Free Linux server audit script that emails you a report

server_audit_notify.sh runs a Lynis security audit and a few quick system checks on a Linux server, saves the results to /var/log/server_audit, and emails you a plain-text summary over TLS through an SMTP server such as Forward Email.

Read the install guideView the script on GitHub

What is ServerAuditing?

ServerAuditing.com is the home of server_audit_notify.sh, a free Bash script from the Forward Email team. You run it as root on a Linux server. It audits the system with Lynis, adds a few checks of its own, and sends the results to your inbox so you do not have to log in to read them.

The script is a single file with no build step. The header of the file declares the MIT license, and the source is on GitHub.

What does the script check?

Each run collects six sets of data and writes each one to its own file. The checks page lists the exact commands.

Lynis security audit

Runs lynis audit system and copies up to 20 warnings from the Lynis report file into the emailed summary.

Failed SSH logins

Reads the last 50 "Failed password" lines from /var/log/auth.log, /var/log/secure or the systemd journal, then lists the top five source IP addresses.

Listening ports

Runs ss -tuln, or netstat -tuln when ss is missing, and shows any service on ports 22, 25, 80, 443, 3306 or 5432.

Disk usage

Runs df -h and adds a recommendation when a file system is 90% full or more.

Large files

Lists up to 20 files over 100 MB. The list goes into the email at the thorough level and stays in the log directory otherwise.

Recent packages

Saves recent installs from /var/log/dpkg.log or yum history to the log directory for later review.

How does it send the report?

The script builds a plain-text email and sends it with curl over implicit TLS to smtp.forwardemail.net on port 465, with certificate verification on. Pass --smtp and --port for another server; any port other than 465 or 2465 uses required STARTTLS. The subject line is Server Audit Report: <hostname> - <date>.

Read the SMTP password from the SMTP_PASS environment variable or from a file that only root can read (--pass-file). Both keep it out of the process list, and the script does not write it anywhere.

By default the script emails after every run, so a missing email means the job did not run. Add --only-on-issues to email only when it finds Lynis warnings, failed SSH logins or a file system at 90% or more.

Quick start

Run these commands as root. The install guide explains each step, the options, and how to schedule a daily run.

curl -fsSL -o /usr/local/bin/server_audit_notify.sh \
  https://raw.githubusercontent.com/forwardemail/serverauditing.com/main/server_audit_notify.sh
chmod 755 /usr/local/bin/server_audit_notify.sh
SMTP_PASS='your-smtp-password' /usr/local/bin/server_audit_notify.sh \
  --email you@example.com \
  --user alerts@example.com

Send the reports with Forward Email

Forward Email is an open-source email service. Its outbound SMTP comes with all paid plans, as stated in the Forward Email FAQ. Use the full alias address as the SMTP username and a password from the alias "Generate Password" option. Any other SMTP server that supports TLS also works.

Other open-source server audit tools

server_audit_notify.sh is a small wrapper. These projects go further, and the Linux server audit checklist shows where each fits.

ToolWhat it is, in the project's own words
Lynis"Security auditing tool for Linux, macOS, and UNIX-based systems." The script uses it for the main audit.
OpenSCAP"NIST Certified SCAP 1.2 toolkit." Its oscap command scans a system against SCAP content.
Wazuh"A free and open source platform used for threat prevention, detection, and response."
osquery"SQL powered operating system instrumentation, monitoring, and analytics."
Linux Audit (auditd)The userspace tools for the Linux Audit System, which records system calls and events from privileged programs.
Falco"A cloud native runtime security tool for Linux operating systems."
Chef InSpec"An open-source testing framework for infrastructure" with compliance, security and policy requirements.

The same team builds two projects about a different question: proving which code a server runs. server_audit_notify.sh does not use them and does not perform attestation.