🛡️ USAF: Auditing Ubuntu Like It Matters
Hardening a machine is easy to claim and hard to prove. USAF — the Ubuntu Security Audit Framework — is an open-source answer to that gap: a single CLI that collects the state of a Linux host, runs hundreds of security checks against it, correlates the results into attack scenarios, maps them to five compliance frameworks, and reports findings with the evidence attached.
What it does
- 389+ security checks across more than twenty categories — SSH, kernel, users, permissions, network, filesystem, services, containers, secrets, boot, firewall, cloud, persistence, AppArmor, USB, password policy, forensics and more.
- 26 collectors that read from
/proc, systemd, APT, auditd, PAM, SSH config, journald, Docker and Podman, snapd, Flatpak, firmware and cloud metadata. - A correlation engine that runs YAML-defined rules with temporal correlation and risk accumulation to surface eight core attack scenarios — ransomware, cryptominer, persistence, supply chain, bootkit, container escape, data theft and active breach.
- Compliance gap analysis against CIS, NIST, PCI DSS, SOC2 and HIPAA.
- Evidence-based findings in eight evidence types, with context-aware severity and a trust score that adjusts confidence to the quality of the evidence behind it.
- Multiple outputs — a Rich terminal report, JSON, and Markdown — plus weighted A+ to F- scoring and baseline drift detection.
An architecture built for hundreds of plugins
The framework is a plugin system first and an application second. Collectors gather data once; checks are independent plugins that consume it; the runner orchestrates them with parallel execution and a cache in front. A policy engine and a knowledge base of 93 YAML entries — threat, exploit, impact, remediation and CVSS for each check — sit alongside, so findings carry their reasoning rather than a bare pass/fail.
The parts that are usually marketing are, here, tested: the knowledge base is validated, the scoring engine is deterministic and confidence-aware, and a validation lab provisions known-vulnerable Ubuntu VMs across five scenarios to prove that checks actually detect what they claim. The codebase is held to mypy --strict and a professional ruff configuration, with 1,942+ tests behind it.
Tech stack
| Technology | Role |
|---|---|
| Python 3.13+ | Application and plugin runtime |
| Typer | Composable CLI (scan, compliance, baseline, profile) |
| Pydantic | Typed findings, evidence and scores |
| Rich | Terminal reporting |
| pytest | 1,942+ tests across the framework |
The result
USAF is public and installable under the MIT licence at github.com/Type-3-studio/usaf, tested against Ubuntu 20.04 through 26.04. It is the studio's deepest piece of systems work: a tool that takes the guesswork out of hardening, and takes its own evidence as seriously as it asks you to take yours.