# ServerAuditing

> A free, MIT-licensed Bash script from the Forward Email team that runs a Lynis security audit plus checks for failed SSH logins, listening ports, disk usage, large files and recent package installs on a Linux server, then emails a plain-text summary over SMTP with TLS.

ServerAuditing.com is run by the Forward Email team (https://forwardemail.net). The script is `server_audit_notify.sh`; its header declares the MIT license. It runs as root and is written for Debian, Ubuntu and Red Hat style Linux systems. Every page below also has a Markdown copy at the same path plus `index.md`.

## Pages

- [Server audit script](https://serverauditing.com/): A free, MIT-licensed Bash script from the Forward Email team that runs a Lynis security audit plus checks for failed SSH logins, listening ports, disk usage, large files and recent package installs on a Linux server, then emails a plain-text summary over SMTP with TLS.
- [Install guide](https://serverauditing.com/install/): Step-by-step install guide for server_audit_notify.sh with requirements, password handling, every command-line option, cron and systemd timer examples, exit codes and troubleshooting.
- [What the script checks](https://serverauditing.com/what-it-checks/): A check-by-check reference for server_audit_notify.sh with the command behind each check, the files it writes, the three audit levels, what the emailed summary contains, and what the script does not check.
- [Linux server audit checklist](https://serverauditing.com/linux-server-audit-checklist/): A Linux server security audit checklist with one command per item, a note on which items server_audit_notify.sh covers, and links to CIS, NIST, OpenSSH and Ubuntu documentation.
- [Compliance context](https://serverauditing.com/compliance/): How scheduled server audits relate to HIPAA, PCI DSS, NIST, SOC 2 and ISO/IEC 27001, what the script's output can and cannot show, and its limits as evidence. Not legal advice.
- [FAQ](https://serverauditing.com/faq/): Frequently asked questions about server_audit_notify.sh, covering cost, supported systems, root access, audit levels, report files, SMTP providers, scheduling, password handling, and how it differs from Audit Status and Attestium.
- [About and privacy](https://serverauditing.com/about/): Who runs ServerAuditing.com, how to contact the team, where the source lives, the license, and the privacy note for this site.

## Source

- [server_audit_notify.sh](https://raw.githubusercontent.com/forwardemail/serverauditing.com/main/server_audit_notify.sh): the script itself, plain text
- [GitHub repository](https://github.com/forwardemail/serverauditing.com): source for the script and this site
- [Full text of all pages](https://serverauditing.com/llms-full.txt): every page above as Markdown in one file

## Optional

- [Forward Email](https://forwardemail.net): open-source email service; outbound SMTP comes with its paid plans
- [Attestium](https://attestium.com): Node.js remote attestation library from the Forward Email team (not used by the script)
- [Audit Status](https://auditstatus.com): tool built on Attestium that verifies production servers run published code (not used by the script)