AEGIS Community

Is your machine obviously unsafe? One command reads your host's security posture — SSH, exposed services, file permissions, stray secrets — and tells you, in plain English, whether you've left yourself open. Then it hands you the fix. It never changes a thing.

Read-only. Offline. No login, no telemetry, nothing leaves your box.

$ python3 aegis_community.py
Host posture: 38/100 on demo-host — 5 item(s) to review.
  ✓ [CRITICAL] SSH PermitEmptyPasswords: PermitEmptyPasswords = no (default)
  ✗ [HIGH    ] SSH PermitRootLogin: PermitRootLogin = yes
      fix: set 'PermitRootLogin prohibit-password' in /etc/ssh/sshd_config; then reload sshd
  ✗ [HIGH    ] Secret/credential files not group/world accessible: Over-permissive: /root/.ssh/id_rsa (0o644); /root/.env (0o644)
      fix: chmod 600 the listed files (chmod 600 <file>)
  ▲ [HIGH    ] SSH PasswordAuthentication: PasswordAuthentication = yes (key-only is safer)
      fix: set 'PasswordAuthentication no' once key access is confirmed; then reload sshd
  ✓ [HIGH    ] No API-key-shaped secrets in home files: none detected
  ✗ [MEDIUM  ] No world-writable files in home: 1 world-writable file(s), e.g. /root/deploy.sh
      fix: chmod o-w <file> on the listed files
  ✓ [MEDIUM  ] Passwordless sudo (NOPASSWD) entries: none found (or sudoers not readable without privileges)
  ? [LOW     ] Host firewall present/active: no host firewall detected (containers/VMs may rely on an upstream firewall — confirm the perimeter is enforced somewhere)
  ▲ [LOW     ] Kernel hardening sysctls: net.ipv4.conf.all.rp_filter=2 (want 1, reverse-path filtering)
      fix: set the listed sysctls in /etc/sysctl.d/ (note: containers may inherit from the host)
  ✓ [INFO    ] Services bound to all interfaces (0.0.0.0): Public-bound ports: none — confirm each is intended to be reachable (vs 127.0.0.1).

What it checks

• SSH config — root login, password auth, empty passwords
• Exposed services — anything bound to 0.0.0.0 / all interfaces
• Sensitive-file permissions — ~/.ssh, .env, cloud-credential files
• World-writable files in your home
• Passwordless sudo (NOPASSWD) rules
• Host firewall presence
• Kernel hardening sysctls
• Plaintext secrets — API-key-shaped strings sitting in your home directory

You get a 0–100 hardening score and a ranked, copy-paste fix list.

Install & run

git clone https://github.com/AkuchiS/aegis-community
cd aegis-community
python3 aegis_community.py            # audit this machine
python3 aegis_community.py --home /path   # audit a specific home directory
python3 aegis_community.py --selftest     # prove it works
python3 aegis_community.py --json         # full JSON output

Pure standard library — Python 3.8+, nothing to install. All checks are first-party (CIS/Lynis-inspired, our own implementation); nothing third-party is required.

It never changes anything

AEGIS Community is read-only. It reports findings and proposes fixes — you decide what to apply. It does not modify your system, require root, or send anything off the machine.

License

MIT — free to use, modify, and share.

---

Want the depth? AEGIS Pro

Community answers "am I obviously exposed?". AEGIS Pro answers "show me everything" — full CVE / dependency analysis (pip-audit + grype), exportable reports, and verification certificates. Same privacy: offline, read-only. Free first — upgrade only if you already trust it.