Getting Started

Get infraudit running on your server in under a minute.

Installation

Option 1: Install script (recommended)

One command. Detects your server's architecture automatically and installs the correct binary:

curl -sL https://raw.githubusercontent.com/civanmoreno/infraudit/main/install.sh | sh

Option 2: Homebrew

brew tap civanmoreno/tap https://github.com/civanmoreno/infraudit.git
brew install infraudit

Option 3: Build from source

Requires Go 1.25+:

git clone https://github.com/civanmoreno/infraudit.git
cd infraudit
make build
sudo mv infraudit /usr/local/bin/
sudo make install-man  # Install man page (optional)

Option 4: Docker

docker build -t infraudit .
docker run --rm --privileged -v /:/host:ro infraudit audit

Commands

infraudit has three main commands:

Basic Usage

Run a full audit

Most checks require root to read system configurations:

sudo infraudit audit

Audit a specific category

# Only authentication checks
sudo infraudit audit --category auth

# Only network and firewall checks
sudo infraudit audit --category network

List all available checks

infraudit list

Output:

ID          CATEGORY    SEVERITY  NAME
──          ────────    ────────  ────
AUTH-001    auth        CRITICAL  SSH root login disabled
AUTH-002    auth        HIGH      SSH password authentication disabled
AUTH-003    auth        CRITICAL  Only root has UID 0
...
Total: 287 checks

Export results

# JSON for CI/CD pipelines
sudo infraudit audit --format json --output report.json

# YAML for config management
sudo infraudit audit --format yaml --output report.yaml

Skip specific checks

# Skip checks you've accepted the risk for
sudo infraudit audit --skip HARD-007,SVC-012

# Combine skip with category filter
sudo infraudit audit --category auth --skip AUTH-008

Server Profiles

Profiles automatically skip categories not relevant to your server role and configure allowed ports:

# Web server — skips container & NFS, allows ports 22/80/443
sudo infraudit audit --profile web-server

# Database server — skips container & NFS, allows DB ports
sudo infraudit audit --profile db-server

# Container host — skips NFS, allows ports 22/80/443/2376
sudo infraudit audit --profile container-host

# Minimal — skips container, NFS, malware, backup categories
sudo infraudit audit --profile minimal

Complete CLI Reference

infraudit (root command)

infraudit audit

Execute security checks and generate a report.

infraudit list

Display all registered checks in a table with ID, category, severity, and name.

infraudit completion <shell>

Generate autocompletion scripts for your shell:

# Bash
infraudit completion bash > /etc/bash_completion.d/infraudit

# Zsh
infraudit completion zsh > "${fpath[1]}/_infraudit"

# Fish
infraudit completion fish > ~/.config/fish/completions/infraudit.fish

Available Categories

Exit Codes

Permissions

infraudit reads system files like /etc/shadow, /etc/ssh/sshd_config, and kernel parameters. Most checks require root access. Checks that cannot run without proper permissions will report as ERROR with a clear message.

infraudit is read-only — it never modifies your system. It only inspects configurations and reports findings.

Configuration File

For persistent settings (skip lists, allowed ports), create a JSON config file. See Configuration for details.

# Example: ~/.infraudit.json
{
  "skip": ["HARD-007", "SVC-012"],
  "skip_categories": ["container"],
  "allowed_ports": [22, 80, 443]
}

Man Page

infraudit includes a Unix man page with the complete command reference. After installation:

man infraudit

If you built from source, install it with:

sudo make install-man