Free tools

Free Linux server security tools

Small, specific checks for people who run Linux servers. No signup for any of the browser tools, and each one says before you start where your input goes. Five of the six run entirely in your browser and send nothing anywhere.

Server readiness checkRun one read-only command on your Linux server and get a GREEN, AMBER or RED verdict with the findings behind it.Input: One command, emailed to you, run on the server.Sends about thirty facts about the setup to SecAI; never file contents, passwords or keys.SSH config checkerPaste sshd -T output or sshd_config and see which settings are weak, why, and the fix for each.Input: sshd -T output or sshd_config.Runs in your browser. Nothing is uploaded.auth.log analyzerOpen auth.log, /var/log/secure or journalctl output and see failed and successful SSH logins, sudo use and account changes, with what deserves a second look first.Input: Authentication log lines, up to 20 MB.Runs in your browser. Nothing is uploaded.fail2ban config checkerPaste fail2ban-client -d output or jail.local and see which jails run, how long bans last, and the mistakes that stop fail2ban banning.Input: fail2ban-client -d output, jail.local or jail.d files.Runs in your browser. Nothing is uploaded.sudoers checkerPaste sudoers rules and see who can run what as root, which rules hand out a shell, and which settings load user code into root commands.Input: /etc/sudoers and /etc/sudoers.d files.Runs in your browser. Nothing is uploaded.Server security checklistTwenty-one plain-English questions for business owners: is your Linux server security actually in place?Input: Your answers.Answers are kept in your browser only. Nothing is uploaded.

How these tools treat what you give them

The four paste-in checkers (SSH config, auth.log, fail2ban and sudoers) are JavaScript that runs in the page. What you paste or open is never sent: there is no request containing it, it is not stored, and analytics records only that a tool was used, by name. You can load the page, disconnect from the internet and use them offline.

The checklist keeps your answers in your own browser so you can come back to them. The readiness check is the one tool with a server side: it emails you a read-only command, and the command sends about thirty facts about the server’s setup (each a yes/no, a count or a name, never file contents, passwords or keys) to produce a GREEN, AMBER or RED verdict. How that verdict is scored is published in the security score methodology.

Every tool states what it cannot tell you. None of them can prove a server is clean, and none replaces looking at the server itself.

Where to go next