unifly-audit

UniFi Security Audit

Perform a security-focused audit of the UniFi configuration.

Execution

Run each check and compile findings into a security report.

1. WiFi Security Check

Identify SSIDs with weak or no security:

unifly wifi list -p {{profile}} -o json | jq '[
  .[] | {
    name,
    security,
    enabled,
    alert: (if .security == "open" then "CRITICAL: Open network"
            elif .security == "wpa2-personal" then "MODERATE: WPA2 only"
            else "OK" end)
  } | select(.alert != "OK")
]'

2. Firewall Policy Review

Check for overly permissive rules:

# All allow rules
unifly firewall policies list -p {{profile}} -o json | jq '[
  .[] | select(.action == "ALLOW") | {id, description, source_zone, dest_zone}
]'

# Rules without logging
unifly firewall policies list -p {{profile}} -o json | jq '[
  .[] | select(.logging == false) | {id, description, action}
]'

3. Device Firmware Check

Identify devices with outdated firmware:

unifly devices list --all -p {{profile}} -o json | jq '[
  .[] | select(.upgrade_available == true) | {name, mac, model, current_version}
]'

4. Network Isolation Check

Verify IoT and guest networks are properly isolated:

unifly networks list --all -p {{profile}} -o json | jq '[
  .[] | {name, vlan_id, isolation}
]'

5. Unused Resources

Find networks with no cross-references:

unifly networks list --all -p {{profile}} -o json

For each network, check unifly networks refs <id> for cross-references.

When -p {{profile}} is provided, the -p {{profile}} flag is already wired into every command above; no further substitution is needed.

Result Reporting

Compile findings into a report with severity levels:

• CRITICAL: Open WiFi networks, no firewall between zones
• HIGH: WPA2-only networks, allow-all firewall rules, no logging
• MODERATE: Outdated firmware, unused networks
• INFO: Network isolation status, device counts