shs-security 1.0.1
System Hygiene Scanner (SHS) – Linux security auditing tool
License: MIT

# Security Hygiene Scanner (SHS)

Security Hygiene Scanner (SHS) is a **cross-platform** CLI security hygiene tool for Windows, Linux, and macOS. It focuses on practical misconfigurations and weak security practices rather than rare exploits.

SHS is designed for IT admins, SOC analysts, DevOps engineers, startups, students, and trainers who need a fast, one-command security posture snapshot.

**Available as native standalone executables for all three platforms—no Python installation required.**

## Features

- System hygiene: root usage, firewall status, OS update freshness, antivirus presence, insecure services
- Network hygiene: exposed ports and services, weak TLS configuration hints
- User hygiene: admin-like accounts, potentially inactive users, MFA and password policy signals
- File and secret hygiene: `.env` files, API keys and secrets, world-writable files, backup files
- Cloud hygiene (AWS): root MFA status, unused access keys
- App hygiene: debug mode, debug configs, default credentials in configs
- Weighted risk scoring with a security health score
- HTML and JSON report generation from the latest scan
- Safe auto-remediation helpers for file permissions and firewall enablement

## Tech Stack

- Python 3.10+
- psutil
- python-nmap (optional, future network deep scan)
- boto3
- PyYAML
- sqlite3
- colorama

## Installation

### 🚀 Quick Start (Standalone Executables)

Download the native executable for your platform from [GitHub Releases](https://github.com/YOUR_ORG/shs/releases):

**Windows:**
```powershell
.\shs-windows.exe scan --system
```

**Linux:**
```bash
chmod +x shs-linux
./shs-linux scan --system
```

**macOS:**
```bash
chmod +x shs-macos
./shs-macos scan --system
```

**No Python installation required!** Just download and run.

### 📦 Development Installation (from source)

```bash
python -m venv .venv
source .venv/bin/activate     # Windows: .venv\Scripts\activate
pip install -r requirements.txt
```

Ensure the `nmap` binary is installed on the system if you intend to use deeper network scanning in future extensions.

## Quickstart

Run a full hygiene scan:

```bash
shs scan
```

Run specific modules:

```bash
shs scan --system
shs scan --network
shs scan --users
shs scan --files
shs scan --cloud
shs scan --apps
```

Generate reports from the latest scan:

```bash
shs report --html
shs report --json
shs report --html --output reports/latest.html
```

Apply safe auto-remediation helpers:

```bash
shs fix --auto
```

## Security Score

Findings are scored using weighted severities:

- CRITICAL = 10
- HIGH = 7
- MEDIUM = 4
- LOW = 1

The engine aggregates findings into a `Security Score` from 0–100% with a label such as `Excellent`, `Good`, `Needs Attention`, `High Risk`, or `Critical Risk`.

Example terminal output:

```text
[CRITICAL] FTP open to network (21) (ip=0.0.0.0, port=21)
[HIGH] AWS root MFA not enabled
[MEDIUM] MFA not detected for SSH logins
[LOW] Weak TLS protocol versions appear enabled (protocols=TLSv1,TLSv1.1)
Security Score: 62% (High Risk)
```

## Extensibility

- Each scan module is implemented as a separate Python module under `shs/modules`.
- The scan engine dynamically loads modules, so adding a new module only requires a new file and registration.
- Risk weights and module enablement can be adjusted in `shs/config/shs.yaml`.

## Limitations

- Some checks require Linux-specific files or commands and will be skipped on unsupported platforms.
- Deep vulnerability assessment, exploitation, and intrusive network testing are out of scope.
- Cloud checks are currently focused on AWS and require valid IAM permissions.

## Next Steps

- Add deeper network analysis using nmap scripts.
- Extend cloud checks for GCP and Azure.
- Add unit tests and CI workflows.
#\x00 \x00S\x00H\x00S\x00
\x00
\x00#\x00 \x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00-\x00H\x00y\x00g\x00i\x00e\x00n\x00e\x00-\x00S\x00c\x00a\x00n\x00n\x00e\x00r\x00
\x00
\x00#\x00 \x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00-\x00H\x00y\x00g\x00i\x00e\x00n\x00e\x00-\x00S\x00c\x00a\x00n\x00n\x00e\x00r\x00
\x00
\x00#\x00 \x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00-\x00H\x00y\x00g\x00i\x00e\x00n\x00e\x00-\x00S\x00c\x00a\x00n\x00n\x00e\x00r\x00
\x00
\x00#\x00 \x00S\x00e\x00c\x00u\x00r\x00i\x00t\x00y\x00-\x00H\x00y\x00g\x00i\x00e\x00n\x00e\x00-\x00S\x00c\x00a\x00n\x00n\x00e\x00r\x00-\x00S\x00H\x00S\x00-\x00
\x00
\x00