LSMS

Linux Security and Monitoring Scripts These are a collection of security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Each script works on its own and is independent of other scripts. The scripts can be set up to either...

mimipenguin

MimiPenguin 2.0 A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. This was assigned CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Fun fact it's still not fixed after GNOME Keyring 3.27.2 and still works ...

kerneleye

KernelEye Kernel-level traffic intelligence and threat remediation for Linux servers. KernelEye is a self-hosted security monitoring platform for Linux servers. It uses eBPF, TC, and XDP in a Go agent to observe network metadata, score suspicious activity, and apply remediation through kernel-lev...

CopyFail-Penguin

CopyFail Penguin A safe Linux security checker for CopyFail/CVE-2026-31431. Purpose CopyFail Penguin checks basic Linux system information and possible exposure indicators related to the CopyFail vulnerability. This project is intended for learning, awareness, and defensive system administration...

owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

SysTrace

SysTrace 2.0 ptrace-based Linux syscall monitor and sandbox for analyzing ELF binaries. SysTrace runs a target inside an isolated Linux namespace environment, traces its system calls and child processes, applies rule-based detection and weighted risk scoring, then uses a Random Forest classifier ...

RCLocals

RCLocals Inspired by 'Autoruns' from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more Things covered: ·List GPG keys trusted by the system ·Installed Packages ·File...

selinux-notebook

The SELinux Notebook Introduction The SELinux Notebook is an Open Source book on SELinux, originally created by Richard Haines and donated to the SELinux community. The Notebook's goal is to be the most current and comprehensive book on SELinux, covering the Linux Kernel components, the userspace...

Linux_hardening_and_security

Linuxhardeningandsecurity...

secfesc

/ / / / / / // / / / / // / / ///// /// This project uses AI as a development tool. All code is human‑reviewed, tested and maintained by the author. Quick Start pip install secfesc secfetch Quick security overview secscan Basic audit no root sudo secscan --full Complete audit requires root...

CrowArmor

CrowArmor : Linux Driver What is CrowArmor ? CrowArmor is a driver for Linux aimed at system security, we use LSM interfaces to improve kernel security, providing support for MalDec-EDR, code documentation and how to proceed with installation Documentation Development Process The standard practic...

linux-security-audit

Linux Security Audit Tool Linux Security Audit Tool based on the CIS - Red Hat Enterprise Linux 8 Benchmark v3.0.0 If you find this helpful, please the "star" 🌟 to support further improvements. Table of Contents 1. Features 2. Preview 3. Result-Log 4. Supported OS 5. Prerequisites 6. Notes...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

hawkopsec

HawkOpsec One-tap Linux OPSEC hardening & anonymity toolkit Pick a profile and HawkOpsec starts Tor, encrypts DNS, spoofs your identity, hardens the kernel and checks for DNS / IP leaks — Reset system rolls everything back. Architecture Install With pipx Debian / Ubuntu / Kali / Mint sudo apt...

Astra Linux – Vulnerability in grub2

Integer underflow in grubnetrecvip4packets; A malicious IP packet can cause an integer underflow in the grubnetrecvip4packets function, affecting the rsm-totallen value. Under certain circumstances, the totallen value may wrap around to a small integer number, which will be used in memory...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: atl1c: Workaround for the DMA RX overflow issue. This work is based on the alx driver commit 881d0327db37 “net: alx: Workaround for the DMA RX overflow issue”. The alx and atl1c drivers both had RX overflow errors; therefore, ...

iptables-essentials

Iptables Essentials: Reglas y comandos comunes de firewall ☑️ POR HACER Añadir ejemplos útiles de configuración de Iptables Añadir configuración útil de Kernel Settings sysctl Añadir enlaces a recursos externos útiles Añadir ejemplos de configuración avanzada, comandos, reglas Tabla de Contenidos...

linux-soft-exploit-suggester

linux-soft-exploit-suggester Script para encontrar exploits para todo el software vulnerable en el sistema, centrándose en los paquetes de software en lugar de solo vulnerabilidades del kernel. Utiliza la base de datos de exploits para evaluar la seguridad de los paquetes y buscar exploits que...

syswarden

SysWarden Difesa Linux. Il tuo host. Le tue regole. Difesa Linux locale all'host con applicazione verificabile e fail-closed. Sito web | Documentazione | Compil...

Astra Linux – Vulnerability in Containerd

Containerd is a container runtime. A bug was discovered in containerd versions prior to 1.4.8 and 1.5.4, where pulling and extracting a specially crafted container image could result in changes to Unix file permissions for existing files in the host’s filesystem. Changes to file permissions could...