ServerAuditing.com

Source for serverauditing.com, the home of server_audit_notify.sh: a free Bash script from the Forward Email team that runs a Lynis security audit on a Linux server, adds checks for failed SSH logins, listening ports, disk usage, large files and recent package installs, and emails a plain-text summary over SMTP.

The script

server_audit_notify.sh is a single file. Run it as root:

mkdir -p /var/log/server_audit
curl -fsSL -o /usr/local/bin/server_audit_notify.sh \
  https://raw.githubusercontent.com/forwardemail/serverauditing.com/main/server_audit_notify.sh
chmod 755 /usr/local/bin/server_audit_notify.sh
install -m 600 /dev/null /root/.server-audit-pass
printf '%s\n' 'your-smtp-password' > /root/.server-audit-pass
/usr/local/bin/server_audit_notify.sh \
  --email you@example.com \
  --user alerts@example.com \
  --pass-file /root/.server-audit-pass

• Needs Bash, root, curl and lynis (both installed with apt-get or yum when missing) and an SMTP account. Uses ss or netstat for the listening ports check when present.
• Sends mail with curl over implicit TLS to smtp.forwardemail.net on port 465, with certificate verification. Other ports use required STARTTLS.
• Reads the SMTP password from --pass-file (a file only its owner can read), the SMTP_PASS environment variable, or --pass (visible in the process list).
• Writes reports to /var/log/server_audit and emails after every run, or only when it finds problems with --only-on-issues.
• Exits with 0 on success, 1 on a runtime error or failed email, and 2 on a usage error.

Run server_audit_notify.sh --help for every option.

• Install guide: requirements, options, cron and systemd timer examples, troubleshooting
• What the script checks: each check, its command, output file and the email layout
• FAQ

The header of the script declares the MIT license.

The website

GitHub Pages publishes the main branch from the repository root. There is no build step in CI: every published file is committed.

Path	What it is
scripts/pages/*.md	Page sources: front matter plus Markdown. Edit these.
scripts/style.css	Stylesheet source
scripts/build.js	Generator (Node.js, no dependencies)
scripts/render-images.js	Optional: renders the PNG images with headless Chrome
index.html, <slug>/index.html	Generated pages
index.md, <slug>/index.md, <slug>.md	Generated Markdown copies of each page
css/style.min.css	Generated, minified stylesheet (the only one the pages load)
404.html, sitemap.xml, robots.txt, llms.txt, llms-full.txt, site.webmanifest, .well-known/security.txt, .nojekyll	Generated
images/	Icons, favicon and Open Graph image

Edit a page

1. Change the Markdown in scripts/pages/<page>.md.
2. Run node scripts/build.js (Node.js 18 or newer).
3. Commit the source and the regenerated files together.

Front matter keys:

Key	Use
slug	URL path, empty for the home page. Pages live at /<slug>/.
order	Position in the navigation, footer, sitemap and llms.txt
nav, name	Short navigation label and longer link name
title, description	<title> and meta description (keep them about 50 to 60 and 120 to 130 characters)
h1, lead	Page heading and the answer-first paragraph under it
summary	One-line description used in llms.txt
schema	faq (FAQPage built from ### questions ending in ?), howto (HowTo built from ### 1. Step headings) or about
software	true adds the SoftwareApplication JSON-LD for the script
cta, cta2	Hero buttons as Label|URL

The Markdown supports headings, paragraphs, lists, tables, fenced code, links, inline code and bold, plus two containers: :::cards (a grid of ### cards, each with an optional icon: /images/x.svg line) and :::note.

Add a page

Create scripts/pages/<slug>.md with the front matter above and run the build. The page is added to the navigation, footer, sitemap, llms.txt and llms-full.txt.

Images

The PNG files (images/og-image.png, images/apple-touch-icon.png, images/icon-192.png, images/icon-512.png and favicon.ico) are committed. To change them, edit the artwork in scripts/render-images.js or images/favicon.svg and run:

CHROME_PATH=/path/to/chrome node scripts/render-images.js

Preview locally

Serve the repository root with any static file server, for example npx http-server . -p 8080, and open http://localhost:8080/.

Site policies

• No JavaScript, cookies, analytics, web fonts or third-party requests. A Content-Security-Policy meta tag enforces this.
• Every fact about the script must match the code in server_audit_notify.sh, and every outside claim must link to the source it comes from.

Contributing and security

Open an issue or pull request. Report security issues privately to security@forwardemail.net, as the Forward Email security policy describes.

Related

• Forward Email: open-source email service
• Attestium: Node.js remote attestation library from the Forward Email team
• Audit Status: tool built on Attestium that checks production servers run the code in a public repository