Why This Exists

Linux security is fragmented. This makes it simple.

Every guide tells you to install UFW, enable AppArmor, set sysctl values, configure auto-updates — but nobody gives you a single script that does all of it, safely, with verification.

sec-toolkit.sh is that script. One file, no dependencies beyond what Ubuntu/Pop!_OS already ships. It checks your system, hardens it, verifies the results, and optionally sets up ClamAV virus scanning. Every step is conservative — it won't break your desktop.

Live Output

Run the check — see what needs attention

sec-toolkit.sh check

────────────────────────────────────────────────── [OK] UFW is active [OK] Default incoming = deny [OK] Default outgoing = allow [WARN] UFW logging is off [OK] AppArmor service is running [OK] unattended-upgrades installed [OK] Automatic package list updates enabled [OK] kernel.randomize_va_space = 2 [OK] kernel.kptr_restrict = 2 [WARN] 3 updates available Report: ~/sec-check-reports/sec-check_20260726.log

What It Does

Five phases, one file, zero fluff

🔍

Check (sec-toolkit.sh check)

Read-only security audit. Inspects UFW, AppArmor, auto-updates, sysctl, listening ports, failed services, login history, SSH keys, kernel hardening — saves a full report to ~/sec-check-reports/.

🛡️

Harden (sudo sec-toolkit.sh harden)

Conservative desktop hardening. Installs unattended-upgrades, AppArmor tools, and applies safe sysctl settings. Creates backups before any change. Won't break your desktop.

✅

Verify (sec-toolkit.sh verify)

Confirms hardening took effect. Checks UFW status, AppArmor, auto-updates config, sysctl values, listening ports, SSH server, and pending updates. Color-coded output.

🦠

ClamAV Scan (sec-toolkit.sh scan)

Optional virus scanning with ClamAV. Scan any directory (default: ~/Downloads). Installs ClamAV + ClamTk GUI with one command.

🌐

Firewall (sec-toolkit.sh fw)

UFW setup in one step. Deny incoming, allow outgoing, deny routed. Optional SSH rate limiting and LAN access — your choice via interactive prompts.

🌍

Bilingual EN/DE

Full English and German support. Choose at startup — all menus, prompts, and output follow your language choice automatically.

How It Works

From zero to hardened in 5 steps

Download one file

No package manager, no repo to add. Just wget the script and run it. Single bash file, ~800 lines, everything inline.

Run the check

./sec-toolkit.sh check — read-only audit of your current security posture. See what's good, what's missing, what's open.

Back up first

Run sudo apt install timeshift and create a snapshot. Takes seconds. Restores in minutes. Cheap insurance.

Harden your system

sudo ./sec-toolkit.sh harden — installs security packages, configures auto-updates, enables AppArmor, applies kernel hardening. Backs up existing configs first.

Verify everything

./sec-toolkit.sh verify — confirms all hardening steps took effect. Color-coded: green = good, yellow = check, red = critical.

Part of nomad Pro

sec-toolkit hardens your system. nomad watches for agents.

nomad detects autonomous agents on your machine. sec-toolkit.sh hardens the system they're running on. Together: detect the agents, lock down the infrastructure.

sec-toolkit.sh is free to download and use. The full integration — harden, verify, scan, fw commands via nomad security — is part of nomad Pro ($19/mo).

Get nomad Pro →

Get Started

One file. Copy and run.

terminal

# Download the toolkit $ wget https://008amonra.github.io/loom/sec-toolkit.sh $ chmod +x sec-toolkit.sh # Back up your system first (recommended) $ sudo apt install timeshift $ sudo timeshift --create --comments "before sec-toolkit" # Run a read-only security check $ ./sec-toolkit.sh check # Harden your system (needs sudo) $ sudo ./sec-toolkit.sh harden # Verify hardening took effect $ ./sec-toolkit.sh verify # Or run the interactive menu $ ./sec-toolkit.sh