pareto-linux

Automatically audit your Linux machine for basic security hygiene.

Installation

Using Debian/Ubuntu/Pop!_OS/RHEL/Fedora/CentOS

See https://pkg.paretosecurity.com for install steps.

Quick Start

To run a one-time security audit:

paretosecurity check

or with JSON reporter

paretosecurity check --json

Using Nix

Quick Start without installing anything

To run a one-time security audit without installation:

nix run github:paretosecurity/pareto-linux -- check

or if running from local repo with JSON reporter

nix run . -- check --json

This will analyze your system and provide a security report highlighting potential improvements and vulnerabilities.

Install via nix-channel

As root run:

$ sudo nix-channel --add https://github.com/paretosecurity/pareto-linux/archive/main.tar.gz paretosecurity
$ sudo nix-channel --update

Install module via nix-channel

Then add the following to your configuration.nix in the imports list:

{
  imports = [ <paretosecurity/modules/paretosecurity.nix> ];
}

Install CLI via nix-channel

To install the paretosecurity binary:

{
  environment.systemPackages = [ (pkgs.callPackage <paretosecurity/pkgs/paretosecurity.nix> {}) ];
}

Install via Flakes

Install module via Flakes

{
  inputs.paretosecurity.url = "github:paretosecurity/pareto-linux";
  # optional, not necessary for the module
  #inputs.paretosecurity.inputs.nixpkgs.follows = "nixpkgs";

  outputs = { self, nixpkgs, paretosecurity }: {
    # change `yourhostname` to your actual hostname
    nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
      # change to your system:
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        paretosecurity.nixosModules.default
      ];
    };
  };
}

Install CLI via Flakes

Using NixOS module (replace system "x86_64-linux" with your system):

{
  environment.systemPackages = [ paretosecurity.packages.x86_64-linux.default ];
}

e.g. inside your flake.nix file:

{
  inputs.paretosecurity.url = "github:paretosecurity/pareto-linux";
  # ...

  outputs = { self, nixpkgs, paretosecurity }: {
    # change `yourhostname` to your actual hostname
    nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        # ...
        {
          environment.systemPackages = [ paretosecurity.packages.${system}.default ];
        }
      ];
    };
  };
}