franken-scan
It's alive!… but is it secure? A free check-up for Linux servers and PCs. In about 10 seconds it tells you what's wrong in plain English, why it matters, and the exact command to fix it, then grades your box from A to F.
What it looks like
── SSH (remote login) ──
✓ SSH doesn't accept passwords (keys only)
✗ [LOW] Root can log in over SSH with a key
Why: Logging in as a normal user and using sudo leaves a clearer
trail and limits the damage if a key leaks.
Fix: Set 'PermitRootLogin no': add it to a new file
/etc/ssh/sshd_config.d/00-hardening.conf, then:
sudo sshd -t && sudo systemctl reload sshd
── Firewall ──
✓ ufw is on and blocks incoming connections by default
── Brute-force protection ──
✗ [MEDIUM] No brute-force blocker running
Why: Bots hammer SSH with guesses around the clock.
Fix: sudo pacman -S fail2ban && sudo systemctl enable --now fail2ban
── Result ──
Grade B · 87/100 · Not bad. A few stitches to tighten.
9 passed · 0 high · 1 medium · 1 low · 0 skipped What it checks
- SSH: password logins (including the sneaky ones), root login
- Firewall: whether it's actually blocking anything, not just switched on
- Open ports: databases, remote desktops and Docker exposed to the internet
- Updates: pending updates, automatic security updates, reboots needed
- Brute-force protection: fail2ban or CrowdSec watching SSH
- Accounts: hidden root accounts, empty passwords, who has admin
- Plus: Docker, risky file permissions, clock sync, HTTPS certificates, backups
The promise
It only looks
It never changes your configuration: no installs, no edits, no restarts.
No internet
It never contacts the internet. No telemetry, nothing sent anywhere.
Read it yourself
One commented file. It was also independently reviewed, and the fixes are in.
Run it
On your Linux server or PC, in a terminal:
# 1. Download it, plus its checksum curl -fsSLO https://github.com/MartyMonster/franken-scan/releases/latest/download/franken-scan.sh curl -fsSLO https://github.com/MartyMonster/franken-scan/releases/latest/download/franken-scan.sh.sha256 # 2. Check it arrived intact sha256sum -c franken-scan.sh.sha256 # 3. Have a read (it's short and commented) less franken-scan.sh # 4. Run it (sudo gives the full scan) sudo bash franken-scan.sh
You won't find a curl … | sudo bash one-liner here. Piping
scripts from the internet straight into a root shell is exactly the
habit a security tool shouldn't teach.
Works on Debian, Ubuntu, Arch, Fedora, RHEL, Rocky, Alma and openSUSE, on PCs, servers and Raspberry Pi-style ARM boards.
Got a B or worse?
I'll get you to an A. Linux server hardening: I fix what franken-scan finds, and explain everything I change.