ake13-art/secfescLightweight security state inspector for Linux — bridging the gap between pretty fetch tools and heavy-duty audit frameworks.
____
________ _____/ __/__ __________
/ ___/ _ \/ ___/ /_/ _ \/ ___/ ___/
(__ ) __/ /__/ __/ __(__ ) /__
/____/\___/\___/_/ \___/____/\___/
This project uses AI as a development tool. All code is human‑reviewed, tested and maintained by the author.
pip install secfesc
secfetch # Quick security overview
secscan # Basic audit (no root)
sudo secscan --full # Complete audit (requires root)
| Tool | Purpose | Run as |
|---|---|---|
| secfetch | Quick security overview | User |
| secscan | Deep audit (Lynis-like) | User or root |
secfetch provides instant security status at a glance.
secscan delivers a Lynis-style audit — SSH, users and groups today, growing toward full coverage.
| Category | Checks |
|---|---|
| System | Kernel, Secure Boot |
| Kernel Security | ASLR, Lockdown, LSM |
| Kernel Hardening |
| Version | Categories | Target |
|---|---|---|
| v1.8 | Boot, Services, Logging | ~120 |
| v2.0 | Filesystem, Permissions | ~160 |
| v2.4 | Compliance (CIS/NIST) | ~300+ |
secscan aims to become a Lynis-style auditor. The roadmap numbers are targets, not shipped counts.
____
________ _____/ __/__ __________
/ ___/ _ \/ ___/ /_/ _ \/ ___/ ___/
(__ ) __/ /__/ __/ __(__ ) /__
/____/\___/\___/_/ \___/____/\___/
System
────────────────────────────────────────
✔ Kernel 6.14.6-zen1-1-zen
✔ Secure Boot Enabled
Kernel Security
────────────────────────────────────────
✔ ASLR Full
✔ Lockdown integrity
✔ LSM landlock,lockdown,yama,integrity,apparmor,bpf
Network
────────────────────────────────────────
✔ Firewall Rules firewalld active
✔ Open Ports 22 (SSH/TCP), 53 (DNS/UDP)
Security Score
────────────────────────────────────────
System [████████████] 92/100
Kernel Security [████████████] 95/100
Network [██████████░░] 80/100
────────────────────────────────────────
Total [████████████] 88/100
GNU General Public License v3.0 - See LICENSE
| Command | Description |
|---|
secfetch | Full security overview |
secfetch --short | Compact one-box summary |
secfetch fastscan | Fast scan (enabled checks only, see ~/.config/secfesc/checks.conf) |
secfetch live | Live monitoring, auto-refresh every 5 s |
secfetch live --interval N | Live monitoring, refresh every N seconds |
secfetch improve | Show failing checks with fix suggestions |
secfetch improve --auto | Interactive auto-fix selection and apply |
secfetch help | List all checks |
secfetch help <name> | Detailed info about a check |
| Command | Description |
|---|
secscan | Basic audit (no root) |
secscan --full | Complete audit |
secscan --quick | Essential checks only |
secscan --category ssh | Specific category |
secscan --report json | Export results to stdout |
secscan --report html --output audit.html | Export report to file |
secscan --verbose | Enable verbose/debug output |
secscan --quiet | Suppress human summary |
| kptr_restrict, dmesg_restrict, ptrace_scope |
| Network | Firewall, Ports, Services, SYN Cookies |
| Filesystem | SUID, World Writable, /tmp |
| Category | Checks |
|---|
| SSH | Root login, empty passwords, password auth, legacy protocol, X11 forwarding, MaxAuthTries |
| Users | UID 0 accounts, empty passwords (root), duplicate UID/name |
| Groups | Duplicate GID/name, root group members |
| Authentication | Password ageing policy, weak hash method, default umask (/etc/login.defs) |
| Firewall | Active firewall detection (firewalld/ufw/nftables/iptables) |
| Cron | World-writable cron paths/files, unrestricted cron policy |
| Permissions | Mode & ownership of /etc/passwd, /etc/group, /etc/shadow, /etc/gshadow |
| Document | Description |
|---|
| Installation | How to install |
| Configuration | Configure checks |
| Usage | CLI reference |
| Architecture | Project structure |
| ROADMAP.md | Development plans |