From lehnert-skills
Use when user wants to audit, review, analyze, or improve a Linux config file — nginx, Apache, sshd_config, systemd service/timer/socket units, iptables, nftables, firewalld, fail2ban, sudoers, /etc/security/limits.conf, sysctl.conf, or any server config — for security issues, misconfigurations, performance problems, or compliance gaps.
How this skill is triggered — by the user, by Claude, or both
Slash command
/lehnert-skills:linux-config-auditorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Audits any Linux configuration file against security best practices, performance recommendations, and common compliance baselines (CIS, STIG-inspired). Outputs a structured findings report with severity ratings, explanations, and ready-to-apply fix snippets.
Audits any Linux configuration file against security best practices, performance recommendations, and common compliance baselines (CIS, STIG-inspired). Outputs a structured findings report with severity ratings, explanations, and ready-to-apply fix snippets.
Language: Respond in the user's language. Config snippets always use the native config syntax.
| Config File / Type | What Gets Checked |
|---|---|
nginx.conf / vhost | TLS versions, cipher suites, headers, rate limiting, open redirects, directory listing, worker tuning |
apache2.conf / .htaccess | ServerTokens, TLS, headers, directory access, mod_security hints |
sshd_config | PermitRootLogin, PasswordAuth, key algorithms, ciphers, idle timeout, AllowUsers/Groups |
systemd unit (.service, .timer, .socket) | Sandboxing, privilege escalation, restart policy, resource limits |
iptables / nftables rules | Default policies, open ports vs. need, stateful rules, loopback, anti-spoofing |
firewalld config | Active zones, overly permissive services, rich rules |
fail2ban jail config | Enabled jails, ban time, max retry, action severity |
sudoers / visudo | NOPASSWD, wildcards, command scope, user/group grants |
sysctl.conf | Network hardening params, kernel pointer restriction, core dump settings |
/etc/security/limits.conf | Open file limits, process limits for services |
pg_hba.conf | Peer/md5/scram auth methods, host access rules, trust entries |
mysql/my.cnf | bind-address, skip-networking, max_connections, log_error, SSL settings |
redis.conf | requirepass, bind, protected-mode, ACL, TLS, dangerous commands |
| Generic / unknown | Best-effort structural review, flag obvious anti-patterns |
Run findings through three lenses in order:
Look for settings that increase attack surface, weaken encryption, allow privilege escalation, or violate least-privilege.
Look for settings that limit throughput, cause unnecessary latency, misuse resources, or have known bottleneck defaults.
Check against CIS Benchmark guidance (where applicable), vendor hardening docs, and widely accepted defaults.
Structure every audit as follows:
Config: <filename or type>
Findings: X critical · Y warnings · Z info · N passed
| Severity | Setting / Line | Issue | Fix |
|---|---|---|---|
| 🔴 Critical | PermitRootLogin yes | Root login allowed over SSH | Set to no or prohibit-password |
| 🟠 Warning | ssl_protocols TLSv1 TLSv1.1 TLSv1.2 | TLS 1.0 and 1.1 are deprecated and vulnerable | Remove TLS 1.0 and 1.1 |
| 🟡 Info | worker_processes 1 | Single worker — consider matching CPU count | Set worker_processes auto; |
| ✅ OK | PasswordAuthentication no | Password auth disabled — good | — |
Severity scale:
What to include in the table:
After the table, output a corrected config snippet containing only the changed lines with brief inline comments:
# Fixed settings — replace in your config
ssl_protocols TLSv1.2 TLSv1.3; # Remove deprecated TLS 1.0/1.1
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
worker_processes auto;
Always close with:
Apply fixes: Review each change before applying — test in staging first Full script: Use
/linux-shell-scriptorto automate applying these changes OS hardening: Use/linux-security-hardenerfor a full system-level review Monitor: Use/linux-monitoring-setupto detect anomalies after reconfiguring
Write findings to ./audit/ in the current working directory:
audit/
report-<type>-<YYYY-MM-DD>.md ← full findings report
fixed-<filename> ← corrected config (changed lines only)
Print the findings table and corrected snippet directly in chat — they are concise and immediately useful. The full written report is for archiving and diffing over time.
Check all of the following when auditing any nginx config:
| Check | Secure Value |
|---|---|
| TLS protocols | TLSv1.2 TLSv1.3 only |
| TLS ciphers | ECDHE + AES-GCM / CHACHA20 only; no RC4, DES, MD5, EXPORT |
| HSTS header | Strict-Transport-Security with max-age ≥ 15768000 and includeSubDomains; add preload to register on the HSTS preload list |
server_tokens | off |
X-Frame-Options | SAMEORIGIN or DENY |
X-Content-Type-Options | nosniff |
Content-Security-Policy | Present (warn if missing) |
client_max_body_size | Set explicitly (not unlimited) |
autoindex | off |
worker_processes | auto or matches CPU count |
keepalive_timeout | 65 or lower |
| Rate limiting | limit_req_zone defined for public endpoints |
| Default server | Catch-all returning 444 for unknown hostnames |
| Check | Secure Value |
|---|---|
PermitRootLogin | no or prohibit-password |
PasswordAuthentication | no |
PermitEmptyPasswords | no |
PubkeyAuthentication | yes |
X11Forwarding | no |
AllowTcpForwarding | no (unless needed) |
ClientAliveInterval | 300 or less |
ClientAliveCountMax | 2 or less |
MaxAuthTries | 4 or less |
LoginGraceTime | 30 or less |
Ciphers | Only modern ciphers (no arcfour, blowfish, 3des) |
MACs | Only SHA-2 MACs (no md5, sha1) |
AllowUsers / AllowGroups | Defined to restrict access |
Port | Non-default (advisory only) |
| Check | Recommendation |
|---|---|
NoNewPrivileges=yes | Always set for non-root services |
PrivateTmp=yes | Isolate /tmp access |
ProtectSystem=strict | Prevent writes to system dirs |
ProtectHome=yes | Block home directory access |
ReadOnlyPaths= | Restrict filesystem to minimum needed |
CapabilityBoundingSet= | Drop all capabilities not needed |
Restart= | Set to on-failure for critical services |
RestartSec= | Use with Restart= to avoid rapid respawn |
User= / Group= | Never run as root unless absolutely required |
LimitNOFILE= | Set for services that open many connections |
TimeoutStopSec= | Set to avoid zombie services on shutdown |
| Check | Expected |
|---|---|
| Default INPUT policy | DROP or REJECT |
| Default FORWARD policy | DROP (unless routing) |
| Default OUTPUT policy | ACCEPT (or DROP with explicit rules) |
| Loopback accepted | ACCEPT for lo interface |
| Established/related | ACCEPT for ESTABLISHED,RELATED |
| ICMP | Limited — accept echo-request, drop rest |
| Anti-spoofing | Drop packets from localhost arriving on external interface |
| Open ports | Flag any port open that isn't clearly needed |
| Logging | At least one LOG rule before the final DROP |
Flag these patterns in any config type as 🔴 Critical:
chmod 644 on /etc/ssl/private/)NOPASSWD: ALL in sudoers*) in AllowUsers or command grantsSudoers-specific critical patterns:
Cmnd_Alias containing /usr/bin/bash, /bin/sh, /bin/bash, sudoedit, su → shell escape for full root%group ALL=(ALL) NOPASSWD: ALL on a broad group (e.g. %wheel, %sudo, %docker) → unrestricted group sudoALL=(ALL:ALL) NOPASSWD: /path/to/script * with wildcard arguments → argument injectionvisudo not being used to edit sudoers (syntax errors in sudoers can lock out all sudo access)npx claudepluginhub chfle/lehnert-claude-skills --plugin linux-vuln-scannerHardens Linux endpoints against CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS. Automates filesystem, service, and network security configurations for compliance and reduced attack surface.
Hardens Linux endpoints (Ubuntu, RHEL, CentOS, Debian) using CIS Benchmark recommendations. Automates filesystem, service, and network security configurations to reduce attack surface and meet compliance requirements.
Hardens Linux endpoints (Ubuntu, RHEL, CentOS) using CIS Benchmark via bash scripts for filesystem, services, network config, and boot settings. For server deployment, audit remediation, compliance.