# Building a Linux Security Audit Tool in WSL: A Hybrid Bash + Python Adventure

> By Johnathan Belcher — July 1, 2026 — 8 min read

LinuSec is a lightweight, modular Linux security audit tool built inside Ubuntu on WSL. It grew into a hybrid Bash + Python system with a Rich-powered TUI dashboard and clean separation of concerns.

## Why Build a Security Audit Tool?

Linux is full of corners you don't think about until you use it every day — file permissions, SUID binaries, cron jobs, SSH configs, world-writable directories, failed logins, kernel errors. Rather than checking these manually, I built a tool that runs a series of security checks, parses and scores the results, generates a structured JSON report, and displays everything in a Rich-based terminal dashboard.

## Hybrid Architecture: Bash for Collection, Python for Intelligence

Bash is perfect for running system commands and collecting raw data; Python is perfect for parsing, scoring, and presenting that data:

```
audit.sh -> runs Bash modules -> produces raw txt
Python modules -> parse txt -> produce JSON
Rich TUI -> reads JSON -> displays dashboard
```

## Bash Modules: The Raw Data Layer

Each Bash module (system.sh, users.sh, permissions.sh, services.sh, network.sh, logs.sh) captures Linux command output as raw text without interpreting it, making the tool easy to extend — add a new Bash module for a new check.

## Python Modules: The Brain

Each Python module reads the raw text, parses it into structured data, scores severity (low/medium/high), and writes a JSON file. For example, the permissions module scores severity based on the number of SUID/SGID binaries and world-writable directories found.

## The Orchestrator: audit.sh

This script creates directories, runs all Bash modules, runs all Python modules, and combines all JSON into a single report — the "run everything" button.

## The Rich TUI: A Dashboard for Your System

The terminal UI loads the latest audit report and displays a header, summary panel, detailed category panels, severity colors (green/yellow/red), and a Trend column that updates each time you run `make audit`. Because everything is JSON, the TUI is fully decoupled from the audit logic.

## Lessons Learned

1. Hybrid architectures (Bash + Python) work naturally for system-level tooling.
2. WSL is a great playground for a real Linux environment without a full VM.
3. Rich makes terminal UI feel modern.
4. Modularity makes adding new checks trivial.
5. JSON is the universal glue between the audit engine, TUI, and testing.

## What's Next

Threat intelligence enrichment, a live-refresh mode, a Textual-based interactive UI, Windows notifications for high severity, and integration with a SOC homelab.

[GitHub Repo](https://github.com/JohnB-LWF/LinuSec)