Defensive Linux security auditing and guarded repair in POSIX shell.

LAZYSEC finds weak local configuration, checks the running kernel and the distribution's security metadata, maintains a verified canonical CISA Known Exploited Vulnerabilities snapshot, and provides narrowly scoped tools to plan, apply, validate, and roll back selected fixes.

It is not a penetration-testing framework. It contains no exploits, payloads, credential attacks, stealth, persistence, or remote scanning.

Clone the repository, inspect it, and launch the control surface:

git clone https://github.com/QSOLKCB/LAZYSEC.git
cd LAZYSEC
sh lazysec-tui.sh

The TUI is written entirely in POSIX shell. On a capable terminal it provides arrow-key navigation, hotkeys, status, and action views inspired by QSOLKCB/QEC's operator TUI. On a basic or non-interactive terminal it falls back to a plain numbered menu. Set NO_COLOR=1 for colorless output.

• running-kernel CPU vulnerability and mitigation state;
• reboot-required state and kernel identity;
• duplicate UID 0 accounts and empty password hashes;
• sensitive account-file permissions;
• unsafe privileged PATH entries and /etc/ld.so.preload;
• effective OpenSSH settings via sshd -T, including included drop-ins;
• host firewall state and wildcard TCP/UDP listeners;
• SELinux or AppArmor enforcement;
• conservative kernel/sysctl hardening values;
• time synchronization, persistent logs, and legacy clear-text services;
• world-writable system paths and setuid/setgid inventory in --deep mode;
• vendor security updates through APT, DNF/YUM, Zypper, APK, or Pacman tooling.

LAZYSEC does not declare a package vulnerable merely because its version looks old. Linux distributions routinely backport security fixes without adopting an upstream version number. Applicable CVEs come from vendor package metadata; the CISA KEV catalog is a prioritization feed, not proof of local exposure.

Every fixer defaults to inspection or a plan. Applying a fix is separately named, requires root, and is never reached through eval or assembled shell commands. SSH key-only mode additionally requires a populated authorized_keys file and the typed phrase ENABLE-KEY-ONLY.

Synchronize and verify the complete CISA KEV catalog:

sh lazy-cve.sh --sync-kev
sh lazy-cve.sh --verify-kev
sh lazy-cve.sh --kev

tools/cve-sync.sh validates the feed, normalizes it into LAZYSEC's deterministic canonical JSON profile, sorts every vulnerability by CVE ID, sorts object keys, and writes:

cve-catalog.json
cve-catalog.json.sha256

Writes are atomic and symlink state paths are refused. Every query verifies the SHA-256 and schema first. The digest detects later modification of the retrieved snapshot; it is not represented as a CISA digital signature. See docs/CVE-DATA.md.

# Quick read-only audit
sudo sh lazy-audit.sh

# Slower local filesystem checks
sudo sh lazy-audit.sh --deep --verbose

# Distro security advisories and running-kernel mitigations
sudo sh lazy-cve.sh --status

# Show before touching anything
sh tools/fix-ssh.sh --plan baseline
sh tools/fix-sysctl.sh --plan
sh tools/apply-security-updates.sh --plan

# Explicit guarded changes
sudo sh tools/fix-ssh.sh --apply baseline
sudo sh tools/fix-sysctl.sh --apply
sudo sh tools/apply-security-updates.sh --apply

Do not pipe remote scripts directly into a root shell. Clone or download the repository, review the exact version, and run the local files.

The self-red-team attacks LAZYSEC's own trust boundaries with isolated fixtures:

sh tests/redteam.sh

The optional full lab deliberately weakens a disposable, network-isolated Docker/Podman container and proves the audit detects the planted flaws:

sh tests/lab-redteam.sh

The lab drops all container capabilities, enables no-new-privileges, disables container networking, and removes the container afterward. It never weakens the host. See docs/THREAT-MODEL.md.

sh tools/install-timer.sh --plan
sudo sh tools/install-timer.sh --apply
journalctl -u lazysec.service

The daily service is read-only, uses cached security metadata, writes to the system journal, and runs with systemd sandboxing. It makes no network requests.

• Linux with a POSIX /bin/sh;
• standard Linux userland tools;
• jq, curl, and a SHA-256 implementation for canonical KEV sync;
• optional ss, sshd, mokutil, distribution security tools, and systemd;
• optional Docker or Podman only for the disposable adversarial lab.

Missing optional tools produce explicit INFO or SKIP results, not fabricated passes.

• Local, defensive, and authorized.
• Read-only by default.
• Vendor metadata over naive version guessing.
• Plan before apply.
• Backup, validate, then reload.
• Canonical evidence with integrity hashes.
• Fast is holy. Small is beautiful. Lazy is not sloppy.

MIT License. QSOL-IMC / Trent Slade.