@topy-ai/maggie 0.7.55 → 0.7.57

package/bundled-tools/clis/maggie_security_host.py

@@ -0,0 +1,511 @@
+#!/usr/bin/env python3
+"""Host checks (docs/maggie-security/07-host-audit-prd.md):
+``host-quick``, ``host-audit``, ``host-nginx-config``.
+
+- ``host-quick``: a read-only evidence collector runs on the host (printed by
+  ``--print-collector`` for review; over SSH only with ``ssh-read`` consent)
+  and the checks run here. The check list and their logic are ported from
+  nuver-labs/vps-audit (MIT, Copyright (c) 2024 Israel Abebe Kokiso) with the
+  egress (``api.ipify.org``) and the report file removed, plus Maggie checks
+  (databases listening publicly, Docker bypassing UFW, time sync).
+- ``host-audit``: parses a lynis ``report.dat`` (lynis is GPL and runs on the
+  host as a separate program); over SSH it needs ``ssh-temp-write`` consent
+  and the host lock, uploads the pinned tarball to a private /tmp folder,
+  and removes it afterwards, verifying the removal.
+- ``host-nginx-config``: rules over ``nginx -T`` and ``php -i`` output
+  (ideas from the CIS NGINX benchmark; no third-party rule text).
+
+Nothing here changes the host's configuration.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import shlex
+import subprocess
+from pathlib import Path
+
+import maggie_security_core as core
+from maggie_host_runtime import COLLECTOR as RUNTIME_COLLECTOR, parse_sections
+
+QUICK_COLLECTOR = r"""set +e
+s() { printf '\n### %s\n' "$1"; }
+SUDO=""; [ "$(id -u)" != 0 ] && sudo -n true 2>/dev/null && SUDO="sudo -n"
+s os-release; cat /etc/os-release 2>/dev/null
+s sshd-T; $SUDO sshd -T 2>/dev/null | grep -Ei '^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication) '
+s sshd-config; cat /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null | grep -Ei '^\s*(port|permitrootlogin|passwordauthentication|include)\b'
+s reboot-required; [ -f /var/run/reboot-required ] && echo yes || echo no
+s ufw; $SUDO ufw status 2>/dev/null | head -3
+s firewalld; firewall-cmd --state 2>/dev/null
+s iptables; $SUDO iptables -S 2>/dev/null | grep -c -- '-A'
+s nftables; $SUDO nft list ruleset 2>/dev/null | grep -c 'chain'
+s unattended; dpkg-query -W -f='${Status}' unattended-upgrades 2>/dev/null; echo; cat /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null; rpm -q dnf-automatic 2>/dev/null
+s ips; for u in fail2ban crowdsec; do printf '%s %s\n' "$u" "$(systemctl is-active $u 2>/dev/null)"; done; $SUDO docker ps --format '{{.Image}}' 2>/dev/null | grep -Ei 'fail2ban|crowdsec'
+s f2b-jail; $SUDO fail2ban-client get sshd port 2>/dev/null; $SUDO cat /etc/fail2ban/jail.local /etc/fail2ban/jail.d/*.conf 2>/dev/null | grep -Ei '^\s*(\[|enabled|port|banaction)'
+s updates; apt-get -s upgrade 2>/dev/null | grep -E '^[0-9]+ upgraded'; apt-get -s upgrade 2>/dev/null | grep -c '^Inst .*-security'
+s listen; ss -H -tlnp 2>/dev/null || netstat -tln 2>/dev/null
+s docker-ports; $SUDO docker ps --format '{{.Names}}\t{{.Ports}}' 2>/dev/null
+s sudo-log; $SUDO grep -rhE '^Defaults.*(logfile|log_output)' /etc/sudoers /etc/sudoers.d 2>/dev/null | head -3
+s pwquality; grep -E '^\s*minlen\s*=' /etc/security/pwquality.conf 2>/dev/null | tail -1
+s disk; df -P / | awk 'NR==2 {print int($5)}'
+s mem; free | awk '/^Mem:/ {printf "%.0f\n", $3/$2*100}'
+s load; nproc; cut -d' ' -f1 /proc/loadavg
+s failed-logins; $SUDO grep -c 'Failed password' /var/log/auth.log 2>/dev/null || $SUDO grep -c 'Failed password' /var/log/secure 2>/dev/null
+s time-sync; timedatectl show -p NTPSynchronized --value 2>/dev/null || chronyc tracking 2>/dev/null | head -1
+s suid; timeout 45 find / -xdev -type f -perm -4000 2>/dev/null | grep -Ev '^(/usr/bin/|/bin/|/sbin/|/usr/sbin/|/usr/lib|/usr/libexec)' | grep -Ev '(ping|sudo|mount|umount|su|passwd|chsh|newgrp|gpasswd|chfn)$' | head -20
+"""
+
+DB_PORTS = {"3306": "MySQL/MariaDB", "5432": "PostgreSQL", "6379": "Redis", "11211": "Memcached", "27017": "MongoDB", "9200": "Elasticsearch",
+            "5984": "CouchDB", "9042": "Cassandra", "2375": "Docker API (no TLS)", "8086": "InfluxDB"}
+VPS_AUDIT = "nuver-labs/vps-audit (MIT)"
+
+
+def check(fid: str, title: str, severity: str, summary: str, *, kind: str = "host-hardening", host: str, ctx: core.Context,
+          evidence: str | None = None, steps: list[str] | None = None, asvs: list[str] | None = None) -> dict:
+    return core.make_finding(kind=kind, command=ctx.command, primary_id=fid, site=ctx.site, title=title, severity=severity, severity_source="maggie",
+                             confidence="confirmed", target={"host": host}, asvs_ids=asvs or [],
+                             evidence=[{"path": host, "excerpt": evidence}] if evidence else [], rule_id=fid,
+                             remediation={"summary": summary, "steps": steps or [], "snippets": [], "references": [], "cheat_sheet": None})
+
+
+def quick_checks(ctx: core.Context, sections: dict[str, str], host: str) -> list[dict]:
+    f: list[dict] = []
+    sec = lambda name: sections.get(name, "").strip()  # noqa: E731
+    effective = {}
+    for line in sec("sshd-T").splitlines():
+        parts = line.split(None, 1)
+        if len(parts) == 2:
+            effective[parts[0].lower()] = parts[1].strip().lower()
+    for line in sec("sshd-config").splitlines():
+        parts = line.strip().split(None, 1)
+        if len(parts) == 2 and parts[0].lower() not in effective and parts[0].lower() != "include":
+            effective.setdefault(parts[0].lower(), parts[1].strip().lower())  # first match wins, as sshd does
+    if sec("sshd-T") or sec("sshd-config"):
+        root = effective.get("permitrootlogin", "prohibit-password")
+        if root not in ("no", "prohibit-password", "without-password", "forced-commands-only"):
+            f.append(check("hq-ssh-root", "SSH allows root login with a password", "high", "Set `PermitRootLogin no` (or prohibit-password).", host=host, ctx=ctx,
+                           evidence=f"PermitRootLogin {root}", steps=["sudo sshd -t && sudo systemctl reload ssh"]))
+        if effective.get("passwordauthentication", "yes") != "no":
+            f.append(check("hq-ssh-password", "SSH accepts passwords (brute-force target)", "high",
+                           "Use SSH keys only: `PasswordAuthentication no` in /etc/ssh/sshd_config.d/, after confirming your key works.",
+                           host=host, ctx=ctx, evidence="PasswordAuthentication yes",
+                           steps=["Check you can log in with your key in a second session first", "sudo sshd -t && sudo systemctl reload ssh"]))
+        if effective.get("port", "22") == "22":
+            f.append(check("hq-ssh-port", "SSH listens on the default port 22", "info", "Optional: a non-default port only reduces log noise.", host=host, ctx=ctx))
+    else:
+        f.append(check("hq-ssh-unread", "SSH configuration could not be read", "info", "Run the collector with sudo for a complete check.", host=host, ctx=ctx))
+    ufw = sec("ufw").lower()
+    firewall = "status: active" in ufw or sec("firewalld") == "running" or _int(sec("iptables")) > 3 or _int(sec("nftables")) > 0
+    if not firewall:
+        f.append(check("hq-firewall", "No active firewall", "high", "Enable a firewall that allows only SSH, HTTP and HTTPS (e.g. ufw).", host=host, ctx=ctx,
+                       steps=["sudo ufw allow OpenSSH && sudo ufw allow 80,443/tcp && sudo ufw enable"]))
+    unattended = sec("unattended")
+    if "install ok installed" not in unattended and "dnf-automatic" not in unattended.replace("not installed", ""):
+        f.append(check("hq-unattended", "Automatic security updates are not set up", "medium", "Install and enable unattended-upgrades (Debian/Ubuntu) or dnf-automatic.",
+                       host=host, ctx=ctx, steps=["sudo apt install unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades"]))
+    updates = sec("updates").splitlines()
+    pending = _int(updates[0].split()[0]) if updates and updates[0].split() else 0
+    security = _int(updates[1]) if len(updates) > 1 else 0
+    if pending:
+        f.append(check("hq-updates", f"{pending} package updates pending ({security} security)", "medium" if security else "low",
+                       "Apply updates (sudo apt upgrade) in a maintenance window.", host=host, ctx=ctx))
+    if sec("reboot-required") == "yes":
+        f.append(check("hq-restart", "A restart is needed to finish updates (e.g. a new kernel)", "low", "Reboot in a quiet hour.", host=host, ctx=ctx))
+    ips_lines = [line.split() for line in sec("ips").lower().splitlines() if line.strip()]
+    unit_active = any(len(parts) == 2 and parts[0] in ("fail2ban", "crowdsec") and parts[1] == "active" for parts in ips_lines)
+    container = any(len(parts) == 1 and re.search(r"fail2ban|crowdsec", parts[0]) for parts in ips_lines)
+    if not (unit_active or container):
+        f.append(check("hq-ips", "No intrusion prevention (fail2ban or CrowdSec) is running", "medium",
+                       "Run `maggie security protect-plan` for a reviewed fail2ban/CrowdSec setup.", host=host, ctx=ctx))
+    jail = sec("f2b-jail")
+    ssh_port = effective.get("port", "22")
+    if jail and "allports" not in jail:
+        ports = re.findall(r"(?im)^\s*port\s*=\s*(\S+)", jail)
+        first = jail.splitlines()[0].strip() if jail else ""
+        jail_ports = set(re.split(r"[,\s]+", first if re.fullmatch(r"[\w,\s:]+", first) and not first.startswith("[") else (ports[0] if ports else "ssh")))
+        if ssh_port not in jail_ports and not ("ssh" in jail_ports and ssh_port == "22") and not any(":" in p for p in jail_ports):
+            f.append(check("hq-f2b-port", f"fail2ban guards port {', '.join(sorted(jail_ports))} but SSH listens on {ssh_port}: its bans do nothing",
+                           "medium", f"Set `port = {ssh_port}` in the [sshd] jail (jail.local) or use banaction = nftables[type=allports].",
+                           host=host, ctx=ctx, evidence=first[:120]))
+    public_db = []
+    for line in sec("listen").splitlines():
+        match = re.search(r"(\S+):(\d+)\s", line + " ")
+        if not match:
+            continue
+        address, port = match.group(1), match.group(2)
+        if port in DB_PORTS and address in ("0.0.0.0", "*", "[::]", "::"):
+            public_db.append(f"{DB_PORTS[port]} ({port})")
+    if public_db:
+        f.append(check("hq-ports", f"Database or admin port listens on every interface: {', '.join(sorted(set(public_db)))}", "high",
+                       "Bind it to 127.0.0.1 (or a private network) and keep it closed in the firewall.", host=host, ctx=ctx))
+    docker_ports = sec("docker-ports")
+    if "status: active" in ufw and re.search(r"0\.0\.0\.0:\d+->", docker_ports):
+        f.append(check("hq-docker-ufw", "Docker publishes container ports that bypass UFW rules", "high",
+                       "Publish on 127.0.0.1 (-p 127.0.0.1:8080:80) and put nginx in front, or use DOCKER-USER chain rules.", host=host, ctx=ctx,
+                       evidence=docker_ports.splitlines()[0][:150]))
+    suid = [line for line in sec("suid").splitlines() if line.strip()]
+    if suid:
+        f.append(check("hq-suid", f"{len(suid)} SUID programs outside the usual system folders", "low", "Check that each is expected.", host=host, ctx=ctx,
+                       evidence=", ".join(suid[:5])))
+    if not sec("sudo-log"):
+        f.append(check("hq-sudo-log", "sudo commands are not logged to a file", "low", "Add `Defaults logfile=/var/log/sudo.log` via visudo.", host=host, ctx=ctx))
+    minlen = re.search(r"minlen\s*=\s*(\d+)", sec("pwquality"))
+    if not minlen or int(minlen.group(1)) < 12:
+        f.append(check("hq-password-policy", "Weak or no password length policy", "low", "Set minlen = 12 in /etc/security/pwquality.conf.", host=host, ctx=ctx))
+    for fid, name, value in (("hq-disk", "Disk", _int(sec("disk"))), ("hq-mem", "Memory", _int(sec("mem")))):
+        if value >= 90:
+            f.append(check(fid, f"{name} use is {value}%", "low", "Free space or add capacity before it fills.", kind="availability", host=host, ctx=ctx))
+    load = sec("load").split()
+    if len(load) == 2 and _int(load[0]) and float(load[1]) > 2 * _int(load[0]):
+        f.append(check("hq-cpu", f"Load average {load[1]} on {load[0]} cores", "low", "Check what is using the CPU.", kind="availability", host=host, ctx=ctx))
+    failed = _int(sec("failed-logins"))
+    if failed > 100:
+        f.append(check("hq-failed-logins", f"{failed} failed SSH logins in the current auth log (attempts, not break-ins)", "info",
+                       "Expected on public servers; keys-only SSH and fail2ban make them harmless.", kind="attack-signal", host=host, ctx=ctx))
+    if sec("time-sync") and sec("time-sync").lower() not in ("yes",) and "leap status     : normal" not in sec("time-sync").lower():
+        f.append(check("hq-time-sync", "The clock is not synchronised (NTP)", "low", "Enable systemd-timesyncd or chrony; logs and TLS depend on time.",
+                       host=host, ctx=ctx))
+    return f
+
+
+def _int(text: str) -> int:
+    match = re.search(r"-?\d+", text or "")
+    return int(match.group(0)) if match else 0
+
+
+def ssh_run(target: str, script: str, timeout: int = 300) -> str:
+    proc = subprocess.run(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=15", target, "sh -s"], input=script, capture_output=True, text=True,
+                          timeout=timeout, check=False)
+    if proc.returncode not in (0, 1) and not proc.stdout:
+        raise core.DegradedError(f"ssh {target}: {core.clean_excerpt(proc.stderr, 200)}")
+    return proc.stdout
+
+
+def evidence_text(ctx: core.Context, collector: str) -> tuple[str, str]:
+    args = ctx.args
+    if args.evidence:
+        path = Path(args.evidence)
+        if not path.is_file():
+            raise core.UsageError(f"file not found: {path}")
+        return path.read_text(encoding="utf-8", errors="replace"), args.host or path.stem
+    if args.ssh:
+        alias, _, target = args.ssh.partition("=")
+        if not target:
+            raise core.UsageError("--ssh takes ALIAS=user@host")
+        core.require_consent(ctx.state, alias, "ssh-read")
+        text = ssh_run(target, collector)
+        out = ctx.state.path("inventory", f"host-{alias}-{ctx.command}.txt")
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(text, encoding="utf-8")
+        return text, alias
+    raise core.UsageError("give --evidence FILE (collector output) or --ssh ALIAS=user@host; see --print-collector")
+
+
+def host_quick(ctx: core.Context):
+    if ctx.args.print_collector:
+        return {"_raw": QUICK_COLLECTOR}
+    text, host = evidence_text(ctx, QUICK_COLLECTOR)
+    sections = parse_sections(text)
+    if not sections:
+        raise core.UsageError("the evidence has no '### section' blocks; run the collector from --print-collector")
+    findings = quick_checks(ctx, sections, host)
+    ctx.run["inputs"].update({"host": host, "checks_from": VPS_AUDIT})
+    return ctx.finish(findings, covered=[f"host:{host}", "*"])
+
+
+# --------------------------------------------------------------------------- host-audit (lynis report.dat)
+
+
+def parse_lynis(text: str) -> dict:
+    data: dict = {"warning": [], "suggestion": [], "vulnerable_package": [], "firewall_software": [], "malware_scanner": []}
+    for line in text.splitlines():
+        if "=" not in line or line.startswith("#"):
+            continue
+        key, _, value = line.partition("=")
+        if key.endswith("[]"):
+            data.setdefault(key[:-2], []).append(value)
+        else:
+            data[key] = value
+    return data
+
+
+LYNIS_HIGH_PREFIX = ("SSH-", "FIRE-", "AUTH-")
+LYNIS_COSMETIC = {"BANN-7126", "BANN-7130", "LYNIS"}
+
+
+def lynis_findings(ctx: core.Context, data: dict, host: str) -> list[dict]:
+    findings = []
+    for kind_key, base in (("warning", "medium"), ("suggestion", "low")):
+        for entry in data.get(kind_key, []):
+            parts = entry.split("|")
+            test = parts[0] if parts else "LYNIS"
+            message = parts[1] if len(parts) > 1 else entry
+            details = parts[2] if len(parts) > 2 and parts[2] not in ("-", "") else ""
+            solution = parts[3] if len(parts) > 3 and parts[3] not in ("-", "") else ""
+            severity = "high" if kind_key == "warning" and test.startswith(LYNIS_HIGH_PREFIX) else base
+            if test in LYNIS_COSMETIC:
+                severity = "info"
+            findings.append(core.make_finding(
+                kind="host-hardening", command="host-audit", primary_id=f"lynis-{test}-{core.sha256_bytes(message.encode())[:8]}", site=ctx.site,
+                title=f"{test}: {core.clean_excerpt(message, 200)}", severity=severity, severity_source="tool", confidence="likely",
+                target={"host": host}, tool="lynis", rule_id=test,
+                evidence=[{"path": host, "excerpt": core.clean_excerpt(details, 200)}] if details else [],
+                remediation={"summary": f"lynis suggests: {core.clean_excerpt(solution, 300)}" if solution else "See the lynis control for this test.",
+                             "steps": [], "snippets": [], "references": [f"https://cisofy.com/lynis/controls/{test}/"], "cheat_sheet": None}))
+    for package in data.get("vulnerable_package", []):
+        findings.append(core.make_finding(
+            kind="vulnerability", command="host-audit", primary_id=f"lynis-vulnerable-package-{package}", site=ctx.site,
+            title=f"lynis reports a vulnerable package: {package}", severity="medium", severity_source="tool", confidence="likely",
+            affected={"purl": None, "ecosystem": None, "name": package, "version": None, "component_type": "os", "direct": None, "scope": "os"},
+            target={"host": host}, tool="lynis", rule_id="PKGS-7392",
+            remediation={"summary": f"Update {package}; `maggie security vuln-watch` with this host's evidence shows the CVEs.", "steps": [], "snippets": [],
+                         "references": [], "cheat_sheet": None}))
+    return findings
+
+
+LYNIS_PROFILE = """# Maggie lynis profile: no upload, skip tests that do not apply to web servers
+upload=no
+skip-test=PRNT-2307
+skip-test=PRNT-2308
+skip-test=STRG-1840
+skip-test=STRG-1842
+skip-test=NAME-4402
+skip-test=NAME-4404
+skip-test=KRB-5108
+skip-test=LDAP-2219
+skip-test=STRG-1902
+"""
+
+
+def host_audit(ctx: core.Context):
+    args = ctx.args
+    if args.evidence:
+        path = Path(args.evidence)
+        if not path.is_file():
+            raise core.UsageError(f"file not found: {path}")
+        data = parse_lynis(path.read_text(encoding="utf-8", errors="replace"))
+        host = args.host or "host"
+    else:
+        if not args.ssh:
+            raise core.UsageError("give --evidence report.dat, or --ssh ALIAS=user@host (needs ssh-temp-write consent)")
+        alias, _, target = args.ssh.partition("=")
+        core.require_consent(ctx.state, alias, "ssh-temp-write")
+        data = remote_lynis(ctx, alias, target)
+        host = alias
+    findings = lynis_findings(ctx, data, host)
+    index = data.get("hardening_index")
+    ctx.run["inputs"].update({"host": host, "lynis_version": data.get("lynis_version"), "hardening_index": int(index) if str(index).isdigit() else None,
+                              "firewall_software": data.get("firewall_software"), "malware_scanner": data.get("malware_scanner")})
+    ctx.run["tools"].append({"name": "lynis", "version": data.get("lynis_version"), "sha256": None})
+    return ctx.finish(findings, covered=[f"host:{host}", "*"])
+
+
+def remote_lynis(ctx: core.Context, alias: str, target: str) -> dict:
+    """Upload the pinned lynis tarball to a private /tmp folder, run it, copy report.dat back, remove the folder and verify."""
+    import maggie_host_runtime as runtime
+
+    spec = ctx.lock["tools"]["lynis"]
+    asset = (spec.get("assets") or {}).get("any")
+    if not asset or asset.get("sha256") in (None, "UNPINNED"):
+        raise core.ToolError("lynis has no pinned tarball in the tools lock yet; run lynis yourself and pass --evidence report.dat")
+    tarball = core.tools_cache_dir() / "lynis" / spec["version"] / "lynis.tar.gz"
+    if not tarball.is_file():
+        status, _h, body = core.http_request(asset["url"], timeout=300)
+        if status != 200 or core.sha256_bytes(body) != asset["sha256"]:
+            raise core.ToolError("lynis tarball download failed or its sha256 does not match the lock")
+        tarball.parent.mkdir(parents=True, exist_ok=True)
+        tarball.write_bytes(body)
+    elif core.sha256_file(tarball) != asset["sha256"]:
+        raise core.ToolError("cached lynis tarball does not match the lock")
+    session = f"maggie-security-{ctx.run['id'][-4:]}"
+    lock_path = "/run/lock/maggie-agent-host.lock"  # the same lock `maggie deployment host-lock` uses
+    lock = runtime.host_lock("acquire", target, session, 1800, "security host-audit", False, 60, lock_path, runtime.WATCH if hasattr(runtime, "WATCH") else [], [])
+    if lock.get("result") not in ("acquired", "mine"):
+        raise core.PolicyError(f"host lock is held by another session: {json.dumps(lock)[:300]}")
+    remote_dir = f"/tmp/maggie-lynis-{ctx.run['id'][-4:]}"
+    try:
+        subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"umask 077 && mkdir -p {remote_dir}"], check=True, timeout=60)
+        subprocess.run(["scp", "-q", "-o", "BatchMode=yes", str(tarball), f"{target}:{remote_dir}/lynis.tar.gz"], check=True, timeout=300)
+        profile = shlex.quote(LYNIS_PROFILE)
+        script = (f"cd {remote_dir} && tar xzf lynis.tar.gz && printf %s {profile} > maggie.prf && cd lynis && "
+                  f"$( [ $(id -u) != 0 ] && sudo -n true 2>/dev/null && echo sudo -n ) ./lynis audit system --quick --no-colors --no-log "
+                  f"--profile {remote_dir}/maggie.prf --report-file {remote_dir}/report.dat --logfile /dev/null >/dev/null 2>&1; cat {remote_dir}/report.dat")
+        proc = subprocess.run(["ssh", "-o", "BatchMode=yes", target, script], capture_output=True, text=True, timeout=1800, check=False)
+        report = proc.stdout
+    finally:
+        subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"rm -rf {remote_dir}"], timeout=60, check=False)
+        gone = subprocess.run(["ssh", "-o", "BatchMode=yes", target, f"test ! -e {remote_dir}"], timeout=60, check=False).returncode == 0
+        ctx.run["inputs"]["remote_cleanup"] = "verified" if gone else "failed"
+        runtime.host_lock("release", target, session, 0, "", False, 60, lock_path, [], [])
+    if not report.strip():
+        raise core.DegradedError("lynis produced no report")
+    return parse_lynis(report)
+
+
+# --------------------------------------------------------------------------- host-nginx-config
+
+
+NGINX_EXTRA = RUNTIME_COLLECTOR + r"""
+s php-i; php -i 2>/dev/null | grep -Ei '^(expose_php|allow_url_include|allow_url_fopen|display_errors|disable_functions|session.cookie_secure|session.cookie_httponly|session.use_strict_mode) '
+s key-perms; for k in $($SUDO nginx -T 2>/dev/null | awk '/ssl_certificate_key/ {gsub(";",""); print $2}' | sort -u); do $SUDO stat -c '%a %U %n' "$k" 2>/dev/null; done
+"""
+
+
+def server_blocks(text: str) -> list[dict]:
+    """Split `nginx -T` output (or a config file) into server blocks with their locations."""
+    blocks = []
+    current_file = ""
+    clean = []
+    for line in text.splitlines():
+        if line.startswith("# configuration file "):
+            current_file = line[len("# configuration file "):].rstrip(":")
+            clean.append(f"__FILE__ {current_file};")
+            continue
+        clean.append(line.split("#", 1)[0] if not line.strip().startswith("#") else "")
+    body = "\n".join(clean)
+    for match in re.finditer(r"\bserver\s*\{", body):
+        depth, i = 1, match.end()
+        while i < len(body) and depth:
+            depth += {"{": 1, "}": -1}.get(body[i], 0)
+            i += 1
+        content = body[match.end():i - 1]
+        before = body[:match.start()]
+        file_match = re.findall(r"__FILE__ ([^;]+);", before)
+        top = re.sub(r"\blocation\b[^{]*\{(?:[^{}]|\{[^{}]*\})*\}", "", content)
+        blocks.append({"file": file_match[-1] if file_match else "", "text": content, "top": top,
+                       "names": re.findall(r"server_name\s+([^;]+);", content)[:1],
+                       "listen": re.findall(r"listen\s+([^;]+);", top),
+                       "locations": re.findall(r"\blocation\s+([^{]*)\{((?:[^{}]|\{[^{}]*\})*)\}", content)})
+    return blocks
+
+
+def nginx_findings(ctx: core.Context, nginx: str, php: str, key_perms: str, host: str) -> list[dict]:
+    findings = []
+    seen = set()
+
+    def add(fid: str, title: str, severity: str, summary: str, snippet: str | None = None, where: str = "", asvs: list[str] | None = None) -> None:
+        key = (fid, where)
+        if key in seen:
+            return
+        seen.add(key)
+        findings.append(core.make_finding(kind="misconfiguration", command="host-nginx-config", primary_id=fid, site=ctx.site,
+                                          title=title + (f" ({where})" if where else ""), severity=severity, severity_source="maggie",
+                                          confidence="likely", target={"host": host, "path": where or None}, asvs_ids=asvs or [], rule_id=fid,
+                                          remediation={"summary": summary, "steps": ["sudo nginx -t && sudo systemctl reload nginx"],
+                                                       "snippets": [{"kind": "nginx", "text": snippet}] if snippet else [],
+                                                       "references": ["https://nginx.org/en/docs/"], "cheat_sheet": None}))
+
+    http_level = re.sub(r"\bserver\s*\{(?:[^{}]|\{(?:[^{}]|\{[^{}]*\})*\})*\}", "", nginx)
+    if not re.search(r"(?m)^\s*server_tokens\s+off\s*;", nginx):
+        add("ngx-server-tokens", "nginx shows its version (server_tokens is not off)", "low", "Add `server_tokens off;` in the http block.", "server_tokens off;", asvs=["V13.4.6"])
+    if re.search(r"(?m)^\s*autoindex\s+on\s*;", nginx):
+        add("ngx-autoindex", "Directory listing is on (autoindex on)", "medium", "Remove `autoindex on;`.", asvs=["V13.4.3"])
+    for block in server_blocks(nginx):
+        name = (block["names"][0].split()[0] if block["names"] else "_")
+        where = f"{name} in {block['file']}" if block["file"] else name
+        text, top = block["text"], block["top"]
+        tls = any("ssl" in listen or "443" in listen for listen in block["listen"])
+        plain = any(re.match(r"^(\[::\]:|0\.0\.0\.0:)?80\b", listen.strip()) for listen in block["listen"])
+        has_root = re.search(r"(?m)^\s*root\s+\S+;", text)
+        locations = block["locations"]
+        if plain and not tls and not re.search(r"return\s+30[18]\s+https://", text) and has_root:
+            add("ngx-https-redirect", "Plain HTTP is served instead of redirected to HTTPS", "medium",
+                "Redirect port 80 to HTTPS (keep /.well-known/acme-challenge/ if you use HTTP-01).", "return 301 https://$host$request_uri;", where, ["V12.2.1"])
+        if has_root and not any(re.search(r"~\*?\s*/\\\.", loc[0]) or "/\\." in loc[0] for loc in locations):
+            add("ngx-dotfiles", "Hidden files (.git, .env) can be served", "high", "Deny hidden files except .well-known.",
+                "location ~ /\\.(?!well-known) { deny all; }", where, ["V13.4.1"])
+        php_site = "fastcgi_pass" in text
+        if php_site and not any(re.search(r"(uploads|files)", loc[0]) and "deny" in loc[1] for loc in locations):
+            add("ngx-php-uploads", "PHP files in upload folders can be executed", "high", "Deny .php under upload folders.",
+                "location ~* /(?:uploads|files)/.*\\.php$ { deny all; }", where, ["V5.3.2"])
+        if php_site and "fastcgi_split_path_info" in text and not re.search(r"try_files\s+\$uri\s*=404|try_files\s+\$fastcgi_script_name\s*=404", text):
+            add("ngx-fastcgi-split", "PATH_INFO handling without a file check can run uploaded files as PHP", "high",
+                "Add `try_files $fastcgi_script_name =404;` in the PHP location.", "try_files $fastcgi_script_name =404;", where, ["V5.3.2"])
+        if php_site and not re.search(r"(env|git|bak|old|sql|swp|ini|log)", " ".join(loc[0] for loc in locations)):
+            add("ngx-sensitive-ext", "Backup and config files (.sql, .bak, .env, .log) are not blocked", "medium", "Deny sensitive extensions.",
+                "location ~* \\.(?:bak|old|sql|swp|ini|log|env)$ { deny all; }", where, ["V13.4.1"])
+        if tls:
+            protocols = re.findall(r"ssl_protocols\s+([^;]+);", text + http_level)
+            if protocols and re.search(r"\b(SSLv3|TLSv1|TLSv1\.1)\b", protocols[0].replace("TLSv1.2", "").replace("TLSv1.3", "")):
+                add("ngx-tls-protocols", f"Old TLS versions allowed ({protocols[0].strip()})", "high", "Allow only TLS 1.2 and 1.3.",
+                    "ssl_protocols TLSv1.2 TLSv1.3;", where, ["V12.1.1"])
+            ciphers = re.findall(r"ssl_ciphers\s+([^;]+);", text + http_level)
+            if ciphers and re.search(r"(?<![!-])\b(RC4|3DES|DES-|MD5|NULL|EXPORT|aNULL)", ciphers[0]):
+                add("ngx-tls-ciphers", "Weak TLS ciphers allowed", "high", "Use the Mozilla intermediate cipher list.", where=where, asvs=["V12.1.2"])
+            if "strict-transport-security" not in (text + http_level).lower():
+                add("ngx-hsts", "No HSTS header in this HTTPS server (unless your CDN adds it)", "medium", "Add HSTS.",
+                    'add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;', where, ["V3.4.1"])
+            server_headers = re.findall(r"add_header\s+(\S+)", top + http_level)
+            for loc, loc_body in locations:
+                if "add_header" in loc_body and server_headers:
+                    add("ngx-add-header-inherit", f"location {loc.strip()} sets its own add_header, which drops the server's security headers there", "medium",
+                        "Repeat the security headers inside that location (nginx does not merge add_header levels).", where=where, asvs=["V3.4.1"])
+                    break
+        if re.search(r"wp-login\.php|wordpress|wp-content", text) and not re.search(r"limit_req\b", text):
+            add("ngx-limit-req", "WordPress login is not rate limited", "medium", "Rate limit wp-login.php and xmlrpc.php.",
+                "limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;\nlocation = /wp-login.php { limit_req zone=login burst=5 nodelay; include fastcgi_params; fastcgi_pass php; }",
+                where)
+            if not re.search(r"xmlrpc\.php", " ".join(loc[0] for loc in locations)):
+                add("ngx-xmlrpc", "WordPress xmlrpc.php is reachable (brute-force and pingback abuse)", "medium", "Deny it unless Jetpack or the app needs it.",
+                    "location = /xmlrpc.php { deny all; }", where)
+        if re.search(r"(?m)^\s*access_log\s+off\s*;", top):
+            add("ngx-access-log", "Access logging is off for a public server", "medium", "Keep access logs (security checks and incident response need them).", where=where)
+        if "proxy_pass" in text and "proxy_hide_header" not in text + http_level and "x-powered-by" not in (text + http_level).lower():
+            add("ngx-proxy-hide", "The app's X-Powered-By header is passed through", "low", "Hide it.", "proxy_hide_header X-Powered-By;", where, ["V13.4.6"])
+    if re.search(r"(?m)^\s*error_log\s+\S+\s+debug\s*;", nginx):
+        add("ngx-error-log-level", "error_log is at debug level", "low", "Use `warn` or `error` in production.")
+    if "set_real_ip_from" not in nginx and re.search(r"cloudflare|cf-connecting-ip", nginx, re.I) is None and "proxy_protocol" not in nginx:
+        pass  # cannot tell whether a CDN sits in front from config alone; `headers` reports the edge
+    php_values = dict(re.findall(r"(?m)^(\S+)\s*=>\s*(\S+)", php))
+    if php_values:
+        if php_values.get("expose_php", "").lower() == "on":
+            add("php-expose", "PHP announces its version (expose_php = On)", "low", "Set expose_php = Off in php.ini.", asvs=["V13.4.6"])
+        if php_values.get("allow_url_include", "").lower() == "on":
+            add("php-url-include", "PHP allows including remote URLs (allow_url_include = On)", "high", "Set allow_url_include = Off.")
+        if php_values.get("display_errors", "").lower() in ("on", "1", "stdout"):
+            add("php-display-errors", "PHP shows errors to visitors (display_errors = On)", "medium", "Set display_errors = Off and log errors instead.",
+                asvs=["V13.4.2"])
+    for line in key_perms.splitlines():
+        parts = line.split(None, 2)
+        if len(parts) == 3 and (int(parts[0][-1]) > 0 or int(parts[0][-2]) > 4 or parts[1] != "root"):
+            add("ngx-tls-key-perms", f"TLS private key is readable by others ({parts[0]} {parts[1]})", "high", "chmod 600 the key and chown root.",
+                where=parts[2], asvs=["V13.3.1"])
+    return findings
+
+
+def host_nginx_config(ctx: core.Context):
+    if ctx.args.print_collector:
+        return {"_raw": NGINX_EXTRA}
+    text, host = evidence_text(ctx, NGINX_EXTRA)
+    sections = parse_sections(text)
+    nginx = sections.get("nginx-T", "") if sections else text
+    if not nginx.strip():
+        raise core.UsageError("no nginx configuration in the evidence (need the `nginx -T` section or a config file)")
+    findings = nginx_findings(ctx, nginx, sections.get("php-i", ""), sections.get("key-perms", ""), host)
+    ctx.run["inputs"].update({"host": host, "server_blocks": len(server_blocks(nginx))})
+    return ctx.finish(findings, covered=[f"host:{host}", "*"])
+
+
+def _quick(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--ssh", help="ALIAS=user@host (needs ssh-read consent)")
+    p.add_argument("--evidence", help="saved collector output")
+    p.add_argument("--host", help="host alias for --evidence")
+    p.add_argument("--print-collector", action="store_true", help="print the read-only collector script to review")
+
+
+def _audit(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--ssh", help="ALIAS=user@host (needs ssh-temp-write consent and takes the host lock)")
+    p.add_argument("--evidence", help="a lynis report.dat")
+    p.add_argument("--host", help="host alias for --evidence")
+
+
+COMMANDS = [
+    core.Command("host-quick", "quick server hardening check: SSH, firewall, updates, intrusion prevention, open database ports (read-only)", [],
+                 _quick, host_quick),
+    core.Command("host-audit", "deep server audit with lynis (temporary upload, removed after; host lock)", ["github-releases"], _audit, host_audit,
+                 routine_safe=False),
+    core.Command("host-nginx-config", "nginx and PHP configuration rules (hidden files, PHP in uploads, TLS, headers, rate limits)", [], _quick,
+                 host_nginx_config),
+]

package/bundled-tools/clis/maggie_security_hosted.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""``maggie security hosted-job``: the CMO.so server job for the hosted daily watch
+(docs/maggie-security/11-mcp-tools-prd.md section 9, 12-workflows-prd.md section 5).
+
+The backend stores each workspace's ``maggie-security-stack-upload.v1`` and,
+once a day per opted-in workspace (spread over 05:07–05:53 UTC), runs:
+
+    maggie security hosted-job --stack-upload STACK.json --state-dir DIR/<workspace> --workspace example.com
+
+It needs no project files: it matches the uploaded names and versions against
+OSV, Node security advisories, WPVulnerability, the CVE delta, KEV and EPSS,
+keeps the ledger per workspace under ``--state-dir``, enforces the per-workspace
+daily caps (PRD 11 section 9) and writes a ``report_save`` payload only when
+something is new (otherwise a one-line "nothing new" result). The backend sends
+that payload with its own report inbox code; this command never holds
+credentials and never sends anything itself.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+import maggie_security_core as core
+
+DAILY_CAPS = {"vuln_watch": 4, "headers_check": 20, "tls_check": 10, "osv_query": 200, "wp_check": 50}
+
+
+def take_cap(state: core.State, workspace: str, tool: str) -> int:
+    """Count one use of a capped tool for today; raises PolicyError over the cap."""
+    path = state.path("caps.json")
+    data = core.read_json(path) if path.is_file() else {}
+    today = core.iso()[:10]
+    if data.get("date") != today:
+        data = {"date": today, "workspace": workspace, "used": {}}
+    used = data["used"].get(tool, 0)
+    if used >= DAILY_CAPS[tool]:
+        raise core.PolicyError(f"daily cap reached for {tool} on {workspace} ({DAILY_CAPS[tool]}/day)")
+    data["used"][tool] = used + 1
+    core.write_json(path, data)
+    return used + 1
+
+
+def stack_from_upload(upload: dict) -> dict:
+    components = [{"purl": core.make_purl(c["ecosystem"], c["name"], c["version"]), "ecosystem": c["ecosystem"], "name": c["name"], "version": c["version"],
+                   "scope": c.get("scope") or "runtime", "direct": c.get("direct"), "location": "uploaded stack"} for c in upload["components"]]
+    import maggie_security_versions as versions
+
+    runtimes = [{"name": r["name"], "version": r["version"], "cycle": versions.cycle_of(r["version"]), "host": r.get("host"), "source": "uploaded stack"}
+                for r in upload["runtimes"]]
+    return {"schema": "maggie-security-stack.v1", "site": {"id": upload["workspace"], "type": upload.get("site_type") or "unknown", "domains": [upload["workspace"]],
+                                                           "hosting": None},
+            "collected_at": upload["created_at"], "hash": upload["hash"], "sources": [{"kind": "manual", "path": "uploaded stack"}],
+            "components": components, "runtimes": runtimes, "wordpress": upload.get("wordpress"), "images": [],
+            "hosts": [{"id": h, "os": None, "public": True} for h in sorted({r["host"] for r in runtimes if r.get("host")})],
+            "watch": {"products": upload.get("watch") or []}}
+
+
+def hosted_job(ctx: core.Context) -> dict:
+    args = ctx.args
+    upload = core.read_json(Path(args.stack_upload))
+    errors = core.validate_contract(upload, "stack-upload-v1")
+    if errors:
+        raise core.UsageError("stack upload failed its contract: " + "; ".join(errors[:5]))
+    if args.workspace and upload["workspace"] != args.workspace:
+        raise core.PolicyError("the upload belongs to another workspace")
+    state_dir = Path(args.state_dir)
+    state_dir.mkdir(parents=True, exist_ok=True)
+    # Run everything against the workspace's own state folder, never a project tree.
+    ctx.project = state_dir.resolve()
+    ctx.state = core.State(ctx.project)
+    ctx.site = upload["workspace"]
+    ctx.cache = core.FeedCache(ctx.state, ctx.guard)
+    ctx.run = core.new_run("vuln-watch", ctx.site, {"hosted": True, "stack_hash": upload["hash"]})
+    used = take_cap(ctx.state, upload["workspace"], "vuln_watch")
+    stack = stack_from_upload(upload)
+    core.write_json(ctx.state.path("inventory", "stack.json"), stack)
+    import maggie_security_intel as intel
+
+    ctx.args = argparse.Namespace(**{**vars(args), "rebuild_inventory": False, "sources": args.sources, "advisory_out": str(ctx.state.path("advisories")),
+                                     "cve_budget": 1500, "wp_budget": 300, "no_epss": False, "full_rematch": False, "since": args.since})
+    doc = intel.vuln_watch(ctx)
+    new = [f for f in doc["findings"] if f["status"] == "new"]
+    escalated = [f for f in new if f.get("change") == "escalated"]
+    result = {"schema": "maggie-security-hosted-job.v1", "workspace": upload["workspace"], "run": doc["run"]["id"], "cap_used": used,
+              "cap": DAILY_CAPS["vuln_watch"], "new": len(new), "open": doc["summary"]["open"], "degraded": doc["run"]["degraded"]}
+    if not new:
+        result["report_save"] = None
+        result["line"] = f"Nothing new for {upload['workspace']} today" + (f" (incomplete: {', '.join(doc['run']['degraded'])})" if doc["run"]["degraded"] else "") + "."
+        return result
+    import maggie_security_report as report
+
+    ctx.args = argparse.Namespace(**{**vars(ctx.args), "kind": "daily_ops", "audience": "owner", "save": True, "runs": [doc["run"]["id"]], "since": "48h",
+                                     "level": 1, "incident": None, "output": None, "fail_on": None, "ci": False})
+    built = report.build(ctx)
+    if not built["check"]["passed"]:
+        raise core.PolicyError("report failed report-check: " + "; ".join(built["check"]["errors"]))
+    payload = core.read_json(Path(built["report_save"]["payload"]))
+    payload["data"]["findings_set"] = {"schema": doc["schema"], "run": doc["run"]["id"], "new": [f["id"] for f in new]}
+    result.update({"report_save": payload, "escalated": len(escalated),
+                   "notify": any(f["priority"] in ("p0", "p1") for f in new) or bool(escalated)})
+    return result
+
+
+def configure(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--stack-upload", required=True, help="maggie-security-stack-upload.v1 file for one workspace")
+    p.add_argument("--state-dir", required=True, help="the workspace's own state folder (ledger, feeds cache, caps)")
+    p.add_argument("--workspace", help="expected workspace; refuses an upload for another one")
+    p.add_argument("--sources", help="as vuln-watch --sources")
+
+
+COMMANDS = [core.Command("hosted-job", "CMO.so server job: daily watch on an uploaded stack, with caps; returns a report_save payload when something is new",
+                         ["osv-api", "kev", "node-core", "wpvulnerability", "cvelistv5-zip", "cvelistv5-delta", "cvelistv5-record", "epss", "eol"],
+                         configure, hosted_job, findings=False, routine_safe=False)]