An Automated Linux Security Auditing and Hardening Framework

Abstract

Linux systems are increasingly targeted by cyber-attacks due to misconfigurations, outdated packages, and exposed services. Traditional security assessment approaches are often manual, time-consuming, and fragmented across multiple tools. This paper presents a unified automated framework for Linux security auditing and hardening, integrating vulnerability assessment, CVE-based mapping using the National Vulnerability Database, automated remediation, patch management, network port scanning, and real-time security monitoring. The framework is implemented using a hybrid architecture combining Python, Bash scripting, and a Flask-based monitoring interface. It was evaluated across six widely used Linux distributions Ubuntu, Debian, CentOS, Fedora, Kali Linux, and Parrot OS using a systematic before-and-after hardening methodology. Experimental results demonstrate a 60 – 70% average reduction in detected vulnerabilities and misconfigurations, improved security scores, and minimal runtime overhead. Additionally, the framework introduces a closed-loop automated security pipeline that enables continuous assessment and remediation without manual intervention.These findings validate the framework’s effectiveness, scalability, and portability, providing a practical solution for proactive Linux system security management. Future work will extend the framework to container and application-level security and incorporate machine learning-based anomaly detection.