# Server audit script FAQ

> Short answers about what server_audit_notify.sh does, what it needs, and how it handles your data and credentials.

Source: https://serverauditing.com/faq/

## About the script

### What is server_audit_notify.sh?

It is a [free server audit script](https://serverauditing.com/) from the Forward Email team that audits a Linux server and emails you a summary. It runs Lynis, checks failed SSH logins, listening ports, disk usage, large files and recent package installs, and saves each result to `/var/log/server_audit`. See [what it checks](https://serverauditing.com/what-it-checks/).

### Is it free?

Yes. The script is free to download and its header declares the MIT license. You need an SMTP account to send the email. With Forward Email, outbound SMTP comes with all paid plans.

### Does it fix the problems it finds?

No. It only reports. The only changes it makes are installing `lynis` and `curl` if they are missing and writing report files to `/var/log/server_audit`.

### Does it email only when it finds a problem?

Not by default. It sends the summary after every run, so a missing email means the job did not run or failed. Add `--only-on-issues` to send it only when the audit finds Lynis warnings, failed SSH logins or a file system at 90% or more.

## Setup and scheduling

### Which Linux distributions does it support?

It is written for Debian, Ubuntu and Red Hat style systems. It uses `apt-get` or `yum` to install `curl` and `lynis` when they are missing, and reads SSH failures from `/var/log/auth.log`, `/var/log/secure` or the systemd journal. On other Linux systems, install `curl`, `lynis` and `ss` or `netstat` first.

### Does it need root?

Yes. It writes to `/var/log/server_audit`, installs missing packages, reads system logs and searches the file system for large files. Without root it prints a warning and the checks see less.

### What do the audit levels do?

`basic` runs Lynis tests from five groups (authentication, ssh, firewalls, networking, ports_packages) and skips the large file search. `standard` runs every Lynis test group and every check. `thorough` runs the same full Lynis audit as `standard` and puts Lynis suggestions, large files and recent packages in the email.

### Where are the reports stored?

In `/var/log/server_audit`, or the directory you pass with `--report-dir`. The script creates it with mode 700. Each run writes about ten files whose names end with the start time, such as `summary_YYYY-MM-DD_HH-MM-SS.txt`. The script never deletes old files, so add a cleanup job. The [install guide](https://serverauditing.com/install/) has one.

### How do I schedule it?

Use cron or a systemd timer. The [install guide](https://serverauditing.com/install/) has examples for both. The script also has an `--interval HOURS` option that loops forever in the foreground.

## Email and security

### Can I use an SMTP provider other than Forward Email?

Yes. Pass `--smtp HOST` and `--port PORT`. Ports 465 and 2465 use implicit TLS, and any other port uses STARTTLS. The script always requires TLS and checks the server certificate, so the server must offer one or the other.

### Why did the test email not arrive?

Look for "Failed to send email notification" in `/var/log/server_audit/audit_*.log`; the curl error is on the line before it. "Login denied" means a wrong username or password. "Failed to connect" usually means the network blocks outbound port 465; try `--port 587`. If the script reports success, check the spam folder of the recipient.

### Is the SMTP password stored anywhere?

Not by the script. You keep it in a file that only root can read and pass `--pass-file`, or set the `SMTP_PASS` environment variable. The script hands it to `curl` on standard input, so it does not appear in the process list. The older `--pass` option still works, but then the password is visible in the process list and the script prints a warning.

### How is this different from Audit Status and Attestium?

They answer a different question. [Attestium](https://attestium.com) is a Node.js library for remote attestation, and [Audit Status](https://auditstatus.com) is a tool built on it that checks production servers run the code in a public repository. `server_audit_notify.sh` reports on server configuration and does not use either one.

## About this site

### Does this site use cookies or tracking?

No. The site is static HTML and CSS with no JavaScript, cookies, analytics or third-party requests. GitHub Pages hosts it, and requests pass through Cloudflare, which processes visitor IP addresses. See the [privacy note](https://serverauditing.com/about/#privacy-note).

### Where do I report a bug or a security issue?

Open an issue on [GitHub](https://github.com/forwardemail/serverauditing.com/issues) for bugs. Report security issues privately by email to [security@forwardemail.net](mailto:security@forwardemail.net), as the [Forward Email security policy](https://forwardemail.net/en/security) describes.