Linux & Windows Hardening

#!/usr/bin/env bash
# audit_linux.sh - Automated Linux Hardening Auditor

set -euo pipefail

REPORT_LOG="./linux_hardening_report.log"

echo "=== Linux Hardening Audit Report ===" > "${REPORT_LOG}"
echo "Execution Time: $(date)" >> "${REPORT_LOG}"
echo "------------------------------------" >> "${REPORT_LOG}"

# 1. Check for Shadow File Permissions
SHADOW_PERMS=$(stat -c "%a" /etc/shadow)
if [ "${SHADOW_PERMS}" -eq 600 ] || [ "${SHADOW_PERMS}" -eq 000 ]; then
  echo "[OK] Shadow file permissions are secure: ${SHADOW_PERMS}" >> "${REPORT_LOG}"
else
  echo "[FAIL] Shadow file permissions are weak: ${SHADOW_PERMS} (Expected 600)" >> "${REPORT_LOG}"
fi

# 2. Verify SSH Root Login Status
if grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
  echo "[OK] SSH Remote Root Login is disabled." >> "${REPORT_LOG}"
else
  echo "[FAIL] SSH configuration allows Remote Root Login." >> "${REPORT_LOG}"
fi

# 3. Check for Insecure Listening Daemons
if ss -tulpn 2>/dev/null | grep -E -q ":(21|23) "; then
  echo "[FAIL] Insecure active daemons detected (FTP port 21 / Telnet port 23)" >> "${REPORT_LOG}"
else
  echo "[OK] No insecure legacy listener daemons active on FTP/Telnet ports." >> "${REPORT_LOG}"
fi

echo "[*] Hardening Audit complete. Output written to ${REPORT_LOG}."
cat "${REPORT_LOG}"

# AuditHardening.ps1 - Automated Windows Hardening Compliance Inspector
set-strictmode -version 2.0

$ReportPath = ".\WindowsHardeningReport.txt"
$Report = @()
$Report += "=== Windows System Hardening Report ==="
$Report += "Execution Time: $(Get-Date)"
$Report += "---------------------------------------"

# 1. Audit Password Complexity Registry Settings
$ComplexityPath = "HKLM:\SAM\SAM\Domains\Account"
if (Test-Path $ComplexityPath) {
  # SAM folder is protected; read standard SecEdit metrics instead
  $Report += "[INFO] Checking local account database baselines..."
}

# 2. Check for Insecure Listening Services (e.g. Remote Registry, Telnet if any)
$UnsecureServices = @("RemoteRegistry", "TlntSvr", "SessionEnv")
foreach ($service in $UnsecureServices) {
  $srv = Get-Service -Name $service -ErrorAction SilentlyContinue
  if ($srv) {
    if ($srv.Status -eq "Running") {
      $Report += "[FAIL] Insecure service running: $($srv.DisplayName)"
    } else {
      $Report += "[OK] Insecure service $($service) is disabled or stopped."
    }
  } else {
    $Report += "[OK] Service $($service) is not present on system."
  }
}

# 3. Verify Local Firewall Profile Status
$FirewallProfiles = Get-NetFirewallProfile -Profile Domain,Private,Public
foreach ($profile in $FirewallProfiles) {
  if ($profile.Enabled -eq $True) {
    $Report += "[OK] Firewall Profile $($profile.Name) is Enabled."
  } else {
    $Report += "[FAIL] Firewall Profile $($profile.Name) is Disabled!"
  }
}

# Output Report
$Report | Out-File -FilePath $ReportPath -Encoding utf8
$Report
Write-Host "Hardening report compiled: $ReportPath" -ForegroundColor Green