ubuntu-security

Plugin ubuntu-security in danielrosehill/Ubuntu-Security. Commands read from the repo's manifest — 19 days ago.

Skills (18)

• av-install

  Install and initialise malware and rootkit scanning on Ubuntu — the core set (ClamAV engine + clamd daemon + freshclam updater, ClamTk GUI on desktops, rkhunter) and, on request, the advanced layer (Lynis hardening audit, chkrootkit, AIDE file-integrity baseline, debsecan). Detects what is already i

• av-update-definitions

  Refresh signature databases and data for every installed scanner on Ubuntu — freshclam (ClamAV), rkhunter --update, Lynis version check, debsecan CVE list — and report one status line per tool, without re-baselining rkhunter or AIDE. Also explains stale ClamAV signatures (freshclam service down, mir

• fail2ban

  Install, configure and operate fail2ban on Ubuntu — sshd jail reading the systemd journal, ban time and retry thresholds, ignoring the LAN/VPN so the user can't ban themselves, list active jails and banned IPs, unban an address, and check whether fail2ban is the reason a client can't connect. Use wh

• fingerprint-setup

  Set up a fingerprint reader for login, lock screen and sudo on an Ubuntu laptop or desktop — check the reader is supported by libfprint, install fprintd and libpam-fprintd, enroll fingers, enable fingerprint auth with pam-auth-update, verify, and troubleshoot unsupported or flaky readers. Use when t

• firewall-allow

  Add a scoped firewall exemption with ufw on an Ubuntu desktop or server — open a port, port range or app profile (OpenSSH, CUPS, KDE Connect, Samba, Syncthing...) to the LAN, a VPN interface, one host, or anywhere, with a comment, without duplicating existing rules, and verify it actually took effec

• firewall-diagnose

  Work out whether the host firewall (ufw) is what is blocking a connection on an Ubuntu desktop or server, and if so which rule or policy — reads UFW BLOCK lines from the kernel log (journalctl -k) and /var/log/ufw.log, checks logging is on, walks first-match rule order, interface and address-family

• firewall-remove

  Remove or tighten ufw firewall rules on an Ubuntu desktop or server — show the numbered rules, delete by number or by rule spec, dedupe redundant entries, replace a broad allow with a scoped one, or reset to a saved baseline. Confirms before deleting anything that was not added in this same session,

• firewall-setup

  First-time ufw setup on an Ubuntu desktop or server — install if missing, set default policies (deny incoming, allow outgoing), low logging, add narrow allows only for services the user actually runs (SSH first on a remote box, then e.g. mDNS, KDE Connect, Syncthing, Samba, CUPS on a desktop, or HTT

• firewall-status

  Probe the host firewall (ufw, with nftables/iptables/firewalld detection) on an Ubuntu desktop or server and report what is actually reachable — active or not, default policies, logging level, every rule with its number, listening services cross-checked against the rules, recent blocks, holes ufw do

• malware-scan

  Run an on-demand malware, rootkit or file-integrity scan on Ubuntu with the installed tools — ClamAV (clamdscan / clamscan) over home, a path, or the whole filesystem, plus rkhunter, chkrootkit, Lynis and AIDE — write per-tool reports and a summary, and interpret the results including well-known fal

• scan-schedule

  Schedule periodic malware / rootkit scans and definition refreshes on Ubuntu with systemd timers (cron fallback) — e.g. weekly quick scan, monthly deep scan — writing reports to the user's reports folder, marking the unit failed when there are findings, and sending a desktop notification on desktops

• security-audit

  Read-only security audit of an Ubuntu desktop or server host — updates and reboot state, firewall and network exposure (including Docker publishes), SSH server config and auth logs, accounts and sudo, file permissions and non-package SUID binaries, AppArmor, installed scanners and their freshness, d

• security-updates

  Check the security-patch state of an Ubuntu host — pending upgrades from the -security pocket, Ubuntu Pro / ESM coverage via `pro security-status`, whether a specific CVE or USN is fixed, whether unattended-upgrades is actually running and when it last applied something, and whether a reboot or serv

• spyware-check

  Look for spyware, unwanted telemetry and suspicious software on an Ubuntu machine — installed packages, snaps, flatpaks and /opt software from unknown origins, telemetry and crash-reporting services (apport, whoopsie, popularity-contest, ubuntu-report, vendor agents), unexpected outbound connections

• ssh-keys

  Manage the user's SSH key pairs on Ubuntu — inventory ~/.ssh keys with type, size, fingerprint and comment, which are loaded in the agent and referenced in ~/.ssh/config, flag weak or orphaned keys, generate new ed25519 (or FIDO2 hardware-backed ed25519-sk) keys, copy a public key to other machines

• ssh-server-config

  Inspect and change the OpenSSH server configuration on an Ubuntu desktop or server safely — effective settings via `sshd -T`, drop-ins in /etc/ssh/sshd_config.d, socket activation (ssh.socket) on Ubuntu 22.10+, recent logins and failed attempts — and apply requested changes such as disabling passwor

• tls-cert-check

  Check TLS certificates on an Ubuntu server — Let's Encrypt / certbot certificates and their renewal timer, certificate files referenced by nginx, Apache, Postfix and other services, what a live endpoint actually serves (expiry, chain, hostname match), and certificates expiring within 30 days — and d

• yubikey-setup

  Set up a YubiKey or other FIDO2/U2F security key for authentication on Ubuntu — detect the key, install libpam-u2f, register the key with pamu2fcfg, require or accept it for sudo, the login screen and the lock screen via PAM, and create FIDO2-backed SSH keys — with a root shell kept open so a PAM mi

Similar plugins