Why This Exists

Linux security is fragmented. This makes it simple.

Every guide tells you to install UFW, enable AppArmor, set sysctl values, configure auto-updates — but nobody gives you a single script that does all of it, safely, with verification.

sec-toolkit.sh is that script. One file, no dependencies beyond what Ubuntu/Pop!_OS already ships. It checks your system, hardens it, verifies the results, and optionally sets up ClamAV virus scanning. Every step is conservative — it won't break your desktop.

Live Output

Run the check — see what needs attention

sec-toolkit.sh check

────────────────────────────────────────────────── [OK] UFW is active [OK] Default incoming = deny [OK] Default outgoing = allow [WARN] UFW logging is off [OK] AppArmor service is running [OK] unattended-upgrades installed [OK] Automatic package list updates enabled [OK] kernel.randomize_va_space = 2 [OK] kernel.kptr_restrict = 2 [WARN] 3 updates available Report: ~/sec-check-reports/sec-check_20260726.log

What It Does

Five phases, one file, zero fluff

🔍

Check (sec-toolkit.sh check)

Read-only security audit. Inspects UFW, AppArmor, auto-updates, sysctl, listening ports, failed services, login history, SSH keys, kernel hardening — saves a full report to ~/sec-check-reports/.

🛡️

Harden (sudo sec-toolkit.sh harden)

Conservative desktop hardening. Installs unattended-upgrades, AppArmor tools, and applies safe sysctl settings. Creates backups before any change. Won't break your desktop.

✅

Verify (sec-toolkit.sh verify)

Confirms hardening took effect. Checks UFW status, AppArmor, auto-updates config, sysctl values, listening ports, SSH server, and pending updates. Color-coded output.

🦠

ClamAV Scan (sec-toolkit.sh scan)

Optional virus scanning with ClamAV. Scan any directory (default: ~/Downloads). Installs ClamAV + ClamTk GUI with one command.

🌐

Firewall (sec-toolkit.sh fw)

UFW setup in one step. Deny incoming, allow outgoing, deny routed. Optional SSH rate limiting and LAN access — your choice via interactive prompts.

🌍

Bilingual EN/DE

Full English and German support. Choose at startup — all menus, prompts, and output follow your language choice automatically.

How It Works

From zero to hardened in 5 steps

Download one file

No package manager, no repo to add. Just wget the script and run it. Single bash file, ~800 lines, everything inline.

Run the check

./sec-toolkit.sh check — read-only audit of your current security posture. See what's good, what's missing, what's open.

Back up first

Run sudo apt install timeshift and create a snapshot. Takes seconds. Restores in minutes. Cheap insurance.

Harden your system

sudo ./sec-toolkit.sh harden — installs security packages, configures auto-updates, enables AppArmor, applies kernel hardening. Backs up existing configs first.

Verify everything

./sec-toolkit.sh verify — confirms all hardening steps took effect. Color-coded: green = good, yellow = check, red = critical.

Want it done for you?

sec-toolkit hardens your system. nomad watches for agents. We set up both.

nomad detects autonomous agents on your machine. sec-toolkit.sh hardens the system they're running on. Together: detect the agents, lock down the infrastructure.

Both tools are free to download and use. If you would rather not do it yourself, the Security Suite is one package, done for you: audit, hardening, nomad monitoring setup, alerts, and before/after proof, on one machine.

See the Security Suite →

Get Started

One file. Copy and run.

terminal

# Download the toolkit $ wget https://008amonra.github.io/loom/sec-toolkit.sh $ chmod +x sec-toolkit.sh # Back up your system first (recommended) $ sudo apt install timeshift $ sudo timeshift --create --comments "before sec-toolkit" # Run a read-only security check $ ./sec-toolkit.sh check # Harden your system (needs sudo) $ sudo ./sec-toolkit.sh harden # Verify hardening took effect $ ./sec-toolkit.sh verify # Or run the interactive menu $ ./sec-toolkit.sh