Transparency First

Exactly What Runs on Your Server.
Nothing More.

We understand you don't run unreviewed scripts on production infrastructure. This page documents every tool, every file touched, every byte uploaded — so your security team can sign off before you run a single command.

From Zero to Report
in Four Steps

The entire process takes under 10 minutes of your time. The scan runs in the background; your report arrives by email.

1
One-time setup · ~2 min

Request Access — Receive Your API Key & Script

After submitting your request, we send you a personal API key and a download link to the scan script. The script is a single self-contained Bash file — open it, read it, audit it. We encourage this. You should never run code you haven't reviewed on a production server.

The script is typically under 300 lines, well-commented, and does exactly one thing: run the six security tools that are already on your server and package the output.

2
Install · ~3 min

Install the Required Scanning Tools

The script requires six open-source tools. If they aren't already on your server, the installer script handles this for you — or you can install manually. All tools are standard, well-audited, open-source packages available via your distro's package manager.

Ubuntu / Debian
# Install required tools (one-time)
sudo apt update
sudo apt install -y lynis unhide chkrootkit debsums
# trivy: official install script (official repo)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
# rkhunter: distro package
sudo apt install -y rkhunter

All six tools are open-source and widely used. Trivy is maintained by Aqua Security. Lynis is maintained by CISOfy. The rest are standard distro packages.

3
Scan · runs in background

Run the Scan Script — It Collects Logs, Nothing Else

You run the script once manually, or add it to cron for recurring scans. It executes the six tools, captures their output into plain-text log files, and compresses them into a single archive. That archive is uploaded to our API using your key.

Run the scan (manual or via cron)
# Download and inspect the script first
wget https://api.linuxaudit.ai/scripts/scan.sh
cat scan.sh                 # read it before running

# Run it — takes 3–8 min depending on server size
sudo bash scan.sh --api-key YOUR_KEY --host production-01

# For daily automated scans via cron:
# 0 3 * * * /usr/local/bin/linuxaudit-scan --api-key YOUR_KEY --host production-01

The script never modifies your system. It is read-only by design — no files written, no packages installed, no services restarted. It only reads and uploads.

4
Done · delivered in <24 hours

Receive Your Report — Prioritised, Actionable, Archived

Our AI engine processes the uploaded logs, cross-correlates findings across all six tools, filters false positives, and generates your structured security report. It is delivered to your email and stored in your dashboard. No analyst bottleneck. No waiting for a human to pick up the ticket.

Every report is fully self-contained — all findings documented in full, with no dependency on prior scans. Nothing falls through the cracks. On Continuous DevSecOps and fleet plans, you additionally receive a fleet summary report consolidating vulnerability rankings across all your servers into a single view for management review. Critical findings trigger an immediate Slack or Teams alert (Daily Guard and above).

Six Tools. One Report.
No Single Tool Sees the Whole Picture.

Each tool has a different detection surface. Running them separately takes hours and leaves you with six conflicting reports to reconcile by hand. We run them together and do the reconciliation for you.

🔬
Trivy
CVE Scanner — by Aqua Security
Scans OS packages, container images, and application dependencies (composer, npm, pip, etc.) against the NVD, OSV, and GitHub Advisory databases. Identifies CVEs by name, version, and fix target.
📊
Lynis
System Hardening Auditor — by CISOfy
Performs 200+ checks against your system configuration: SSH settings, firewall rules, file permissions, boot parameters, authentication controls, logging. Produces a hardening score (0–100).
👁️
unhide
Hidden Process & Port Detector
Compares process tables from multiple system calls to detect hidden processes. Separately scans TCP and UDP ports to surface listeners that don't appear in standard netstat output — a primary rootkit indicator.
🕵️
chkrootkit
Rootkit Signatures — classic scanner
Checks for known rootkit signatures in binaries and system files. Detects LKM trojans, bindshells, and suspicious kernel module loads. Covers 70+ known rootkits including classic Linux/x86 variants.
🔍
rkhunter
Rootkit Hunter — file integrity + sigs
Cross-checks system binaries against known-good SHA-256 hashes, detects suspicious file properties, scans for known rootkit strings, and checks common backdoor ports. Complements chkrootkit with different detection strategies.
debsums
Package Integrity — tamper detection
Verifies MD5 checksums of every installed Debian/Ubuntu package file against the package manager's own database. A tampered system binary — even one byte changed — shows up immediately. Critical for post-compromise triage.

Exactly What We Collect.
And What We Never Touch.

The scan script produces plain-text log files. These are the output of the security tools — not raw system data, not credentials, not application data. Here is the exact breakdown.

Data TypeCollectedDetails
Trivy scan output ✓ YES Package names, installed versions, CVE IDs. No file contents. No application data.
Lynis audit log ✓ YES System configuration flags (SSH settings, firewall state, etc.). No passwords, no keys.
unhide / chkrootkit / rkhunter output ✓ YES Tool output text only — process names, file paths, hashes. No file contents read or transmitted.
debsums output ✓ YES Package filenames and checksum match results. No file contents.
SSH config snapshot ✓ YES Key settings (PasswordAuthentication, AllowUsers, Port, etc.). No private keys.
SSH private keys ✗ NEVER The script has no logic to read, locate, or transmit private keys at any path.
Environment variables / .env files ✗ NEVER The script does not read or access any .env files or application secrets.
Application data / databases ✗ NEVER No database access, no file reads from application directories beyond package-lock.json paths scanned by Trivy.
Auth log content (raw) ✗ NEVER We run structured audit commands (last, lastb, auditd queries) and capture their output — not raw /var/log/auth.log. No usernames or IPs are transmitted, only statistical summaries.
Network traffic / packet captures ✗ NEVER No tcpdump, no iptables logging, no traffic inspection of any kind.
Data stored outside EU ✗ NEVER All processing runs exclusively on EU infrastructure. Data never leaves the EU — supports your GDPR data residency obligations.
Used to train AI models ✗ NEVER Your security logs are never used to train any model. We exclusively use AI providers whose API terms explicitly prohibit training on customer data. A full list of approved providers is available on request.

All uploaded log archives are encrypted in transit (TLS 1.2+). All data is processed and stored exclusively on EU infrastructure — it never leaves the EU. By default, log archives are not retained after your report is generated — each report is fully self-contained. Log archives are never shared with third parties. Your security data is never used to train any AI model. We only process data through AI providers whose API terms explicitly prohibit training on customer data (currently Anthropic and OpenAI API). A full list is available on request.

What's Inside
Every Report

Every report follows the same structured format — so your team knows exactly where to look, every time.

📊

Hardening Score

Lynis index (0–100) with a plain-English verdict and trend graph on recurring scans.

📦

Updates & Upgrades

Every pending package shown with exact versions, security vs. regular classification, and upgrade command including operational impact warnings.

⚠️

Executive Summary

Critical / High / Medium / Low counts, top 3 risks with one-line summaries, and a reboot-required flag.

🔴

Findings — Prioritised

Each finding: CVE name, component, verdict (Likely / Unlikely / N/A), evidence quote from raw logs, and copy-paste fix command.

🧠

AI Severity Adjustments

Every downgraded finding includes written reasoning — why a CRITICAL scanner verdict was reduced to Medium, with the evidence cited.

🛡️

Integrity Verification

Results from all rootkit and hidden-process scans, with false-positive explanations where they apply.

🔑

Auth & SSH Audit

SSH configuration analysis, fail2ban status, login anomalies — with specific hardening recommendations.

📋

Host Context

OS, kernel, uptime, scan timestamp, tool versions — everything needed to reproduce or reference the scan.

Questions Your
Security Team Will Ask

Does the script require root / sudo?
Yes — most security scanning tools (rkhunter, chkrootkit, unhide, debsums) require root access to read system files and compare process tables. The script should be run with sudo. We recommend reviewing the script source before running it as root, which is why the script is fully open and readable before execution.
Does the script modify anything on the server?
No. The script is strictly read-only. It runs tools, captures their text output, compresses the logs, and uploads the archive. No files are written to the system, no services are restarted, no packages are installed or removed, no configuration is changed. You can verify this by reading the script source before running it.
What's the performance impact of running the scan?
Minimal. Lynis and the rootkit scanners are lightweight sequential reads. Trivy is the most resource-intensive — it reads package manifests and queries a local cache of the CVE database. On a typical VPS (2 vCPU, 4 GB RAM), the full scan completes in 3–8 minutes and consumes less than 15% CPU during that window. We recommend scheduling cron runs at off-peak hours (e.g. 3:00 AM) to eliminate any user-facing impact.
How is the upload secured?
The log archive is uploaded via HTTPS (TLS 1.2+) to our API endpoint using your personal API key as a bearer token. Your API key is scoped to upload-only and cannot be used to read or delete reports — that requires your account credentials through the dashboard.
Can I run this on servers without internet access?
The scan itself works on air-gapped servers — all six tools run locally. For upload, you'll need outbound HTTPS access to api.linuxaudit.ai (port 443 only). If your server is behind a strict egress firewall, you can whitelist that single domain. Alternatively, manual log upload via the dashboard is available on all plans.
What Linux distributions are supported?
Fully tested: Ubuntu 20.04, 22.04, 24.04 LTS; Debian 11, 12; CentOS Stream 8/9; Rocky Linux 8/9; Fedora 38+.

Partial support: Alpine Linux (no debsums), Arch Linux (rkhunter via AUR). Container-only environments (no bare-metal OS packages) are not yet supported.
Is the scan script open source?
The scan script is provided as a readable, inspectable Bash file with every download. It is not licensed as open-source (you may not redistribute or resell it), but there is no obfuscation, no binary blobs, and no minification — what you read is exactly what runs. We intentionally ship it this way so your team can verify it before running it on production.

Seen Enough?
Let's Get Your First Report Running.

Two minutes to set up. First report delivered in under 24 hours. Cancel anytime.

Start Your Audit →