cirven systems / modules / audit

cirven audit

Reads your system, changes nothing, and tells you how an attacker would get in. Findings are ranked by the attack paths they open, not by checklist order: a password-accepting sshd is info when it is off, high when it listens on every interface.

usage

$ cirven audit
cirven audit · laptop

[high] tcp port 8000 open on all interfaces
       at   0.0.0.0:8000 · python3 -m http.server 8000
       path a dev file server: anyone on the same network can browse and download the directory
       fix  bind it to 127.0.0.1, or stop it if unused
[med ] ssh key has no passphrase
       at   ~/.ssh/id_ed25519
       fix  ssh-keygen -p -f ~/.ssh/id_ed25519, then load it into ssh-agent
[med ] secure boot disabled
[low ] kernel.kptr_restrict = 0
[ok  ] root filesystem encrypted (LUKS2)
[ok  ] screen locks after 150s idle (omarchy shell)

4 findings (1 high, 2 med, 1 low) · 12 passed · 1 skipped

--json for machines, -q for findings only. Exit code: 0 nothing above low, 1 medium, 2 high, 3 critical.

checks

• network: every listening tcp socket with its process, boot firewall (ufw, nftables, firewalld)
• ssh: effective sshd config as sshd reads it (includes, first value wins), key passphrases, key modes, agent forwarding
• secrets: tokens in shell histories, plaintext credential stores, .env files in your projects. always masked
• disk: root, /home and swap encryption, LUKS1 vs LUKS2, through LVM layers
• boot: secure boot and setup mode, kernel parameters that disable mitigations, pending reboot
• kernel: eleven hardening sysctls safe on any desktop
• accounts: extra uid 0 accounts, shadow permissions, passwordless sudo
• desktop: home permissions, idle screen lock (omarchy shell, hypridle)
• packages: how long since pacman last synced

guarantees

Read only, proven by a test that snapshots a fixture system before and after a run. Secrets are shown as ghp_****, never in full. Decoys planted by lure are skipped so an audit cannot trip them.

threat model

Stops: misconfigurations an attacker would use, found before they are. Does not stop: an attacker already on the machine; they can lie to any tool running beside them. For that, see watch. Without root, sudo rules and firewall rules stay unread and are reported as skipped.