Linux Security Audit 2026:
Comprehensive Guide with Commands

Hands-on Commands included 20 min Desktop & Server

By Marc — Editor SafeITExperts | March 31, 2026

Context: Linux is known to be secure — but a default installation is far from a hardened system. In 2025, 5,530 kernel CVEs were recorded, and 79% of Linux attacks used no malware: they exploited misconfigurations and poorly protected credentials.

Linux Security Audit 2026 — 3D server and shields illustration

This guide covers comprehensively what a user must check:

13 security areas with exact, copy‑paste commands

The expected result for each check

A comparison of secure applications by category

An automated audit tool to get a numeric score

How to use this guide

Each tile in the navigation below corresponds to a security area. Click an item in the menu to display the associated commands, expected results, and explanations. Commands are directly copyable.

Recommended priority order: Start with CRITICAL categories — they cover the most exploited attack vectors. Then IMPORTANT, then GOOD REFLEX. Always finish with the Lynis audit (section III) to get a global score.

I. The 13 essential checks

Navigate between categories using the left menu. Each panel displays the commands to run and the expected result.

Check updatesCRITICAL

In 2025, 5,530 kernel CVEs were recorded. A 2-week delay on security patches is a measurable risk.

Check updates

# Debian / Ubuntu / Mint

$ sudo apt update && apt list --upgradable 2>/dev/null | grep -c upgradable

# Fedora / RHEL / AlmaLinux

$ sudo dnf check-update | wc -l

# openSUSE Tumbleweed / Leap

$ sudo zypper refresh && zypper list-updates

# Arch / Manjaro

$ sudo pacman -Sy && pacman -Qu | wc -l

✔ Expected: 0 pending updates.

Automatic security updatesIMPORTANT

Automatic security updates

# Debian/Ubuntu

$ systemctl is-enabled unattended-upgrades

# RHEL / Fedora

$ systemctl is-enabled dnf-automatic

# Pending security packages (RHEL/Fedora)

$ sudo dnf updateinfo list security

# Current kernel version vs available

uname -r

apt-cache policy linux-image-generic 2>/dev/null || dnf info kernel 2>/dev/null

✔ Expected: enabled. Without automatic updates, a critical vulnerability stays open for weeks.

Accounts with active shellCRITICAL

A rogue UID 0 = a ghost root. An account without a password = an open door.

Accounts with active shell

# Accounts with interactive shell

grep -v '/nologin\|/false' /etc/passwd | cut -d: -f1,3,7

# UID 0 — must be root ONLY

awk -F: '($3 == 0) {print}' /etc/passwd

# Accounts without password (DANGER)

$ sudo awk -F: '($2 == "" || $2 == "!!") {print $1}' /etc/shadow

✔ Only one UID 0 (root). No empty passwords.

sudo privileges — #1 privilege escalation vectorCRITICAL

sudo privileges

# Active sudo rules

$ sudo cat /etc/sudoers /etc/sudoers.d/* 2>/dev/null | grep -v '^#\|^$'

# Who can use sudo?

getent group sudo wheel | cut -d: -f4

# NOPASSWD : dangerous rule

$ sudo grep -r 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null

⚠ ALL=(ALL) NOPASSWD: ALL = root access without exploit. Must be removed.

Recent loginsGOOD REFLEX

Recent logins

$ last -n 20# successful logins

$ sudo lastb -n 20# failed attempts

$ sudo faillock --user $(whoami)# pam_faillock lockout

Effective sshd configurationCRITICAL

sshd -T shows the actually active config, not just the file. Takes Include into account.

sshd configuration

$ sudo sshd -T | grep -E \

# Expected results :

# permitrootlogin no

# passwordauthentication no

# pubkeyauthentication yes

# maxauthtries 3

# x11forwarding no

CVE-2025-26465 / 26466CRITICAL

MITM + DoS pre-auth on OpenSSH < 9.9p2. Disclosed on Feb 18, 2025.

SSH version check

$ ssh -V# must be ≥ 9.9p2 or distro‑patched

# CVE-2025-26465 CLIENT side

grep -r 'VerifyHostKeyDNS' /etc/ssh/ssh_config ~/.ssh/config 2>/dev/null

# Mitigation CVE-2025-26466

$ sudo sshd -T | grep -E 'maxstartups|logingracetime|persourcepenalties'

✔ VerifyHostKeyDNS absent or "no". maxstartups 10:30:60.

SSH key typeIMPORTANT

SSH key type

# Fingerprint and type of local keys

for f in ~/.ssh/*.pub; do

$ echo "$f:"; ssh-keygen -l -f "$f" 2>/dev/null

done

# Order: Ed25519 > ECDSA > RSA 4096 > RSA 2048

# RSA 1024 or DSA = compromised, regenerate

# Generate an Ed25519 key (recommended 2026)

$ ssh-keygen -t ed25519 -a 100 -C "$(whoami)@$(hostname)-$(date +%Y)"

Firewall active?CRITICAL

Firewall status

$ systemctl is-active firewalld# openSUSE, RHEL, Fedora

$ systemctl is-active ufw# Ubuntu, Debian

$ systemctl is-active nftables# modern distros

$ sudo ufw status verbose

$ sudo firewall-cmd --state && sudo firewall-cmd --list-all

✔ active or running.

Default policy and IPv6CRITICAL

Default filter policy

# INPUT policy (must be DROP)

$ sudo iptables -L | grep 'Chain INPUT'

$ sudo ip6tables -L -n | grep 'Chain INPUT'# IPv6 often forgotten

# Listening ports with process

$ sudo ss -tlnup

# Ports exposed to the outside

$ sudo ss -tlnup | grep -v '127.0.0.1\|::1'

✔ Chain INPUT (policy DROP). ip6tables rules present.

Active services and dangerous packagesIMPORTANT

Active services

$ systemctl list-unit-files --type=service --state=enabled

# Clear‑text protocols to remove

dpkg -l telnet rsh-client rsh-server ftp 2>/dev/null | grep '^ii'

rpm -qa telnet rsh rlogin ftp 2>/dev/null

# Compilers (post‑exploit risk)

which gcc g++ cc make 2>/dev/null

✔ Telnet, rsh, rlogin absent or uninstalled.

Suspicious processes and persistenceIMPORTANT

Top CPU processes

# Top 15 by CPU (cryptominers often here)

$ ps aux --sort=-%cpu | head -15

# Processes without executable on disk (memory rootkits)

ls -la /proc/*/exe 2>/dev/null | grep deleted

# Crontabs for all users

for u in $(cut -f1 -d: /etc/passwd); do

cron=$(crontab -u $u -l 2>/dev/null)

[ -n "$cron" ] && echo "=== $u ===" && echo "$cron"

done

✔ No "deleted" processes. No unexpected outgoing connections.

Security sysctl parametersIMPORTANT

eBPF is a critical attack surface in 2025‑2026. unprivileged_bpf_disabled must be 1.

Security sysctl parameters

$ sudo sysctl \

kernel.randomize_va_space \

kernel.kptr_restrict \

kernel.dmesg_restrict \

kernel.unprivileged_bpf_disabled \

net.core.bpf_jit_harden \

net.ipv4.tcp_syncookies \

fs.protected_hardlinks \

fs.protected_symlinks \

fs.suid_dumpable 2>/dev/null

# Expected: 2 / 2 / 1 / 1 / 2 / 1 / 1 / 1 / 0

Secure Boot and bootloaderGOOD REFLEX

Secure Boot

$ mokutil --sb-state 2>/dev/null# Secure Boot active?

[ -d /sys/firmware/efi ] && echo "UEFI" || echo "BIOS legacy"

stat -c '%a %U %G %n' /boot/grub*/grub.cfg 2>/dev/null

# Expected: 600 root root

$ sudo bpftool prog list 2>/dev/null | wc -l# loaded eBPF

SUID files and capabilitiesIMPORTANT

SUID files

# Files with SUID bit (privilege escalation)

$ sudo find / -perm -4000 -type f -ls 2>/dev/null | \

grep -v '/proc\|/sys'

# Extended capabilities on binaries

getcap -r / 2>/dev/null

# World‑writable directories outside /tmp

$ sudo find / -type d -perm -0002 -ls 2>/dev/null | \

grep -v '/proc\|/sys\|/dev\|/run\|/tmp\|/var/tmp'

⚠ Any non‑standard SUID binary (find, vim, bash) = immediate escalation.

/tmp mount optionsIMPORTANT

/tmp mount options

# /tmp must have noexec,nosuid,nodev

$ findmnt -o TARGET,OPTIONS | grep -E 'noexec|nosuid|nodev'

mount | grep ' /tmp '

# File system integrity (AIDE)

$ sudo aide --check 2>/dev/null | head -20

✔ /tmp mounted with noexec,nosuid,nodev.

SELinux — status and modeCRITICAL

In permissive mode, SELinux logs but does not block — illusory protection.

SELinux status

$ sestatus

getenforce

# enforcing = active protection ✓

# permissive = NO protection

# Recent alerts

$ sudo ausearch -m avc -ts recent 2>/dev/null | tail -20

$ sudo journalctl -b | grep 'avc: denied' | tail -10

✔ Mode enforcing mandatory.

AppArmor — profiles and modeCRITICAL

AppArmor status

$ sudo aa-status

$ sudo aa-status | grep -E 'enforce|complain'

# 0 profile in "complain" for critical services

$ sudo aa-enforce /etc/apparmor.d/PROFIL# enable

✔ 0 profile in complain mode for exposed services.

Active loggingIMPORTANT

auditd status

$ systemctl is-active auditd

$ sudo auditctl -s | grep enabled

# 1 = active / 2 = immutable (optimal)

$ systemctl is-active systemd-journald

$ journalctl --disk-usage

ls -lh /var/log/audit/audit.log 2>/dev/null

✔ auditd active, mode 1 or 2.

Suspicious eventsIMPORTANT

SSH failed logins

# Failed SSH attempts

$ sudo journalctl -u sshd | grep "Failed\|Invalid" | tail -20

# sudo escalations

$ sudo journalctl | grep "sudo:" | \

grep -v 'session opened\|session closed' | tail -20

$ sudo fail2ban-client status sshd 2>/dev/null

Active network connectionsIMPORTANT

Active connections

$ sudo ss -tunap | grep ESTABLISHED# established connections

$ sudo ss -tlnup# active listeners

# Unexpected outgoing connections

$ sudo ss -tunap | grep ESTABLISHED | \

grep -v '127.0.0.1\|::1\|192.168\|10\.'

DNS and privacyIMPORTANT

DNS resolver

$ cat /etc/resolv.conf# DNS resolver

# DNS-over-TLS active?

resolvectl status 2>/dev/null | grep -i 'dns\|tls\|protocol'

ip -6 addr show# IPv6 enabled?

$ sudo ip6tables -L -n 2>/dev/null | head -5# IPv6 firewall

✔ DNS-over-TLS enabled. ip6tables rules present.

Falco — runtime detectionIMPORTANT

Falco (CNCF graduated) monitors system calls and detects abnormal behaviour (shells in containers, suspicious mounts, etc.).

Falco runtime

# Check if Falco is installed and active

$ systemctl is-active falco 2>/dev/null || systemctl is-active falco-kmod 2>/dev/null

# Latest alerts

$ journalctl -u falco --since "1 hour ago" | grep -i "alert\|warning"

# For Kubernetes environments:

kubectl get pods -n falco 2>/dev/null || echo "Falco not deployed in K8s"

✔ Falco active, no recent critical alert. Absent on a desktop = acceptable, on a production server = missing.

Containers: privileges and isolationIMPORTANT

Containers must run as non‑root and with reduced capabilities.

Active containers

# Check running containers

$ docker ps 2>/dev/null || podman ps 2>/dev/null || echo "No container runtime"

# Containers running as root (dangerous)

$ docker ps -q 2>/dev/null | xargs -I {} docker inspect {} | grep -E '"User":""|"User":"0"'

⚠ No container running as root. Use --user or Kubernetes securityContext.

LUKS disk encryptionCRITICAL

Without LUKS, stealing the disk is enough to read all your data — even with a locked session.

LUKS partitions

# Active LUKS volumes

$ sudo lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINT | grep -i crypt

# Root partition encrypted?

$ sudo cryptsetup isLuks /dev/sda3 2>/dev/null && \

$ echo "LUKS ✓" || echo "Not encrypted"

# Adapt /dev/sda3 (lsblk)

$ sudo cryptsetup luksDump /dev/YOUR_PARTITION 2>/dev/null | \

grep -i 'cipher\|hash\|key'

✔ Type crypto_LUKS. Cipher: aes-xts-plain64.

Encrypted swap and SSH keysIMPORTANT

Swap status

$ swapon --show

grep swap /etc/crypttab 2>/dev/null

# Private key permissions (must be 600)

stat -c '%a %n' ~/.ssh/id_* 2>/dev/null

# 644 or 777 = DANGER

✔ SSH keys mode 600. Swap encrypted or zram.

II. Secure application comparison

Recommended applications by category, compared according to current security and privacy criteria in 2026.

Web browser

Browser	Telemetry	Verdict
LibreWolf	None	✓ Recommended
Hardened Firefox	Disableable	✓ Good
Ungoogled Chromium	None	✓ Acceptable
Brave	Partial	~ Mitigated
Chrome / Edge	Maximal	✗ Discouraged

Password manager

Application	Storage	Verdict
KeePassXC	Local, encrypted	✓ Recommended
Bitwarden	Self‑hostable	✓ Very good
1Password	Proprietary cloud	~ Acceptable
LastPass	Cloud (breached 2022)	✗ Avoid
Browser built‑in	Cloud sync	✗ Insufficient

Instant messaging

Application	Encryption	Verdict
Signal	E2E (Signal protocol)	✓ Recommended
Element / Matrix	E2E optional	✓ Good
Telegram	E2E optional only	~ Insufficient
WhatsApp	E2E (but Meta)	✗ Discouraged
Discord	No E2E	✗ Avoid

VPN — protocols & reliability

Solution	Protocol	Verdict
WireGuard	WireGuard	✓ Self‑hosted
Mullvad	WireGuard	✓ Verified no‑log
ProtonVPN	WireGuard	✓ Good
NordVPN / ExpressVPN	WireGuard	~ Mitigated
Browser VPN	Simple proxy	✗ Marketing

Audit and detection tools (2026)

Tool	Type	Usage	2026 Verdict
Lynis	Full audit	Hardening score, recommendations	✓ Must‑have reference
CrowdSec	Collaborative banning	Modern Fail2ban replacement, behavioural analysis, 60x faster	✓ 2026 standard
rkhunter	Rootkit scanner	On‑demand audit, daily cron	✓ Essential
chkrootkit	Rootkit scanner	Complement to rkhunter	✓ Good complement
ClamAV	Antivirus	File scanning, mail server	✓ Useful (mail server)
Fail2ban	IP banning	Brute‑force SSH, services	~ Obsolete (prefer CrowdSec)
Wazuh	SIEM / IDS	Continuous monitoring, correlation	~ Advanced / enterprise
Falco	Runtime security	Behavioural detection (containers, kernel) – CNCF graduated project	✓ Container standard
OpenSCAP	Compliance	CIS Benchmark / DISA STIG audit	✓ Regulatory compliance

III. Lynis score — the automated audit reference

Lynis is the reference tool to obtain a numeric hardening score. It covers in 5 to 10 minutes all the areas of this article and provides prioritised recommendations.

Principle: The Lynis score (Hardening Index) ranges from 0 to 100. It is the fastest way to objectively compare two Linux installations: an OS with a score of 85 is measurably more secure than an OS at 45.

Lynis — Installation & Full Audit

# ── 1. Install Lynis ──────────────────────────────────────

$ sudo apt install lynis -y# Debian / Ubuntu / Mint

$ sudo dnf install lynis -y# Fedora / RHEL / AlmaLinux

$ sudo zypper install lynis# openSUSE

$ sudo pacman -S lynis# Arch / Manjaro

# ── 2. Run the full audit (5-10 min) ───────────────────

$ sudo lynis audit system

# ── 3. Read the hardening index ─────────────────────────

$ sudo lynis audit system | grep 'Hardening index'

# ── 4. See priority warnings ────────────────────────────

$ sudo grep Warning /var/log/lynis.log

$ sudo grep suggestion /var/log/lynis-report.dat | head -20

# ── 5. Schedule a weekly audit ──────────────────────────

$ echo "0 3 * * 0 root /usr/bin/lynis audit system > /var/log/lynis-weekly.log 2>&1" \

| sudo tee /etc/cron.d/lynis-weekly

Interpreting the score and practical limitations

≥ 80 — Hardened (excellent)

65–79 — Correct

50–64 — Needs improvement

30–49 — Vulnerable

< 30 — Exposed

2026 warning: limits of maximal hardening
Reaching a score > 90 is theoretically possible, but exposes you to documented functional risks.

Parameter	Risk	Recommendation
`kernel.modules_disabled=1`	Disables kernel modules → USB devices, some external drives become inoperable	Avoid on workstations
PAM modifications (`pam_faillock`, `pam_tally2`)	Incorrect configuration → `sudo` lockout and admin lockout	Use `libpam-pwquality` and test before reboot

Practical recommendation: Aim for a score ≥ 80 for a server, ≥ 85 for a workstation without loss of functionality. Above 90, test your system thoroughly before production.
Source: user feedback, February 2026

Going further: The CIS Benchmark audit via OpenSCAP provides a detailed HTML report with each control marked PASS/FAIL. It is the reference used for regulatory audits (PCI-DSS, HIPAA, SOC2).

OpenSCAP — CIS Benchmark Audit

# CIS Benchmark audit via OpenSCAP

$ sudo apt install openscap-scanner scap-security-guide -y

# Run CIS level 1 audit (Ubuntu 24.04)

$ sudo oscap xccdf eval \

--profile xccdf_org.ssgproject.content_profile_cis_level1_server \

--results /tmp/cis-results.xml \

--report /tmp/cis-report.html \

/usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

# Open the HTML report

$ xdg-open /tmp/cis-report.html

IV. 2026 standards: automation, runtime and collective intelligence

Security practices have evolved in 2026. Here are the three pillars that complement classic auditing.

1. CrowdSec: the modern successor to Fail2ban

CrowdSec has become the reference solution for protecting against brute‑force and malicious scans. Written in Go, it is up to 60 times faster than Fail2ban and incorporates collaborative intelligence: when an attacker is detected on one server in the CrowdSec network, the IP is automatically blocked on all other servers in real time.

Criterion	CrowdSec (2026)	Fail2ban (legacy)
Performance	Go, up to 60× faster	Python, single‑threaded
Collaboration	Global threat intelligence network	None
IPv6	Native	Partial support
Integrated WAF	Yes (HTTP bouncers)	No
Machine learning	Behavioural analysis	Static rules

Quick install (Debian/Ubuntu):

CrowdSec — Quick Install

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

$ sudo apt install crowdsec

Source: CrowdSec vs Fail2ban – official comparison (CrowdSec FAQ)

2. Falco – runtime security (CNCF graduated)

In 2026, Falco is the reference runtime security project in the cloud‑native ecosystem. It interfaces directly with the Linux kernel to detect anomalous behaviour in real time: unauthorised process execution, suspicious volume mounts, unexpected network connections, etc.

Example Falco rule (detecting a shell inside a container):

Falco — Runtime Detection Rule

- rule: Shell in container

desc: A shell was launched inside a production container

condition: container and proc.name in (shell_binaries)

output: "Shell launched in container (user=%user.name %container.info)"

3. Automating hardening with Ansible (devsec.hardening)

The devsec.hardening collection (formerly ansible-hardening) has become the community reference for applying hardening compliant with CIS and STIG benchmarks. It is actively maintained and supports recent versions.

Role	Function	Status
`os_hardening`	sysctl, file permissions, removal of dangerous packages	Active
`ssh_hardening`	Ed25519 keys, password disabling, root restriction	Active
`nginx_hardening`	Secure default configuration	Active
`mysql_hardening`	Permissions, passwords, TLS	Active

Ansible — devsec.hardening

# Installation and usage

$ ansible-galaxy collection install devsec.hardening

# playbook.yml

- hosts: all

become: true

collections:

- devsec.hardening

roles:

- devsec.hardening.os_hardening

- devsec.hardening.ssh_hardening

4. CIS Benchmarks: the compliance standard

CIS Benchmarks have become the essential reference to objectively measure an OS’s security in 2026. More than 171 open source projects on GitHub allow you to audit these benchmarks automatically.

Tool	Type	Recommended use
OpenSCAP	HTML/XCCDF audit	Regulatory compliance (PCI‑DSS, HIPAA)
Prowler	Multi‑cloud environment	AWS/Azure/GCP + Linux audit
Ansible CIS roles	Automation	Continuous application and verification

2026 references:

CrowdSec vs Fail2ban – official comparison (CrowdSec FAQ)
Falco – CNCF graduated (March 2026)
devsec.hardening – latest updates (March 2026)
CIS Benchmark tools – 171 GitHub projects (January 2026)

Conclusion

The 5 most impactful actions: updates, sudo policy, SSH with Ed25519 keys, DROP firewall, SELinux enforcing.

Comparison is objective: a Lynis score ≥ 80 and a CIS audit PASS on critical points concretely define a hardened OS.

2026 standards: replace Fail2ban with CrowdSec, use Falco for containerised environments, and automate your hardening with Ansible devsec.hardening.

Security is a continuous state: schedule rkhunter daily, Lynis weekly, and CrowdSec in real time to avoid regression.

"Linux provides excellent security primitives — and then hands you the controls. What you do with them is entirely up to you."

— SafeITExperts

Find our technical analyses on safeitexperts.com.

About the author

Marc is the lead editor of SafeITExperts, a bilingual (FR/EN) technical blog dedicated to cybersecurity, Linux and digital sovereignty.

Table of Contents

Linux Security Audit 2026:
Comprehensive Guide with Commands

How to use this guide

I. The 13 essential checks

II. Secure application comparison

Web browser

Password manager

Instant messaging

VPN — protocols & reliability

Audit and detection tools (2026)

III. Lynis score — the automated audit reference

Interpreting the score and practical limitations

IV. 2026 standards: automation, runtime and collective intelligence

1. CrowdSec: the modern successor to Fail2ban

2. Falco – runtime security (CNCF graduated)

3. Automating hardening with Ansible (devsec.hardening)

4. CIS Benchmarks: the compliance standard

Conclusion

About the author

👥 Comments