$ show sun977/Linuxgun
LinuxGun is a collection of Bash shell scripts for Linux security incident response and system hardening. The core scripts (`linuxGun.sh`, `linuxGunPro.sh`, `linuxcheck.sh`) perform comprehensive checks across system information, user accounts, network connections, processes, files, logs, backdoors, tunnels, webshells, malware, memory, hacker tools, kernel modules, Kubernetes, and baseline security configurations. The toolset is designed for emergency triage by system administrators and security analysts, with color-coded output and modular function organization. It includes auxiliary tools for IP blocking (`blockIP.sh`), network interface monitoring (`monitorInter.sh`), process-to-IP connection mapping (`monitorPs2Ip.sh`), and a file upload server (`uploadServer.py`) for transmitting results. The repository also contains AI skill definitions (in `AI-skills/old/`) that describe an automated incident response workflow via SSH, though these appear to be experimental or deprecated. The codebase is functional but shows signs of rapid iteration, hardcoded assumptions (CentOS 7, specific command availability), incomplete modules, and mixed-language comments (Chinese/English). It is not a polished library but a practical, field-tested toolkit for Linux forensics.
The LLM identified 3 files worth highlighting for reuse:
Standalone script for managing IP blocking/unblocking via iptables or firewalld. Supports adding, removing, listing, and backing up/restoring firewall rules. Includes a dry-run mode (`--show-run`) to preview commands without execution. Reusable in any Linux environment requiring IP access control, with minimal dependencies.
Simple HTTP file upload server with token-based authentication. Accepts POST requests with a file and token, stores files in a configurable directory, and enforces a maximum file size (default 1024 MB). Uses only Python standard library modules, making it lightweight and portable. Suitable as a receiver for security audit results or any file transfer scenario requiring basic access control.
Real-time process-to-IP connection mapper. Uses `netstat` or `ss` to list active connections and filters by a specified IP address. Outputs process IDs, names, and connection details. Useful for identifying suspicious network connections from specific processes during incident response. Standalone script with no external dependencies beyond standard Linux tools.