Free tool · Open source · Linux · Windows · macOS
Free server security audit, in one command.
Paste one line into a terminal. Sumrite’s audit script checks SSH, users, patching, firewall, kernel, file permissions, logging and services, then gives your server a score out of 100 and a report that says exactly what to fix.
A server security audit script checks an operating system’s configuration against hardening best practice (the kind of settings in the CIS Benchmarks): SSH and remote access, accounts and passwords, missing patches, firewall, kernel and network settings, file permissions, logging and running services. Sumrite’s free script does this in one command on Linux, macOS or Windows Server, makes no changes and no network connections, and writes a scored HTML, JSON and text report.
Run it now: one command
Copy the line for your server, paste it into a terminal and press Enter. The audit takes one to three minutes and saves an HTML, JSON and text report in the current folder (Windows: the Desktop).
Linux and macOS bash
curl -fsSL https://sumrite.com/audit.sh | sudo bashNo curl? Use wget -qO- https://sumrite.com/audit.sh | sudo bash
Windows Server (PowerShell as administrator) powershell
[Net.ServicePointManager]::SecurityProtocol='Tls12'; irm https://sumrite.com/audit.ps1 | iexWorks on Windows Server 2012 R2 to 2025 and Windows 10/11 with PowerShell 5.1 or later.
Prefer to read it first? (recommended for production) bash
curl -fsSLO https://sumrite.com/audit.sh
less audit.sh
sha256sum audit.sh # compare with https://sumrite.com/audit.sha256
sudo bash audit.shWhat the audit checks
| Area | Linux and macOS | Windows Server |
|---|---|---|
| Patching | Pending and security updates, reboot required, automatic updates, end-of-life OS | Days since the last update, pending reboot, Windows Update service, end-of-life version |
| Remote access | SSH root login, password logins, weak ciphers, MACs and key exchange, idle timeout, host key permissions | RDP and Network Level Authentication, RDP security layer, WinRM unencrypted traffic |
| Accounts | Extra UID 0 accounts, empty passwords, weak hashes, password ageing, pwquality, faillock, NOPASSWD sudo | Guest and built-in Administrator, password length and lockout, local admins, LAPS, UAC |
| Credentials | Private keys and ~/.ssh permissions, SUID/SGID shells (GTFOBins), root-equivalent capabilities | WDigest, LSA protection, Credential Guard, NTLMv1 and LM hashes, anonymous enumeration |
| Network | Host firewall, databases and admin services on public interfaces, IP forwarding, redirects, SYN cookies, rp_filter | Windows Firewall profiles, SMBv1, SMB signing, LLMNR, NetBIOS, TLS 1.0/1.1, exposed ports |
| Kernel and platform | ASLR, ptrace, kptr and dmesg restrictions, unprivileged eBPF, SELinux or AppArmor | Secure Boot, BitLocker, Defender real-time protection, signature age, tamper protection |
| Files | Permissions on passwd, shadow, sudoers and cron, world-writable files and directories, /tmp mount options | Unquoted service paths |
| Logging | auditd, persistent logs, log forwarding, fail2ban, NTP, failed SSH logins with top source IPs | Advanced audit policy, Security log size, failed logons (4625), script block logging, PowerShell 2.0 |
| Services | Telnet, FTP, rsh, NIS, CUPS, Avahi; nginx, Apache and PHP version disclosure; Redis auth; Docker socket and privileged containers | Print Spooler on domain controllers, Remote Registry, SNMP, Telnet, FTP; IIS Server and X-Powered-By headers |
| macOS | SIP, Gatekeeper, FileVault, application firewall and stealth mode, automatic security updates, auto-login, guest, root user, Screen Sharing | - |
How the score works
Every check has a severity: critical (10 points), high (6), medium (3) or low (1). A failed check loses all its points, a warning loses half, and informational or skipped checks do not count. The score is the share of points kept, from 0 to 100, with a grade from A to F. One open critical finding caps the grade at D, because a single critical issue is usually enough for an attacker.
How to use the report
- Run it as root or administrator. Without root, checks that read /etc/shadow, sudoers, firewall rules or the Security event log are marked SKIP.
- Open the HTML report. Start with the “Fix these first” list of critical and high findings. Each finding shows the evidence and the exact command or setting that fixes it.
- Fix, then run it again. Re-run after each change window and keep the reports as evidence for ISO 27001, SOC 2 or PCI DSS audits.
- Schedule it. Run it weekly from cron or Task Scheduler.
--fail-under 80(Linux, macOS) or-FailUnder 80(Windows) exits with code 2 below that score, so it can fail a CI job or raise an alert.
Safe to run on production
- Read-only. It reads configuration files, settings and logs. It never changes a setting, installs a package or restarts a service.
- No network connections. Nothing is uploaded, and there is no telemetry. Pending updates are read from the local package cache.
- No exploits. Unlike offensive enumeration tools, it sends no payloads and runs no exploit code.
- One file, plain text. Read every line before you run it, and check its SHA-256 against audit.sha256.
- Open source, MIT licence. Fork it, add checks, run it in your own pipelines.
Sumrite audit vs Lynis, linPEAS and CIS-CAT
| Tool | What it is for | Platforms | Output |
|---|---|---|---|
| Sumrite Server Audit | Defensive hardening check with a fix for every finding | Linux, macOS, Windows Server | Score, HTML, JSON, text |
| Lynis | In-depth defensive audit with hundreds of tests | Linux, macOS, Unix | Hardening index, text report |
| linPEAS / winPEAS | Offensive: finds privilege escalation paths for pentesters | Linux / Windows | Colour-coded terminal output |
| CIS-CAT | Formal scoring against CIS Benchmarks | Many | HTML and XML reports (full version needs CIS SecureSuite) |
| OpenSCAP | Compliance scanning with SCAP profiles (STIG, CIS, PCI) | Mainly RHEL family | XCCDF, HTML |
Frequently asked questions
Is the Sumrite server audit script really free?
Yes. It is free and open source under the MIT licence. There is no sign-up, no licence key and no paid tier.
Is it safe to run curl | sudo bash?
Piping any script into a root shell means trusting its source. The script is read-only and makes no network connections, but on production servers download it first, read it, check its SHA-256 against /audit.sha256 and then run it.
Which operating systems are supported?
Ubuntu, Debian, RHEL, Rocky, AlmaLinux, CentOS Stream, Fedora, Amazon Linux, SUSE, Alpine and other Linux distributions; macOS 12 and later; Windows Server 2012 R2 to 2025 and Windows 10 and 11.
Does the script send my data anywhere?
No. It makes no network connections. The reports are written to your own disk with permissions that only you can read.
Is this a CIS Benchmark scan?
It checks many of the same settings as the CIS Benchmarks for Linux and Windows Server, but it is not an official CIS-CAT assessment and does not cover every control.
How is this different from linPEAS?
linPEAS is an offensive tool that hunts for privilege escalation paths during a penetration test. This audit is a defensive hardening check: it reports misconfigurations with a severity, a score and the fix, and is meant to be run by the server’s own team.
Can I run it on a schedule?
Yes. Run it weekly from cron or Task Scheduler and use --fail-under (Linux, macOS) or -FailUnder (Windows) to exit with code 2 when the score drops below your threshold.
Does a good score mean my server is secure?
No. It means the operating system is configured well. Vulnerable applications, weak access control and chained attacks need an expert-led penetration test.
More free tools
Score fixed? Now find what a script cannot.
Sumrite’s network and infrastructure VAPT tests your servers the way an attacker would, with a free retest.