openclaw-node-harness 2.0.0

package/skills/prompt-guard/scripts/audit.py

@@ -0,0 +1,344 @@
+#!/usr/bin/env python3
+"""
+Security Audit Script for Clawdbot
+Checks system configuration for security issues.
+"""
+
+import os
+import sys
+import json
+import stat
+import argparse
+from pathlib import Path
+from typing import Dict, List, Tuple
+
+
+class SecurityAudit:
+    def __init__(self):
+        self.issues: List[Dict] = []
+        self.warnings: List[Dict] = []
+        self.passed: List[str] = []
+        
+    def check_file_permissions(self, path: str, expected_mode: int, description: str) -> bool:
+        """Check if file has correct permissions."""
+        p = Path(path).expanduser()
+        if not p.exists():
+            self.warnings.append({
+                'check': description,
+                'status': 'skip',
+                'message': f'{path} does not exist'
+            })
+            return True
+        
+        current_mode = stat.S_IMODE(p.stat().st_mode)
+        if current_mode != expected_mode:
+            self.issues.append({
+                'check': description,
+                'status': 'fail',
+                'message': f'{path} has mode {oct(current_mode)}, expected {oct(expected_mode)}',
+                'fix': f'chmod {oct(expected_mode)[2:]} {path}'
+            })
+            return False
+        
+        self.passed.append(f'{description}: {path} = {oct(current_mode)}')
+        return True
+    
+    def check_dir_permissions(self, path: str, expected_mode: int, description: str) -> bool:
+        """Check if directory has correct permissions."""
+        return self.check_file_permissions(path, expected_mode, description)
+    
+    def check_config_not_in_sync(self) -> bool:
+        """Check that config isn't in cloud sync folders."""
+        clawdbot_path = Path('~/.clawdbot').expanduser().resolve()
+        
+        sync_folders = [
+            Path('~/Library/Mobile Documents').expanduser(),  # iCloud
+            Path('~/Dropbox').expanduser(),
+            Path('~/Google Drive').expanduser(),
+            Path('~/OneDrive').expanduser(),
+        ]
+        
+        for sync_folder in sync_folders:
+            if sync_folder.exists():
+                try:
+                    if clawdbot_path.is_relative_to(sync_folder):
+                        self.issues.append({
+                            'check': 'Config not in cloud sync',
+                            'status': 'fail',
+                            'message': f'~/.clawdbot is inside {sync_folder}!',
+                            'fix': 'Move ~/.clawdbot outside of cloud sync folders'
+                        })
+                        return False
+                except ValueError:
+                    pass  # Not relative, which is good
+        
+        self.passed.append('Config not in cloud sync folders')
+        return True
+    
+    def check_gateway_config(self) -> bool:
+        """Check gateway security settings."""
+        config_path = Path('~/.clawdbot/clawdbot.json').expanduser()
+        if not config_path.exists():
+            self.warnings.append({
+                'check': 'Gateway config',
+                'status': 'skip',
+                'message': 'clawdbot.json not found'
+            })
+            return True
+        
+        try:
+            with open(config_path) as f:
+                config = json.load(f)
+        except Exception as e:
+            self.issues.append({
+                'check': 'Gateway config',
+                'status': 'fail',
+                'message': f'Cannot parse config: {e}'
+            })
+            return False
+        
+        gateway = config.get('gateway', {})
+        all_good = True
+        
+        # Check bind
+        bind = gateway.get('bind', 'loopback')
+        if bind not in ['loopback', '127.0.0.1', 'localhost']:
+            if bind in ['0.0.0.0', '::']:
+                self.issues.append({
+                    'check': 'Gateway bind',
+                    'status': 'fail',
+                    'message': f'Gateway bound to {bind} (publicly accessible!)',
+                    'fix': 'Set gateway.bind to "loopback" in config'
+                })
+                all_good = False
+            else:
+                self.warnings.append({
+                    'check': 'Gateway bind',
+                    'status': 'warn',
+                    'message': f'Gateway bound to {bind}'
+                })
+        else:
+            self.passed.append(f'Gateway bind: {bind} (local only)')
+        
+        # Check auth
+        auth = gateway.get('auth', {})
+        auth_mode = auth.get('mode', 'none')
+        if auth_mode == 'none':
+            self.issues.append({
+                'check': 'Gateway auth',
+                'status': 'fail',
+                'message': 'Gateway has no authentication!',
+                'fix': 'Set gateway.auth.mode to "token" in config'
+            })
+            all_good = False
+        else:
+            self.passed.append(f'Gateway auth: {auth_mode}')
+        
+        return all_good
+    
+    def check_telegram_policy(self) -> bool:
+        """Check Telegram DM/group policies."""
+        config_path = Path('~/.clawdbot/clawdbot.json').expanduser()
+        if not config_path.exists():
+            return True
+        
+        try:
+            with open(config_path) as f:
+                config = json.load(f)
+        except:
+            return True
+        
+        telegram = config.get('channels', {}).get('telegram', {})
+        if not telegram.get('enabled', False):
+            return True
+        
+        all_good = True
+        
+        # Check DM policy
+        dm_policy = telegram.get('dmPolicy', 'open')
+        if dm_policy == 'open':
+            self.warnings.append({
+                'check': 'Telegram DM policy',
+                'status': 'warn',
+                'message': 'DM policy is "open" - anyone can DM the bot'
+            })
+        else:
+            self.passed.append(f'Telegram DM policy: {dm_policy}')
+        
+        # Check group policy
+        group_policy = telegram.get('groupPolicy', 'closed')
+        if group_policy == 'open':
+            self.warnings.append({
+                'check': 'Telegram group policy',
+                'status': 'warn',
+                'message': 'Group policy is "open" - anyone in groups can command the bot'
+            })
+        else:
+            self.passed.append(f'Telegram group policy: {group_policy}')
+        
+        return all_good
+    
+    def check_ssh_config(self) -> bool:
+        """Check SSH hardening (if sshd_config exists)."""
+        sshd_config = Path('/etc/ssh/sshd_config')
+        if not sshd_config.exists():
+            return True  # Not a server, skip
+        
+        try:
+            content = sshd_config.read_text()
+        except PermissionError:
+            self.warnings.append({
+                'check': 'SSH config',
+                'status': 'skip',
+                'message': 'Cannot read sshd_config (need sudo)'
+            })
+            return True
+        
+        all_good = True
+        
+        # Check PasswordAuthentication
+        if 'PasswordAuthentication yes' in content:
+            self.issues.append({
+                'check': 'SSH password auth',
+                'status': 'fail',
+                'message': 'SSH password authentication is enabled!',
+                'fix': 'Set PasswordAuthentication no in /etc/ssh/sshd_config'
+            })
+            all_good = False
+        elif 'PasswordAuthentication no' in content:
+            self.passed.append('SSH password auth: disabled')
+        
+        # Check PermitRootLogin
+        if 'PermitRootLogin yes' in content:
+            self.issues.append({
+                'check': 'SSH root login',
+                'status': 'fail',
+                'message': 'SSH root login is enabled!',
+                'fix': 'Set PermitRootLogin no in /etc/ssh/sshd_config'
+            })
+            all_good = False
+        elif 'PermitRootLogin no' in content:
+            self.passed.append('SSH root login: disabled')
+        
+        return all_good
+    
+    def run_audit(self, quick: bool = False) -> Tuple[int, int, int]:
+        """Run all security checks."""
+        
+        # File permissions
+        self.check_dir_permissions('~/.clawdbot', 0o700, 'Clawdbot directory permissions')
+        self.check_file_permissions('~/.clawdbot/clawdbot.json', 0o600, 'Config file permissions')
+        
+        # Config location
+        if not quick:
+            self.check_config_not_in_sync()
+        
+        # Gateway config
+        self.check_gateway_config()
+        
+        # Telegram policies
+        self.check_telegram_policy()
+        
+        # SSH (if server)
+        if not quick:
+            self.check_ssh_config()
+        
+        return len(self.issues), len(self.warnings), len(self.passed)
+    
+    def fix_issues(self) -> int:
+        """Attempt to auto-fix issues."""
+        fixed = 0
+        
+        for issue in self.issues:
+            fix = issue.get('fix', '')
+            if fix.startswith('chmod'):
+                try:
+                    parts = fix.split()
+                    mode = int(parts[1], 8)
+                    path = Path(parts[2]).expanduser()
+                    os.chmod(path, mode)
+                    print(f"✅ Fixed: {fix}")
+                    fixed += 1
+                except Exception as e:
+                    print(f"❌ Cannot fix: {fix} ({e})")
+            else:
+                print(f"⚠️ Manual fix needed: {fix}")
+        
+        return fixed
+    
+    def print_report(self, verbose: bool = False):
+        """Print audit report."""
+        print("=" * 60)
+        print("🛡️  CLAWDBOT SECURITY AUDIT")
+        print("=" * 60)
+        
+        if self.issues:
+            print(f"\n🚨 ISSUES ({len(self.issues)})")
+            for issue in self.issues:
+                print(f"  ❌ {issue['check']}")
+                print(f"     {issue['message']}")
+                if issue.get('fix'):
+                    print(f"     Fix: {issue['fix']}")
+        
+        if self.warnings:
+            print(f"\n⚠️  WARNINGS ({len(self.warnings)})")
+            for warn in self.warnings:
+                print(f"  ⚠️ {warn['check']}")
+                print(f"     {warn['message']}")
+        
+        if verbose and self.passed:
+            print(f"\n✅ PASSED ({len(self.passed)})")
+            for p in self.passed:
+                print(f"  ✅ {p}")
+        
+        print("\n" + "=" * 60)
+        total = len(self.issues) + len(self.warnings) + len(self.passed)
+        if self.issues:
+            print(f"❌ {len(self.issues)} issues need attention")
+        elif self.warnings:
+            print(f"⚠️ {len(self.warnings)} warnings, but no critical issues")
+        else:
+            print(f"✅ All {total} checks passed!")
+        print("=" * 60)
+
+
+def main():
+    parser = argparse.ArgumentParser(description='Clawdbot Security Audit')
+    parser.add_argument('--quick', action='store_true', help='Quick audit (skip slow checks)')
+    parser.add_argument('--fix', action='store_true', help='Attempt to auto-fix issues')
+    parser.add_argument('--json', action='store_true', help='Output as JSON')
+    parser.add_argument('--verbose', '-v', action='store_true', help='Show passed checks')
+    
+    args = parser.parse_args()
+    
+    audit = SecurityAudit()
+    issues, warnings, passed = audit.run_audit(quick=args.quick)
+    
+    if args.fix:
+        print("\n🔧 Attempting to fix issues...\n")
+        fixed = audit.fix_issues()
+        print(f"\nFixed {fixed} issues.")
+        # Re-run audit
+        audit = SecurityAudit()
+        audit.run_audit(quick=args.quick)
+    
+    if args.json:
+        result = {
+            'issues': audit.issues,
+            'warnings': audit.warnings,
+            'passed': audit.passed,
+            'summary': {
+                'issues': len(audit.issues),
+                'warnings': len(audit.warnings),
+                'passed': len(audit.passed),
+            }
+        }
+        print(json.dumps(result, indent=2, ensure_ascii=False))
+    else:
+        audit.print_report(verbose=args.verbose)
+    
+    sys.exit(1 if audit.issues else 0)
+
+
+if __name__ == '__main__':
+    main()