# andy25x/linux-hardening-auditor architecture

> Architecture diagram of the GitHub repository andy25x/linux-hardening-auditor, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/andy25x/linux-hardening-auditor
- Repository: https://github.com/andy25x/linux-hardening-auditor

## Overview

This is a local Linux hardening auditor: an administrator selects checks and output options, the runner executes registered controls and calculates a severity-weighted score, and the CLI presents findings in the terminal or produces HTML/JSON reports. Checks cover SSH, user accounts, filesystem permissions, kernel settings, and network exposure. The README documents the principal workflow and report formats; sampled sources confirm runner dispatch and CLI/reporting connections. Network checks are included as a documented-in-source capability although the README feature summary lists four categories.

Main entry points: [`auditor/runner.py`](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/runner.py) (Runner and scoring), [`auditor/checks/base.py`](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/base.py) (Check model), [`auditor/cli.py`](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/cli.py) (CLI), [`auditor/reporter.py`](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py) (Report generator)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI workflow"]
  node_cli["CLI<br/>[cli.py]"]
end

subgraph group_controls["Audit controls"]
  node_ssh["SSH checks<br/>[ssh.py]"]
  node_users["User checks<br/>[users.py]"]
  node_filesystem["Filesystem checks<br/>[filesystem.py]"]
  node_kernel["Kernel checks<br/>[kernel.py]"]
  node_network["Network checks<br/>[network.py]"]
end

subgraph group_engine["Audit engine"]
  node_base["Check model<br/>[base.py]"]
  node_runner["Runner and scoring<br/>[runner.py]"]
end

subgraph group_outputs["Reporting"]
  node_reporter["Report generator<br/>[reporter.py]"]
  node_terminal["Terminal findings<br/>[cli.py]"]
  node_html["HTML report<br/>[reporter.py]"]
  node_json["JSON report<br/>[reporter.py]"]
end

node_admin(("Administrator"))
node_linux["Linux system"]

node_admin -->|"runs options"| node_cli
node_cli -->|"runs audit"| node_runner
node_runner -->|"dispatches checks"| node_ssh
node_runner -->|"dispatches checks"| node_users
node_runner -->|"dispatches checks"| node_filesystem
node_runner -->|"dispatches checks"| node_kernel
node_runner -->|"dispatches checks"| node_network
node_ssh -->|"returns results"| node_base
node_users -->|"returns results"| node_base
node_filesystem -->|"returns results"| node_base
node_kernel -->|"returns results"| node_base
node_network -->|"returns results"| node_base
node_linux -.->|"provides local state"| node_ssh
node_linux -.->|"provides local state"| node_users
node_linux -.->|"provides local state"| node_filesystem
node_linux -.->|"provides local state"| node_kernel
node_linux -.->|"provides local state"| node_network
node_runner -->|"provides summary"| node_reporter
node_cli -->|"requests reports"| node_reporter
node_cli -->|"prints findings"| node_terminal
node_reporter -->|"renders HTML"| node_html
node_reporter -->|"serializes JSON"| node_json

click node_cli "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/cli.py"
click node_ssh "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/ssh.py"
click node_users "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/users.py"
click node_filesystem "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/filesystem.py"
click node_kernel "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/kernel.py"
click node_network "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/network.py"
click node_base "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/base.py"
click node_runner "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/runner.py"
click node_reporter "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py"
click node_terminal "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/cli.py"
click node_html "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py"
click node_json "https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli toneBlue
class node_ssh,node_users,node_filesystem,node_kernel,node_network toneAmber
class node_base,node_runner toneMint
class node_reporter,node_terminal,node_html,node_json toneRose
class node_admin,node_linux toneIndigo
```

## Components

### CLI workflow

- [CLI](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/cli.py): `auditor/cli.py`

### Audit controls

- [SSH checks](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/ssh.py): `auditor/checks/ssh.py`
- [User checks](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/users.py): `auditor/checks/users.py`
- [Filesystem checks](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/filesystem.py): `auditor/checks/filesystem.py`
- [Kernel checks](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/kernel.py): `auditor/checks/kernel.py`
- [Network checks](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/network.py): `auditor/checks/network.py`

### Audit engine

- [Check model](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/checks/base.py): `auditor/checks/base.py`
- [Runner and scoring](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/runner.py): `auditor/runner.py`

### Reporting

- [Report generator](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py): `auditor/reporter.py`
- [Terminal findings](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/cli.py): `auditor/cli.py`
- [HTML report](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py): `auditor/reporter.py`
- [JSON report](https://github.com/andy25x/linux-hardening-auditor/blob/main/auditor/reporter.py): `auditor/reporter.py`

### Other components

- **Administrator**
- **Linux system**

## Connections

- Administrator → CLI: runs options (evidence: `README.md`)
- CLI → Runner and scoring: runs audit (evidence: `auditor/cli.py`)
- Runner and scoring → SSH checks: dispatches checks (evidence: `README.md`)
- Runner and scoring → User checks: dispatches checks (evidence: `README.md`)
- Runner and scoring → Filesystem checks: dispatches checks (evidence: `README.md`)
- Runner and scoring → Kernel checks: dispatches checks (evidence: `auditor/runner.py`)
- Runner and scoring → Network checks: dispatches checks (evidence: `auditor/runner.py`)
- SSH checks → Check model: returns results (evidence: `auditor/checks/ssh.py`)
- User checks → Check model: returns results (evidence: `auditor/checks/users.py`)
- Filesystem checks → Check model: returns results (evidence: `auditor/checks/filesystem.py`)
- Kernel checks → Check model: returns results (evidence: `auditor/checks/kernel.py`)
- Network checks → Check model: returns results (evidence: `auditor/checks/network.py`)
- Linux system → SSH checks: provides local state
- Linux system → User checks: provides local state
- Linux system → Filesystem checks: provides local state
- Linux system → Kernel checks: provides local state
- Linux system → Network checks: provides local state
- Runner and scoring → Report generator: provides summary (evidence: `auditor/reporter.py`)
- CLI → Report generator: requests reports (evidence: `auditor/cli.py`)
- CLI → Terminal findings: prints findings (evidence: `auditor/cli.py`)
- Report generator → HTML report: renders HTML (evidence: `README.md`)
- Report generator → JSON report: serializes JSON (evidence: `README.md`)