Server audit script FAQ
Short answers about what server_audit_notify.sh does, what it needs, and how it handles your data and credentials.
About the script
What is server_audit_notify.sh?
It is a free server audit script from the Forward Email team that audits a Linux server and emails you a summary. It runs Lynis, checks failed SSH logins, listening ports, disk usage, large files and recent package installs, and saves each result to /var/log/server_audit. See what it checks.
Is it free?
Yes. The script is free to download and its header declares the MIT license. You need an SMTP account to send the email. With Forward Email, outbound SMTP comes with all paid plans.
Does it fix the problems it finds?
No. It only reports. The only changes it makes are installing lynis and curl if they are missing and writing report files to /var/log/server_audit.
Does it email only when it finds a problem?
Not by default. It sends the summary after every run, so a missing email means the job did not run or failed. Add --only-on-issues to send it only when the audit finds Lynis warnings, failed SSH logins or a file system at 90% or more.
Setup and scheduling
Which Linux distributions does it support?
It is written for Debian, Ubuntu and Red Hat style systems. It uses apt-get or yum to install curl and lynis when they are missing, and reads SSH failures from /var/log/auth.log, /var/log/secure or the systemd journal. On other Linux systems, install curl, lynis and ss or netstat first.
Does it need root?
Yes. It writes to /var/log/server_audit, installs missing packages, reads system logs and searches the file system for large files. Without root it prints a warning and the checks see less.
What do the audit levels do?
basic runs Lynis tests from five groups (authentication, ssh, firewalls, networking, ports_packages) and skips the large file search. standard runs every Lynis test group and every check. thorough runs the same full Lynis audit as standard and puts Lynis suggestions, large files and recent packages in the email.
Where are the reports stored?
In /var/log/server_audit, or the directory you pass with --report-dir. The script creates it with mode 700. Each run writes about ten files whose names end with the start time, such as summary_YYYY-MM-DD_HH-MM-SS.txt. The script never deletes old files, so add a cleanup job. The install guide has one.
How do I schedule it?
Use cron or a systemd timer. The install guide has examples for both. The script also has an --interval HOURS option that loops forever in the foreground.
Email and security
Can I use an SMTP provider other than Forward Email?
Yes. Pass --smtp HOST and --port PORT. Ports 465 and 2465 use implicit TLS, and any other port uses STARTTLS. The script always requires TLS and checks the server certificate, so the server must offer one or the other.
Why did the test email not arrive?
Look for "Failed to send email notification" in /var/log/server_audit/audit_*.log; the curl error is on the line before it. "Login denied" means a wrong username or password. "Failed to connect" usually means the network blocks outbound port 465; try --port 587. If the script reports success, check the spam folder of the recipient.
Is the SMTP password stored anywhere?
Not by the script. You keep it in a file that only root can read and pass --pass-file, or set the SMTP_PASS environment variable. The script hands it to curl on standard input, so it does not appear in the process list. The older --pass option still works, but then the password is visible in the process list and the script prints a warning.
How is this different from Audit Status and Attestium?
They answer a different question. Attestium is a Node.js library for remote attestation, and Audit Status is a tool built on it that checks production servers run the code in a public repository. server_audit_notify.sh reports on server configuration and does not use either one.
About this site
Does this site use cookies or tracking?
No. The site is static HTML and CSS with no JavaScript, cookies, analytics or third-party requests. GitHub Pages hosts it, and requests pass through Cloudflare, which processes visitor IP addresses. See the privacy note.
Where do I report a bug or a security issue?
Open an issue on GitHub for bugs. Report security issues privately by email to security@forwardemail.net, as the Forward Email security policy describes.