -i 'cipher\|hash\|key'

swapon --show
grep swap /etc/crypttab 2>/dev/null
# Private key permissions (must be 600)
stat -c '%a %n' ~/.ssh/id_* 2>/dev/null
# 644 or 777 = DANGER