Audit Unix and Linux Systems: Commands and Checklist

Linux runs most web servers, cloud workloads and containers, and Unix still powers many banking and telecom systems. When you audit Unix and Linux systems, you check accounts, file permissions, services, patching and logging against a secure baseline. Most of the evidence comes straight from the command line.

This guide covers the scope, useful tools, practical commands and a checklist you can apply to Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux and most Unix variants.

Scope

A server audit usually covers:

user accounts, groups and sudo rights;
SSH and other remote access;
file and directory permissions, including SUID files;
running services and open ports;
patch level and software sources;
logging, time sync and monitoring;
backups and configuration management.

Useful tools

Lynis: an open-source auditing tool that checks hundreds of settings and suggests fixes.
OpenSCAP: scans systems against profiles such as CIS or DISA STIG.
CIS Benchmarks: detailed hardening guides for each distribution.
Native commands: most checks need nothing more than a shell, as shown below.

Useful commands

Run these with read-only intent, and save the output as evidence.

# Accounts with UID 0 (should only be root)
awk -F: '$3 == 0 {print $1}' /etc/passwd

# Accounts that can log in
grep -vE 'nologin|false' /etc/passwd

# Sudo rights
sudo -l -U username
cat /etc/sudoers /etc/sudoers.d/* 2>/dev/null

# Key SSH settings
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|maxauthtries'

# Listening ports and services
sudo ss -tulpn

# World-writable files and SUID binaries
sudo find / -xdev -type f -perm -0002 2>/dev/null
sudo find / -xdev -type f -perm -4000 2>/dev/null

# Pending security updates (Debian/Ubuntu, then RHEL family)
apt list --upgradable 2>/dev/null
dnf updateinfo list --security

# Time sync and logging
timedatectl
systemctl status rsyslog auditd

Checklist

Accounts and passwords

Only root has UID 0.
Each admin uses a personal account and sudo, not a shared root password.
Service accounts cannot log in interactively.
The team removes or locks accounts of leavers promptly.
Password policy follows your standard, or SSH keys replace passwords.

Remote access

SSH disallows direct root login and password authentication where possible.
Only approved networks can reach SSH, through a firewall or security group.
Admins protect private keys with passphrases, and the team removes old keys from authorized_keys.

Files and permissions

Sensitive files, such as /etc/shadow, have restrictive permissions.
No unexpected world-writable files exist in system directories.
The list of SUID and SGID binaries matches a known-good baseline.
Home directories are not readable by other users.

Services and network

Only required services run, and ss -tulpn shows no unexpected listeners.
A host firewall, such as nftables, firewalld or ufw, limits inbound traffic.
Legacy services like Telnet, rsh and FTP are absent.

Patching

The system runs a supported OS release.
Security updates install within your defined timeline.
Packages come only from trusted, signed repositories.

Logging and monitoring

System and authentication logs go to a central log server or SIEM.
auditd records privileged commands and changes to key files.
Clocks sync with NTP or chrony.
Someone reviews alerts, such as failed logins and new sudo users.

Related guides

Sources

Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.