llm-host-guard 0.2.0__tar.gz

llm_host_guard-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HomeAuto Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

llm_host_guard-0.2.0/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: llm-host-guard
+Version: 0.2.0
+Summary: Audit the attack surface of a machine running local LLMs (Ollama, LM Studio, vLLM, llama.cpp...). Stdlib only.
+License: MIT
+Project-URL: Homepage, https://github.com/leinad07912-ux/llm-host-guard
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# llm-host-guard
+
+**Is my Ollama / LM Studio / vLLM box open to the world?** One command tells you, in plain English, and fixes it if you say yes.
+
+## 30-second start
+
+```
+pipx install git+https://github.com/leinad07912-ux/llm-host-guard    # or: pip install git+…
+llm-host-guard
+```
+
+No pipx? `git clone https://github.com/leinad07912-ux/llm-host-guard && cd llm-host-guard && python3 llm_host_guard.py` — no dependencies, Python 3.9+.
+
+You get a verdict line, a ranked list with a fix under every item, and the next command to run:
+
+```
+llm-host-guard v0.2.0 — neo (Linux, 192.168.50.156)
+
+🔴 2 thing(s) to fix NOW, 2 this week   score 2/10
+
+CRITICAL  Ollama on *:11434 reachable from LAN with no auth (7 models listed)
+          fix: OLLAMA_HOST=127.0.0.1 … or `ufw allow from <LAN>/24 to any port 11434`
+CRITICAL  container web publishes 0.0.0.0:8080 — bypasses host firewall
+HIGH      sshd PasswordAuthentication yes
+HIGH      3 pickle-format weight file(s) — execute code on load
+OK        ufw active, default deny incoming
+
+score: 2/10
+
+next: preview the fixes →  llm-host-guard --fix --dry-run
+      apply them        →  sudo llm-host-guard --fix
+```
+
+Then: `sudo llm-host-guard --fix` walks each fix, shows the exact command, asks y/N, prints the undo. `llm-host-guard --open` gives the same report as a page in your browser. `sudo llm-host-guard --watch 30 --telegram` keeps watching and messages you only when something new opens up.
+
+## Why
+
+Ollama, LM Studio, vLLM, llama.cpp and friends ship with **no authentication**, often bind to **0.0.0.0**, load model files that can **execute code on open**, and run on laptops with no perimeter. Tens of thousands of open Ollama servers are already on Shodan. Tooling exists for agent safety ([agent-firewall](https://github.com/leinad07912-ux/agent-firewall), mcp-sentinel) and generic host hardening (lynis) — nothing covers the LLM-host gap specifically.
+
+## What it checks
+
+| Check | Finds |
+|---|---|
+| `ports` | LLM servers (Ollama, LM Studio, vLLM, llama.cpp, Open WebUI, text-gen-webui, Jan, koboldcpp, LocalAI, Xinference, SGLang, GPT4All, TabbyAPI) bound non-loopback; **probes them from your LAN IP to prove they answer without auth** |
+| `firewall` | ufw / firewalld / nftables / pf / Windows Firewall missing, disabled, not default-deny, or allowing LLM ports from Anywhere |
+| `docker` | Containers publishing on 0.0.0.0 — these **bypass ufw** |
+| `exposure` | Public IP on an interface; cloudflared / ngrok / frp / bore tunnels running |
+| `models` | Pickle weights (`.pt .bin .ckpt`) = RCE on load; malformed GGUF / safetensors headers (parser-CVE bait); world-writable model dirs |
+| `versions` | Ollama / vLLM / llama.cpp / Open WebUI against a bundled CVE table |
+| `config` | `OLLAMA_ORIGINS=*` (any website can drive your LLM from your browser), `OLLAMA_HOST=0.0.0.0`, vLLM / llama-server without `--api-key`, Open WebUI signup, sshd password auth |
+| `agents` | Claude Code / Cursor / Codex / MCP configs present → points you to agent-side tooling |
+| `runtime` | **Behaviour of the running server**: an LLM process that spawned a shell/downloader/unexpected child (the shape of a poisoned-model exploit) → CRITICAL; server or its children connected to a public IP (fine during a pull, otherwise not) → HIGH. `/proc` on Linux, `ps`+`lsof` on macOS, no root. `--checks runtime --watch 0.1` for a 6-second loop. |
+| `internet` (opt-in `--internet`) | What the outside already sees: your public IP's open ports + CVEs via Shodan InternetDB (free, keyless), and router UPnP port-forwards to LLM ports. The only check that makes outbound calls. |
+
+Each finding carries the exact fix.
+
+## What the levels mean
+
+| Level | Plain English |
+|---|---|
+| **CRITICAL** | Wide open right now. Anyone on your network (or the internet) can use or damage your LLM today. Fix first. |
+| **HIGH** | A real hole, but an attacker needs one more thing — be on your WiFi, or get you to open a file. Fix this week. |
+| **MED** | Exposed on purpose but wider than it needs to be. Tighten when convenient. |
+| **LOW** | Looks exposed but something else already blocks it. Just be aware. |
+| **INFO** | Not a problem, just something you should know exists. |
+| **OK** | Checked, nothing wrong. |
+
+Score starts at 10; each CRITICAL takes 3, HIGH 2, MED 1. Run with `sudo` so firewall rules that already protect a port get credited (a LAN-scoped Ollama drops from CRITICAL to MED, a DOCKER-USER-blocked container to LOW).
+
+## Usage
+
+```
+llm-host-guard                 # terminal report, exit 2=critical 1=high/med 0=clean
+llm-host-guard --json          # machine-readable
+llm-host-guard --html report.html         # self-contained page; --open writes it and opens your browser
+llm-host-guard --watch 15 --webhook https://…   # rerun every 15 min, alert on new findings
+llm-host-guard --watch 30 --telegram           # same, to Telegram (token/chat via env, see below)
+llm-host-guard --watch 1 --once --telegram     # single diff pass, for cron
+llm-host-guard --internet          # + Shodan InternetDB + router UPnP (outbound calls)
+llm-host-guard --checks ports,docker --model-dir /data/models
+sudo llm-host-guard            # optional: reads ufw rules + effective sshd config
+```
+
+Run `--watch 30` under systemd / launchd for continuous monitoring; `--html` in watch mode keeps the report fresh.
+
+Telegram: create a bot with @BotFather, DM it once, get your chat id from `https://api.telegram.org/bot<TOKEN>/getUpdates`, then export `LLM_HOST_GUARD_TELEGRAM_BOT_TOKEN` and `LLM_HOST_GUARD_TELEGRAM_CHAT_ID` (a systemd `EnvironmentFile=` keeps them off the command line). `examples/llm-host-guard-watch.service` is a ready user unit.
+
+## `--fix` (v2)
+
+```
+llm-host-guard --fix --dry-run     # preview every recipe, no root, runs nothing
+sudo llm-host-guard --fix          # prints each command, asks y/N per finding
+sudo llm-host-guard --fix --yes    # unattended
+```
+
+Recipes exist for: open LLM port → scoped ufw rule; ufw "Anywhere" rule on an LLM port → re-scoped; `OLLAMA_HOST=0.0.0.0` under systemd → loopback drop-in; container on 0.0.0.0 → DOCKER-USER drop; sshd password auth → `sshd_config.d/00-…` drop-in (only if you already have an SSH key installed — it will not lock you out).
+
+Every recipe only *adds* a rule or a drop-in file, never edits an existing file, and prints its undo command. Findings without a safe automatic recipe say why.
+
+## What it does not do
+
+- Edit config files in place (`--fix` only adds drop-ins/rules)
+- Replace a firewall or IDS — it tells you when you're missing one
+- Detect prompt injection or scan MCP servers — see agent-firewall / mcp-sentinel
+- Kill anything: `runtime` detects and tells you the pid; agent-firewall's eBPF guard is the kill layer
+
+## Platforms
+
+Linux and macOS first-class. Windows best-effort (`netstat -ano`, `netsh advfirewall`; use `py -m llm_host_guard` if `llm-host-guard` isn't on PATH). Python ≥ 3.9. No dependencies.
+
+Running from a clone without installing: `python3 llm_host_guard.py` or `python3 -m llm_host_guard` — identical.
+
+## Contributing
+
+`python3 -m unittest` — tests use fixtures, no live system needed.
+New server signatures → `data/signatures.json`. New CVEs → `data/cves.json` (include vendor advisory link in PR).
+
+MIT.

llm_host_guard-0.2.0/README.md

@@ -0,0 +1,118 @@
+# llm-host-guard
+
+**Is my Ollama / LM Studio / vLLM box open to the world?** One command tells you, in plain English, and fixes it if you say yes.
+
+## 30-second start
+
+```
+pipx install git+https://github.com/leinad07912-ux/llm-host-guard    # or: pip install git+…
+llm-host-guard
+```
+
+No pipx? `git clone https://github.com/leinad07912-ux/llm-host-guard && cd llm-host-guard && python3 llm_host_guard.py` — no dependencies, Python 3.9+.
+
+You get a verdict line, a ranked list with a fix under every item, and the next command to run:
+
+```
+llm-host-guard v0.2.0 — neo (Linux, 192.168.50.156)
+
+🔴 2 thing(s) to fix NOW, 2 this week   score 2/10
+
+CRITICAL  Ollama on *:11434 reachable from LAN with no auth (7 models listed)
+          fix: OLLAMA_HOST=127.0.0.1 … or `ufw allow from <LAN>/24 to any port 11434`
+CRITICAL  container web publishes 0.0.0.0:8080 — bypasses host firewall
+HIGH      sshd PasswordAuthentication yes
+HIGH      3 pickle-format weight file(s) — execute code on load
+OK        ufw active, default deny incoming
+
+score: 2/10
+
+next: preview the fixes →  llm-host-guard --fix --dry-run
+      apply them        →  sudo llm-host-guard --fix
+```
+
+Then: `sudo llm-host-guard --fix` walks each fix, shows the exact command, asks y/N, prints the undo. `llm-host-guard --open` gives the same report as a page in your browser. `sudo llm-host-guard --watch 30 --telegram` keeps watching and messages you only when something new opens up.
+
+## Why
+
+Ollama, LM Studio, vLLM, llama.cpp and friends ship with **no authentication**, often bind to **0.0.0.0**, load model files that can **execute code on open**, and run on laptops with no perimeter. Tens of thousands of open Ollama servers are already on Shodan. Tooling exists for agent safety ([agent-firewall](https://github.com/leinad07912-ux/agent-firewall), mcp-sentinel) and generic host hardening (lynis) — nothing covers the LLM-host gap specifically.
+
+## What it checks
+
+| Check | Finds |
+|---|---|
+| `ports` | LLM servers (Ollama, LM Studio, vLLM, llama.cpp, Open WebUI, text-gen-webui, Jan, koboldcpp, LocalAI, Xinference, SGLang, GPT4All, TabbyAPI) bound non-loopback; **probes them from your LAN IP to prove they answer without auth** |
+| `firewall` | ufw / firewalld / nftables / pf / Windows Firewall missing, disabled, not default-deny, or allowing LLM ports from Anywhere |
+| `docker` | Containers publishing on 0.0.0.0 — these **bypass ufw** |
+| `exposure` | Public IP on an interface; cloudflared / ngrok / frp / bore tunnels running |
+| `models` | Pickle weights (`.pt .bin .ckpt`) = RCE on load; malformed GGUF / safetensors headers (parser-CVE bait); world-writable model dirs |
+| `versions` | Ollama / vLLM / llama.cpp / Open WebUI against a bundled CVE table |
+| `config` | `OLLAMA_ORIGINS=*` (any website can drive your LLM from your browser), `OLLAMA_HOST=0.0.0.0`, vLLM / llama-server without `--api-key`, Open WebUI signup, sshd password auth |
+| `agents` | Claude Code / Cursor / Codex / MCP configs present → points you to agent-side tooling |
+| `runtime` | **Behaviour of the running server**: an LLM process that spawned a shell/downloader/unexpected child (the shape of a poisoned-model exploit) → CRITICAL; server or its children connected to a public IP (fine during a pull, otherwise not) → HIGH. `/proc` on Linux, `ps`+`lsof` on macOS, no root. `--checks runtime --watch 0.1` for a 6-second loop. |
+| `internet` (opt-in `--internet`) | What the outside already sees: your public IP's open ports + CVEs via Shodan InternetDB (free, keyless), and router UPnP port-forwards to LLM ports. The only check that makes outbound calls. |
+
+Each finding carries the exact fix.
+
+## What the levels mean
+
+| Level | Plain English |
+|---|---|
+| **CRITICAL** | Wide open right now. Anyone on your network (or the internet) can use or damage your LLM today. Fix first. |
+| **HIGH** | A real hole, but an attacker needs one more thing — be on your WiFi, or get you to open a file. Fix this week. |
+| **MED** | Exposed on purpose but wider than it needs to be. Tighten when convenient. |
+| **LOW** | Looks exposed but something else already blocks it. Just be aware. |
+| **INFO** | Not a problem, just something you should know exists. |
+| **OK** | Checked, nothing wrong. |
+
+Score starts at 10; each CRITICAL takes 3, HIGH 2, MED 1. Run with `sudo` so firewall rules that already protect a port get credited (a LAN-scoped Ollama drops from CRITICAL to MED, a DOCKER-USER-blocked container to LOW).
+
+## Usage
+
+```
+llm-host-guard                 # terminal report, exit 2=critical 1=high/med 0=clean
+llm-host-guard --json          # machine-readable
+llm-host-guard --html report.html         # self-contained page; --open writes it and opens your browser
+llm-host-guard --watch 15 --webhook https://…   # rerun every 15 min, alert on new findings
+llm-host-guard --watch 30 --telegram           # same, to Telegram (token/chat via env, see below)
+llm-host-guard --watch 1 --once --telegram     # single diff pass, for cron
+llm-host-guard --internet          # + Shodan InternetDB + router UPnP (outbound calls)
+llm-host-guard --checks ports,docker --model-dir /data/models
+sudo llm-host-guard            # optional: reads ufw rules + effective sshd config
+```
+
+Run `--watch 30` under systemd / launchd for continuous monitoring; `--html` in watch mode keeps the report fresh.
+
+Telegram: create a bot with @BotFather, DM it once, get your chat id from `https://api.telegram.org/bot<TOKEN>/getUpdates`, then export `LLM_HOST_GUARD_TELEGRAM_BOT_TOKEN` and `LLM_HOST_GUARD_TELEGRAM_CHAT_ID` (a systemd `EnvironmentFile=` keeps them off the command line). `examples/llm-host-guard-watch.service` is a ready user unit.
+
+## `--fix` (v2)
+
+```
+llm-host-guard --fix --dry-run     # preview every recipe, no root, runs nothing
+sudo llm-host-guard --fix          # prints each command, asks y/N per finding
+sudo llm-host-guard --fix --yes    # unattended
+```
+
+Recipes exist for: open LLM port → scoped ufw rule; ufw "Anywhere" rule on an LLM port → re-scoped; `OLLAMA_HOST=0.0.0.0` under systemd → loopback drop-in; container on 0.0.0.0 → DOCKER-USER drop; sshd password auth → `sshd_config.d/00-…` drop-in (only if you already have an SSH key installed — it will not lock you out).
+
+Every recipe only *adds* a rule or a drop-in file, never edits an existing file, and prints its undo command. Findings without a safe automatic recipe say why.
+
+## What it does not do
+
+- Edit config files in place (`--fix` only adds drop-ins/rules)
+- Replace a firewall or IDS — it tells you when you're missing one
+- Detect prompt injection or scan MCP servers — see agent-firewall / mcp-sentinel
+- Kill anything: `runtime` detects and tells you the pid; agent-firewall's eBPF guard is the kill layer
+
+## Platforms
+
+Linux and macOS first-class. Windows best-effort (`netstat -ano`, `netsh advfirewall`; use `py -m llm_host_guard` if `llm-host-guard` isn't on PATH). Python ≥ 3.9. No dependencies.
+
+Running from a clone without installing: `python3 llm_host_guard.py` or `python3 -m llm_host_guard` — identical.
+
+## Contributing
+
+`python3 -m unittest` — tests use fixtures, no live system needed.
+New server signatures → `data/signatures.json`. New CVEs → `data/cves.json` (include vendor advisory link in PR).
+
+MIT.

llm_host_guard-0.2.0/llm_host_guard/__init__.py

@@ -0,0 +1,2 @@
+"""llm-host-guard: audit the attack surface of a machine running local LLMs."""
+from .core import VERSION as __version__  # noqa: F401

llm_host_guard-0.2.0/llm_host_guard/__main__.py

@@ -0,0 +1,4 @@
+import sys
+from .cli import main
+
+sys.exit(main())

llm_host_guard-0.2.0/llm_host_guard/checks/__init__.py

@@ -0,0 +1,4 @@
+from . import agents, config, docker, exposure, firewall, internet, models, ports, runtime, versions
+
+ALL = {m.NAME: m for m in (ports, firewall, docker, exposure, models, versions, config, agents, runtime)}
+OPTIONAL = {internet.NAME: internet}  # makes outbound calls; enabled with --internet or --checks internet

llm_host_guard-0.2.0/llm_host_guard/checks/agents.py

@@ -0,0 +1,24 @@
+"""Agent tooling on the host. Detect + refer; don't duplicate agent-firewall / mcp-sentinel."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from llm_host_guard.core import Ctx, Finding
+
+NAME = "agents"
+
+
+def run(ctx: Ctx) -> list[Finding]:
+    present = [t["name"] for t in ctx.signatures["agent_tools"]
+               if any((ctx.home / p.removeprefix("~/")).exists() for p in t["paths"])]
+    if not present:
+        return [Finding(NAME, "OK", "No coding-agent tooling detected")]
+    mcp_json = list(ctx.home.glob(".mcp.json")) + list(ctx.home.glob(".claude/**/mcp*.json"))
+    return [Finding(
+        NAME, "INFO", f"Agent tooling present: {', '.join(present)}",
+        f"Agents with shell access turn prompt injection into host compromise. {len(mcp_json)} MCP config(s) found. "
+        "This tool audits the LLM host surface only.",
+        "Constrain agent actions with agent-firewall (https://github.com/leinad07912-ux/agent-firewall) and scan "
+        "MCP servers/skills with mcp-sentinel.",
+        {"tools": present, "mcp_configs": [str(p) for p in mcp_json[:20]]},
+    )]

llm_host_guard-0.2.0/llm_host_guard/checks/config.py

@@ -0,0 +1,91 @@
+"""Runtime + host config weaknesses: CORS *, 0.0.0.0 binds, missing API keys, SSH password auth."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from llm_host_guard.core import Ctx, Finding, sh
+from llm_host_guard import fix
+
+NAME = "config"
+
+
+def _ollama_is_systemd() -> bool:
+    return bool(sh(["systemctl", "cat", "ollama"]))
+
+
+def _sshd_files_text() -> str:
+    files = [Path("/etc/ssh/sshd_config")] + sorted(Path("/etc/ssh/sshd_config.d").glob("*.conf"))
+    text = ""
+    for f in files:
+        try:
+            text += f.read_text(errors="ignore") + "\n"
+        except OSError:
+            continue
+    return text
+
+
+def _ollama_env(ctx: Ctx) -> dict:
+    for l in ctx.listeners:
+        if "ollama" in l.proc.lower() and l.pid:
+            return ctx.env_of_pid(l.pid)
+    txt = sh(["systemctl", "show", "ollama", "-p", "Environment"]) or ""
+    return dict(kv.split("=", 1) for kv in txt.replace("Environment=", "").split() if "=" in kv)
+
+
+def _sshd(ctx: Ctx) -> list[Finding]:
+    out = []
+    text = _sshd_files_text()
+    if not text:
+        return out
+    eff = sh(["sshd", "-T"]) or text  # sshd -T only as root
+    if re.search(r"^\s*passwordauthentication\s+yes", eff, re.I | re.M):
+        keyed = fix.has_ssh_key(ctx)
+        out.append(Finding(NAME, "HIGH", "sshd PasswordAuthentication yes",
+                           "Brute-forceable. AI-driven credential stuffing makes this worse, not better.",
+                           "PasswordAuthentication no  (keep one key-based session open while testing)",
+                           fix_cmds=[fix.write_file_cmd(fix.DROPIN_SSHD, "PasswordAuthentication no\n"),
+                                     fix.sshd_reload_cmd()] if keyed else [],
+                           undo_cmds=[fix.rm_file_cmd(fix.DROPIN_SSHD), fix.sshd_reload_cmd()] if keyed else [],
+                           fix_note="keep this session open; test key login from a second terminal before closing"
+                           if keyed else "no SSH authorized-keys file for the invoking user — refusing to disable passwords"))
+    if re.search(r"^\s*permitrootlogin\s+(yes|without-password|prohibit-password)", eff, re.I | re.M):
+        out.append(Finding(NAME, "MED", "sshd PermitRootLogin enabled", "", "PermitRootLogin no"))
+    return out
+
+
+def run(ctx: Ctx) -> list[Finding]:
+    out = []
+    env = _ollama_env(ctx)
+    if env:
+        origins = env.get("OLLAMA_ORIGINS", "")
+        if "*" in origins:
+            out.append(Finding(NAME, "HIGH", "OLLAMA_ORIGINS=* (any website can drive your Ollama)",
+                               "With wildcard CORS, JavaScript on any page you visit can call localhost:11434 "
+                               "from your browser — run prompts, pull/delete models, exfiltrate outputs.",
+                               "Set OLLAMA_ORIGINS to the exact origins that need it (e.g. http://localhost:3000)."))
+        scoped = [x for x in ctx.ufw_sources(11434) if x != "Anywhere"]
+        if env.get("OLLAMA_HOST", "").startswith(("0.0.0.0", ":", "[::]")) and not scoped:
+            sysd = _ollama_is_systemd()
+            out.append(Finding(NAME, "HIGH", f"OLLAMA_HOST={env['OLLAMA_HOST']} (all interfaces)",
+                               "", "OLLAMA_HOST=127.0.0.1 unless LAN clients need it; then firewall to LAN.",
+                               fix_cmds=[fix.write_file_cmd(fix.DROPIN_OLLAMA, "[Service]\nEnvironment=OLLAMA_HOST=127.0.0.1\n"),
+                                         "systemctl daemon-reload", "systemctl restart ollama"] if sysd else [],
+                               undo_cmds=[fix.rm_file_cmd(fix.DROPIN_OLLAMA), "systemctl daemon-reload",
+                                          "systemctl restart ollama"] if sysd else [],
+                               fix_note="binds Ollama to loopback — LAN clients (Home Assistant, Open WebUI elsewhere) will lose access; "
+                                        "if they need it, skip this and take the ufw-scoping recipe instead"
+                               if sysd else "Ollama not systemd-managed — set OLLAMA_HOST=127.0.0.1 where it is launched"))
+    for l in ctx.listeners:
+        cmd = ctx.cmdline_of_pid(l.pid).lower() if l.pid else ""
+        if not cmd:
+            continue
+        if "vllm" in cmd and "--api-key" not in cmd and not l.loopback:
+            out.append(Finding(NAME, "HIGH", f"vLLM on :{l.port} without --api-key", "", "vllm serve ... --api-key <secret>"))
+        if "llama-server" in cmd and "--api-key" not in cmd and not l.loopback:
+            out.append(Finding(NAME, "HIGH", f"llama-server on :{l.port} without --api-key", "", "llama-server ... --api-key <secret>"))
+        if ("open-webui" in cmd or "open_webui" in cmd) and "enable_signup=false" not in (str(ctx.env_of_pid(l.pid)).lower()):
+            out.append(Finding(NAME, "MED", "Open WebUI signup may be enabled", "First visitor becomes admin; later visitors self-register.",
+                               "ENABLE_SIGNUP=false after creating your admin"))
+    out += _sshd(ctx)
+    return out or [Finding(NAME, "OK", "No config weaknesses detected")]

llm_host_guard-0.2.0/llm_host_guard/checks/docker.py

@@ -0,0 +1,57 @@
+"""Docker port publishing bypasses ufw (DOCKER chain is evaluated before INPUT)."""
+from __future__ import annotations
+
+import re
+
+from llm_host_guard.core import Ctx, Finding, sh
+
+NAME = "docker"
+_MAP = re.compile(r"(\S+):(\d+)->(\d+)/tcp")
+
+
+def parse_ps(text: str) -> list[tuple[str, str, int]]:
+    """[(container, bind_addr, host_port)] for published TCP ports."""
+    out = []
+    for line in text.splitlines():
+        if "\t" not in line:
+            continue
+        name, ports = line.split("\t", 1)
+        for addr, hp, _ in _MAP.findall(ports):
+            out.append((name, addr, int(hp)))
+    return out
+
+
+def run(ctx: Ctx) -> list[Finding]:
+    ps = sh(["docker", "ps", "--format", "{{.Names}}\t{{.Ports}}"])
+    if ps is None:
+        return []
+    out = []
+    wild = sorted({(n, p) for n, a, p in parse_ps(ps) if a in ("0.0.0.0", "::", "[::]")})
+    llm_ports = {p for sig in ctx.signatures["products"] for p in sig["ports"]}
+    for name, port in wild:
+        if ctx.docker_user_drops(port):
+            out.append(Finding(NAME, "LOW", f"container {name} publishes 0.0.0.0:{port} but DOCKER-USER drops it",
+                               "Reachable only via loopback thanks to your DOCKER-USER rule.", "", {"container": name, "port": port}))
+            continue
+        sev = "CRITICAL" if port in llm_ports else "HIGH"
+        rule = f"DOCKER-USER -i {ctx.default_iface()} -p tcp --dport {port} -j DROP"
+        out.append(Finding(
+            NAME, sev,
+            f"container {name} publishes 0.0.0.0:{port} — bypasses host firewall",
+            "Docker inserts its own iptables rules ahead of ufw/firewalld; a published port is reachable "
+            "from the network regardless of host firewall policy.",
+            f"Publish on loopback: `-p 127.0.0.1:{port}:<container_port>`; or set "
+            "`{\"ip\": \"127.0.0.1\"}` in /etc/docker/daemon.json; or add DOCKER-USER rules.",
+            {"container": name, "port": port},
+            fix_cmds=[f"iptables -I {rule}"], undo_cmds=[f"iptables -D {rule}"],
+            fix_note="live rule only; persist via /etc/ufw/after.rules (see examples/ufw-docker-user.rules) or iptables-persistent",
+        ))
+    user_chain = sh(["iptables", "-L", "DOCKER-USER", "-n"])
+    if wild and user_chain is None:
+        out.append(Finding(NAME, "INFO", "DOCKER-USER chain unreadable without sudo",
+                           "Rerun with sudo to credit any DOCKER-USER DROP rules.", ""))
+    elif wild and user_chain.count("\n") <= 2:
+        out.append(Finding(NAME, "MED", "DOCKER-USER chain is empty",
+                           "No custom filtering applies to published container ports.",
+                           "iptables -I DOCKER-USER -i <wan-if> ! -s <LAN>/24 -j DROP"))
+    return out or [Finding(NAME, "OK", "No containers publishing ports on 0.0.0.0")]

llm_host_guard-0.2.0/llm_host_guard/checks/exposure.py

@@ -0,0 +1,48 @@
+"""Internet exposure: public IP on an interface, tunnel daemons running."""
+from __future__ import annotations
+
+import re
+
+from llm_host_guard.core import Ctx, Finding, is_private, sh
+
+NAME = "exposure"
+
+
+def _iface_ips(ctx: Ctx) -> list[str]:
+    if ctx.os == "Windows":
+        txt = sh(["ipconfig"]) or ""
+        return re.findall(r"IPv4 Address[. ]*: (\S+)", txt)
+    txt = sh(["ip", "-4", "-o", "addr"]) or sh(["ifconfig"]) or ""
+    return re.findall(r"inet (?:addr:)?(\d+\.\d+\.\d+\.\d+)", txt)
+
+
+def _procs(ctx: Ctx) -> str:
+    if ctx.os == "Windows":
+        return (sh(["tasklist"]) or "").lower()
+    return (sh(["ps", "-axo", "comm=,args="]) or "").lower()
+
+
+def run(ctx: Ctx) -> list[Finding]:
+    out = []
+    public = [ip for ip in _iface_ips(ctx) if not is_private(ip)]
+    llm = [l for l in ctx.listeners if ctx.sig_for(l) and not l.loopback]
+    if public:
+        out.append(Finding(
+            NAME, "CRITICAL" if llm else "HIGH",
+            f"Host has a public IP ({', '.join(public)})",
+            f"{len(llm)} LLM listener(s) bound non-loopback are directly internet-reachable unless a "
+            "firewall blocks them. Shodan indexes open Ollama within hours.",
+            "Bind LLM servers to 127.0.0.1; firewall default-deny; use a VPN (Tailscale/WireGuard) for remote access.",
+            {"public_ips": public},
+        ))
+    procs = _procs(ctx)
+    tunnels = [t for t in ctx.signatures["tunnels"] if t in procs]
+    if tunnels:
+        out.append(Finding(
+            NAME, "HIGH" if llm else "MED",
+            f"Tunnel daemon running: {', '.join(tunnels)}",
+            "Tunnels punch through NAT and firewall. If a tunnel targets an LLM port it is on the public internet.",
+            "Verify tunnel ingress config; add authentication (Cloudflare Access, ngrok --basic-auth) or remove.",
+            {"tunnels": tunnels},
+        ))
+    return out or [Finding(NAME, "OK", "No public IP or tunnel daemon detected (NAT/router is still your only perimeter)")]

llm_host_guard-0.2.0/llm_host_guard/checks/firewall.py

@@ -0,0 +1,92 @@
+"""Host firewall presence + policy. Read-only, works without sudo where possible."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from llm_host_guard.core import Ctx, Finding, sh
+
+NAME = "firewall"
+
+
+def _ufw(ctx: Ctx) -> list[Finding]:
+    conf = Path("/etc/ufw/ufw.conf")
+    if not conf.exists():
+        return []
+    enabled = "ENABLED=yes" in conf.read_text(errors="ignore")
+    status = sh(["ufw", "status", "verbose"])  # works only as root; may be None
+    if status is None and not enabled:
+        return [Finding(NAME, "HIGH", "ufw installed but disabled",
+                        "Every listening service is reachable from the network.",
+                        "sudo ufw default deny incoming && sudo ufw allow from <LAN>/24 to any port 22 && sudo ufw enable")]
+    if status is None:
+        return [Finding(NAME, "INFO", "ufw enabled (rules unreadable without sudo)",
+                        "Rerun with sudo to audit rule scope for LLM ports.", "")]
+    out = []
+    if "deny (incoming)" not in status:
+        out.append(Finding(NAME, "HIGH", "ufw default policy is not deny incoming", status.splitlines()[2] if len(status.splitlines()) > 2 else "",
+                           "sudo ufw default deny incoming"))
+    llm_ports = {l.port for l in ctx.listeners if ctx.sig_for(l) and not l.loopback}
+    for line in status.splitlines():
+        m = re.match(r"^(\d+)(?:/tcp)?\s+ALLOW IN\s+(\S+)", line)
+        if m and int(m.group(1)) in llm_ports and m.group(2) == "Anywhere":
+            port, cidr = m.group(1), ctx.lan_cidr
+            out.append(Finding(NAME, "HIGH", f"ufw allows port {port} (LLM) from Anywhere",
+                               "Rule is not scoped to your LAN.",
+                               f"sudo ufw delete allow {port}/tcp && sudo ufw allow from {cidr} to any port {port} proto tcp",
+                               fix_cmds=[f"ufw delete allow {port}/tcp",
+                                         f"ufw allow from {cidr} to any port {port} proto tcp comment llm-host-guard"],
+                               undo_cmds=[f"ufw delete allow from {cidr} to any port {port} proto tcp",
+                                          f"ufw allow {port}/tcp"]))
+    return out or [Finding(NAME, "OK", "ufw active, default deny incoming, LLM ports scoped")]
+
+
+def _firewalld() -> list[Finding]:
+    st = sh(["firewall-cmd", "--state"])
+    if st is None:
+        return []
+    if "running" not in st:
+        return [Finding(NAME, "HIGH", "firewalld installed but not running", "", "sudo systemctl enable --now firewalld")]
+    return [Finding(NAME, "OK", "firewalld running")]
+
+
+def _nft() -> list[Finding]:
+    rs = sh(["nft", "list", "ruleset"])
+    if rs is None:
+        return []
+    if "hook input" not in rs:
+        return [Finding(NAME, "HIGH", "nftables present but no input hook chain", "No inbound filtering.",
+                        "Enable ufw/firewalld or add an input chain with policy drop")]
+    return [Finding(NAME, "OK", "nftables input chain present")]
+
+
+def _pf() -> list[Finding]:
+    info = sh(["pfctl", "-s", "info"])
+    if info is None:
+        return []
+    if "Status: Enabled" not in info:
+        return [Finding(NAME, "HIGH", "macOS pf firewall disabled", "",
+                        "System Settings → Network → Firewall → On; or `sudo pfctl -e`")]
+    return [Finding(NAME, "OK", "pf enabled")]
+
+
+def _win() -> list[Finding]:
+    st = sh(["netsh", "advfirewall", "show", "allprofiles", "state"])
+    if st is None:
+        return []
+    if "OFF" in st.upper():
+        return [Finding(NAME, "HIGH", "Windows Firewall OFF on at least one profile", "",
+                        "netsh advfirewall set allprofiles state on")]
+    return [Finding(NAME, "OK", "Windows Firewall on")]
+
+
+def run(ctx: Ctx) -> list[Finding]:
+    if ctx.os == "Darwin":
+        res = _pf()
+    elif ctx.os == "Windows":
+        res = _win()
+    else:
+        res = _ufw(ctx) or _firewalld() or _nft()
+    return res or [Finding(NAME, "HIGH", "No host firewall detected",
+                           "Every listening service is reachable from the network.",
+                           "Linux: sudo apt install ufw && sudo ufw default deny incoming && sudo ufw enable")]