We understand you don't run unreviewed scripts on production infrastructure. This page documents every tool, every file touched, every byte uploaded — so your security team can sign off before you run a single command.
The entire process takes under 10 minutes of your time. The scan runs in the background; your report arrives by email.
After submitting your request, we send you a personal API key and a download link to the scan script. The script is a single self-contained Bash file — open it, read it, audit it. We encourage this. You should never run code you haven't reviewed on a production server.
The script is typically under 300 lines, well-commented, and does exactly one thing: run the six security tools that are already on your server and package the output.
The script requires six open-source tools. If they aren't already on your server, the installer script handles this for you — or you can install manually. All tools are standard, well-audited, open-source packages available via your distro's package manager.
# Install required tools (one-time) sudo apt update sudo apt install -y lynis unhide chkrootkit debsums # trivy: official install script (official repo) curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin # rkhunter: distro package sudo apt install -y rkhunter
All six tools are open-source and widely used. Trivy is maintained by Aqua Security. Lynis is maintained by CISOfy. The rest are standard distro packages.
You run the script once manually, or add it to cron for recurring scans. It executes the six tools, captures their output into plain-text log files, and compresses them into a single archive. That archive is uploaded to our API using your key.
# Download and inspect the script first wget https://api.linuxaudit.ai/scripts/scan.sh cat scan.sh # read it before running # Run it — takes 3–8 min depending on server size sudo bash scan.sh --api-key YOUR_KEY --host production-01 # For daily automated scans via cron: # 0 3 * * * /usr/local/bin/linuxaudit-scan --api-key YOUR_KEY --host production-01
The script never modifies your system. It is read-only by design — no files written, no packages installed, no services restarted. It only reads and uploads.
Our AI engine processes the uploaded logs, cross-correlates findings across all six tools, filters false positives, and generates your structured security report. It is delivered to your email and stored in your dashboard. No analyst bottleneck. No waiting for a human to pick up the ticket.
Every report is fully self-contained — all findings documented in full, with no dependency on prior scans. Nothing falls through the cracks. On Continuous DevSecOps and fleet plans, you additionally receive a fleet summary report consolidating vulnerability rankings across all your servers into a single view for management review. Critical findings trigger an immediate Slack or Teams alert (Daily Guard and above).
Each tool has a different detection surface. Running them separately takes hours and leaves you with six conflicting reports to reconcile by hand. We run them together and do the reconciliation for you.
The scan script produces plain-text log files. These are the output of the security tools — not raw system data, not credentials, not application data. Here is the exact breakdown.
All uploaded log archives are encrypted in transit (TLS 1.2+). All data is processed and stored exclusively on EU infrastructure — it never leaves the EU. By default, log archives are not retained after your report is generated — each report is fully self-contained. Log archives are never shared with third parties. Your security data is never used to train any AI model. We only process data through AI providers whose API terms explicitly prohibit training on customer data (currently Anthropic and OpenAI API). A full list is available on request.
Every report follows the same structured format — so your team knows exactly where to look, every time.
Lynis index (0–100) with a plain-English verdict and trend graph on recurring scans.
Every pending package shown with exact versions, security vs. regular classification, and upgrade command including operational impact warnings.
Critical / High / Medium / Low counts, top 3 risks with one-line summaries, and a reboot-required flag.
Each finding: CVE name, component, verdict (Likely / Unlikely / N/A), evidence quote from raw logs, and copy-paste fix command.
Every downgraded finding includes written reasoning — why a CRITICAL scanner verdict was reduced to Medium, with the evidence cited.
Results from all rootkit and hidden-process scans, with false-positive explanations where they apply.
SSH configuration analysis, fail2ban status, login anomalies — with specific hardening recommendations.
OS, kernel, uptime, scan timestamp, tool versions — everything needed to reproduce or reference the scan.
sudo. We recommend reviewing the script source before running it as root, which is why the script is fully open and readable before execution.
api.linuxaudit.ai (port 443 only). If your server is behind a strict egress firewall, you can whitelist that single domain. Alternatively, manual log upload via the dashboard is available on all plans.
Two minutes to set up. First report delivered in under 24 hours. Cancel anytime.
Start Your Audit →