# Free Linux server audit script that emails you a report

> server_audit_notify.sh runs a Lynis security audit and a few quick system checks on a Linux server, saves the results to /var/log/server_audit, and emails you a plain-text summary over TLS through an SMTP server such as Forward Email.

Source: https://serverauditing.com/

## What is ServerAuditing?

ServerAuditing.com is the home of `server_audit_notify.sh`, a free Bash script from the [Forward Email](https://forwardemail.net) team. You run it as root on a Linux server. It audits the system with [Lynis](https://github.com/CISOfy/lynis), adds a few checks of its own, and sends the results to your inbox so you do not have to log in to read them.

The script is a single file with no build step. The header of the file declares the MIT license, and the source is on [GitHub](https://github.com/forwardemail/serverauditing.com).

## What does the script check?

Each run collects six sets of data and writes each one to its own file. The [checks page](https://serverauditing.com/what-it-checks/) lists the exact commands.

### Lynis security audit
Runs `lynis audit system` and copies up to 20 warnings from the Lynis report file into the emailed summary.

### Failed SSH logins
Reads the last 50 "Failed password" lines from `/var/log/auth.log`, `/var/log/secure` or the systemd journal, then lists the top five source IP addresses.

### Listening ports
Runs `ss -tuln`, or `netstat -tuln` when `ss` is missing, and shows any service on ports 22, 25, 80, 443, 3306 or 5432.

### Disk usage
Runs `df -h` and adds a recommendation when a file system is 90% full or more.

### Large files
Lists up to 20 files over 100 MB. The list goes into the email at the thorough level and stays in the log directory otherwise.

### Recent packages
Saves recent installs from `/var/log/dpkg.log` or `yum history` to the log directory for later review.

## How does it send the report?

The script builds a plain-text email and sends it with `curl` over implicit TLS to `smtp.forwardemail.net` on port 465, with certificate verification on. Pass `--smtp` and `--port` for another server; any port other than 465 or 2465 uses required STARTTLS. The subject line is `Server Audit Report: <hostname> - <date>`.

Read the SMTP password from the `SMTP_PASS` environment variable or from a file that only root can read (`--pass-file`). Both keep it out of the process list, and the script does not write it anywhere.

By default the script emails after every run, so a missing email means the job did not run. Add `--only-on-issues` to email only when it finds Lynis warnings, failed SSH logins or a file system at 90% or more.

## Quick start

Run these commands as root. The [install guide](https://serverauditing.com/install/) explains each step, the options, and how to schedule a daily run.

```bash
curl -fsSL -o /usr/local/bin/server_audit_notify.sh \
  https://raw.githubusercontent.com/forwardemail/serverauditing.com/main/server_audit_notify.sh
chmod 755 /usr/local/bin/server_audit_notify.sh
SMTP_PASS='your-smtp-password' /usr/local/bin/server_audit_notify.sh \
  --email you@example.com \
  --user alerts@example.com
```

## Send the reports with Forward Email

[Forward Email](https://forwardemail.net) is an open-source email service. Its outbound SMTP comes with all paid plans, as stated in the [Forward Email FAQ](https://forwardemail.net/en/faq#do-you-support-sending-email-with-smtp). Use the full alias address as the SMTP username and a password from the alias "Generate Password" option. Any other SMTP server that supports TLS also works.

## Other open-source server audit tools

`server_audit_notify.sh` is a small wrapper. These projects go further, and the [Linux server audit checklist](https://serverauditing.com/linux-server-audit-checklist/) shows where each fits.

| Tool | What it is, in the project's own words |
| --- | --- |
| [Lynis](https://github.com/CISOfy/lynis) | "Security auditing tool for Linux, macOS, and UNIX-based systems." The script uses it for the main audit. |
| [OpenSCAP](https://github.com/OpenSCAP/openscap) | "NIST Certified SCAP 1.2 toolkit." Its `oscap` command scans a system against SCAP content. |
| [Wazuh](https://github.com/wazuh/wazuh) | "A free and open source platform used for threat prevention, detection, and response." |
| [osquery](https://github.com/osquery/osquery) | "SQL powered operating system instrumentation, monitoring, and analytics." |
| [Linux Audit (auditd)](https://github.com/linux-audit/audit-userspace) | The userspace tools for the Linux Audit System, which records system calls and events from privileged programs. |
| [Falco](https://github.com/falcosecurity/falco) | "A cloud native runtime security tool for Linux operating systems." |
| [Chef InSpec](https://github.com/inspec/inspec) | "An open-source testing framework for infrastructure" with compliance, security and policy requirements. |

## Related projects from the Forward Email team

The same team builds two projects about a different question: proving which code a server runs. `server_audit_notify.sh` does not use them and does not perform attestation.

- [Attestium](https://attestium.com) is a Node.js library for remote attestation that checks evidence of what a machine runs against references the verifier fetches itself.
- [Audit Status](https://auditstatus.com) is a tool built on Attestium that checks production servers run the code in a public repository and publishes a report and badge.