linux-security 开源项目推荐（665 个）

trimstray /the-practical-linux-hardening-guide

本指南详细介绍如何创建安全的 Linux 生产系统。OpenSCAP（C2S/CIS、STIG）。

bytedance /Elkeid

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

sleventyeleven /linuxprivchecker

linuxprivchecker.py -- a Linux Privilege Escalation Check Script

rfxn /linux-malware-detect

多引擎Linux恶意软件扫描器，具有五个检测阶段（MD5、HEX模式、YARA、ClamAV、统计）、实时inotify监控、隔离和多通道警报

microsoft /avml

AVML - Acquire Volatile Memory for Linux

nluedtke /linux_kernel_cves

Tracking CVEs for the linux Kernel

Karib0u /rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

Netflix-Skunkworks /stethoscope-app

A desktop application that checks security-related settings and makes recommendations for improvements without requiring central device management or automated reporting.

gustavo-iniguez-goya /opensnitch

OpenSnitch is a GNU/Linux application firewall

aidlx /ghostscan

A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (50+ scanners)

EmreOvunc /Linux-System-Management-Scripts-Tricks

Linux Security & Linux Hardening & Linux Management & Linux Configuration

wirefalls /geo-nft

Bash script to create nftables sets of country specific IP address ranges for use with firewall rulesets. The project provides a simple and flexible way to implement geolocation filtering with nftables. It can be a useful tool to reduce the chance of malware, ransomware and phishing attempts as well as mitigating the effects of DDoS attacks.

rfxn /advanced-policy-firewall

iptables/netfilter firewall for Linux servers with stateful filtering, trust system, ipset block lists, SYN flood protection, VNET per-IP policies, and Docker support

gensecaihq /Ubuntu-Security-Hardening-Script

This script automates the scanning process using the OpenSCAP Security Guid to hardening Ubuntu systems, aligning with DISA-STIG compliance for Ubuntu 24.04. LTS minimum. It includes a range of security enhancements and configurations designed to strengthen the security posture of Ubuntu servers.

jwillyamz /ezEmu

See adversary, do adversary: Simple execution of commands for defensive tuning/research (now with more ELF on the shelf)

tomwechsler /Securing_Linux_Systems

Linux security with three different distributions (Rocky Linux, Ubuntu and openSUSE)!

sandboxec /sandboxec

A lightweight command sandbox for Linux, secure-by-default, built on Landlock.

Division-36 /Z-Jail

A lightweight, multi-layer Linux sandbox combining namespaces, pivot_root, seccomp-bpf, capability dropping, and an evidence-based verdict engine (Truthimatics Public Version) for secure, auditable code execution.

Crihexe /copy-fail-tiny-elf-CVE-2026-31431

Minimal no-libc Linux x86_64 ELF PoC build for Copy Fail (CVE-2026-31431)

longbertha /linux_setup

Automated Linux environment initialization & post-installation setup script for Ubuntu/CentOS/RHEL. 支持开发环境一键配置、常用安全软件与 DevOps 工具链自动化安装、系统内核与网络参数深度性能优化和加固，世界杯备战