The machine's security posture, with the command behind every verdict
A terminal UI for the security posture of one Linux machine. Eight probes — Secure Boot, the MAC layer, the firewall, sshd, pending updates, accounts, kernel hardening and listening ports — each answered ok, warn, bad or unknown, with a score across the lot.
Every verdict shows its work. Open a probe and you get the exact command that was run, the line it judged, the full raw output underneath, and a fix that names either the sibling tool that owns the change (tui-firewall, tui-update) or the command to run yourself.
It reads first and asks second. Nothing escalates beyond sudo -n, which never prompts, so a probe that needs root it cannot get degrades to unknown with the reason instead of hanging on a password. Three fixes are offered inline — enabling ufw, setting one kernel hardening key with its drop-in, enabling the update timer — and each is previewed as the exact command line and confirmed first.
Run tui-secure --demo to drive a sample machine: every key works, every command is built and previewed for real, and nothing touches your system.
| Key | Action |
|---|---|
| enter | Open the probe: evidence, raw output and the fix |
| a | Apply an offered fix, previewed and confirmed first |
| r | Re-run every probe |
| R | Re-run the selected probe |
| / | Filter the probes by name, verdict or summary |
| ? | Help |
| q | Quit |
Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.
This tool is a face on the program below, so its version matters.Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as(untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.
systemctl245systemctl --versionjournal-grepsince 246systemd <246journalctl --grep does not exist, so the denial and failed-login counts are read by filtering the journal here instead of in journalctl, which is slower on a large journal
sshd8.2ssh -Vsshd-test-configsince 8.2openssh <8.2sshd -T predates several of the keywords this probe reads, so the settings come from parsing sshd_config and its drop-ins instead, which does not resolve Match blocks
ufw0.36ufw --versionufw <0.36ufw status verbose prints no default policy line, so the incoming and outgoing policies are reported as unknown and only the active state is judged
firewall-cmd0.9firewall-cmd --versionsbctlsbctl versionsbctl >=0.1sbctl is optional: without it the Secure Boot probe reports what bootctl status knows and says nothing about enrolled keys or signed files
Once per machine, then every tool in the family is one pacman away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
sudo pacman-key --add /tmp/tui-tools.asc
sudo pacman-key --lsign-key \
"$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
| sudo tee -a /etc/pacman.conf
sudo pacman -Sy$ sudo pacman -S tui-secureUpgrades then arrive with the rest of your system updates.
$ paru -S tui-secure-binThe -bin package installs the released static binary.
Once per machine, then every tool in the family is one apt away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://pkgs.tui.tools/pubkey.asc \
| sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
| sudo tee /etc/apt/sources.list.d/tui-tools.list
sudo apt update$ sudo apt install tui-secureUpgrades then arrive with the rest of your system updates.
Once per machine, then every tool in the family is one dnf away.
$ curl -fsSL https://pkgs.tui.tools/install.sh | shA family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.
$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
sudo dnf makecache$ sudo dnf install tui-secureUpgrades then arrive with the rest of your system updates.
Needs the tui-tools repository, a one-time setup you do once per machine.
$ sudo zypper install tui-secureThe rpm repository is shared with dnf; zypper support is not tested yet.
$ curl -fsSL https://github.com/tui-tools/tui-secure/releases/download/v0.1.0/tui-secure_0.1.0_linux_amd64.tar.gz | tar -xz tui-secure
sudo install -m0755 tui-secure /usr/local/bin/tui-secure$ curl -fsSL https://github.com/tui-tools/tui-secure/releases/download/v0.1.0/tui-secure_0.1.0_linux_arm64.tar.gz | tar -xz tui-secure
sudo install -m0755 tui-secure /usr/local/bin/tui-secureOne static binary. Verify it against checksums.txt from the same release.
$ git clone https://github.com/tui-tools/tui-secure
cd tui-secure && make build
sudo install -m0755 bin/tui-secure /usr/local/bin/tui-secureNeeds Go 1.27 or newer.
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
Most probes read unprivileged. Escalation is sudo -n, which never prompts: it covers the reads only root can do (ufw status, sshd -T, /etc/shadow, sudo -l, the nftables ruleset) and the three offered fixes. A probe that cannot escalate reports unknown with the reason.
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
The update probe runs the distribution's own update check (checkupdates, apt-get -s upgrade, dnf check-update), which contacts the configured package repositories. tui-secure itself opens no connection.
Released statically linked, with no runtime dependencies to install.
Releases carry SHA-256 checksums but no signature. Verify the checksum, and read this as the open item it is.
Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.
| File | Size | SHA-256 |
|---|---|---|
| checksums.txt | 204 B | — |
| tui-secure_0.1.0_linux_amd64.tar.gz | 1.9 MB | 0155249fbbf69051afd24b42d9bba0ba4b9133b4f7e5e26d09c4496c8f61d4fe |
| tui-secure_0.1.0_linux_arm64.tar.gz | 1.7 MB | 88e129b44069313647c6006e7ca156e2de35f5b1c944604ccb9eae5d5bc66ef4 |
Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.
## Changelog * 5dc90ba63ada888548d488933f2a156290368403 Give it a face: the branding, six frames and the README * c88b946d7742b36472d82684d08e29c36b8a4117 Initial commit * ba9c696b4571b6f1d361b32ff47bb01fc10130ca Point the install line at v0.1.0 * aac2efff07610fc50ec9b580163f67e9dd524803 Prove it against a real machine, and record which one * 95ec8cf975f35dff981e890546967345579d41a8 Read the machine's posture: the model, the backend and its probes * 1e2288fb487f499f895d7e66a01c376cbecafb83 Start tui-secure from the family template * 970ac953a060e0e4752f796b52322e06e0fa7f73 The screens: the posture, one probe in full, and one confirm dialog