umbermark-cli 1.0.0__py3-none-any.whl

umbermark/core/evidence.py

@@ -0,0 +1,83 @@
+"""Evidence pack for one owner report (UMBR-66; Pro and Agency): a ZIP an auditor can read without Umbermark.
+
+  README.txt        what the pack is, the server, scan time, score (and score with accepted risks), mapping note
+  findings.csv      one row per check: verdict, severity, points lost, CIS Controls v8 safeguards, evidence,
+                    accepted-risk reason and expiry
+  cis_controls.csv  one row per safeguard: the checks that give evidence for it and the worst verdict among them
+  report.json       the stored report, as scanned
+
+The owner's own data only; built on request, never stored. CSV cells starting with = + - @ are quote-prefixed so a
+spreadsheet does not run them as formulas.
+"""
+from __future__ import annotations
+
+import csv
+import io
+import json
+import zipfile
+
+from umbermark.catalogue import cis
+
+_ORDER = {"fail": 0, "warn": 1, "pass": 2, "skip": 3}
+
+
+def _safe(v):
+    return "'" + v if isinstance(v, str) and v[:1] in "=+-@" else v
+
+
+def _csv(rows: list[dict]) -> str:
+    buf = io.StringIO()
+    if rows:
+        w = csv.DictWriter(buf, fieldnames=list(rows[0].keys()))
+        w.writeheader()
+        for r in rows:
+            w.writerow({k: _safe(v) for k, v in r.items()})
+    return buf.getvalue()
+
+
+def build(*, report_row, payload: dict, server_label: str | None, accepted: dict, adjusted) -> bytes:
+    findings = payload.get("findings", []) or []
+    lost = {d.get("check_id"): d.get("points_lost", 0) for d in (payload.get("result") or {}).get("deductions", [])}
+    rows = []
+    for f in findings:
+        cid = f.get("check_id", "")
+        verdict = str(f.get("verdict", ""))
+        acc = accepted.get(cid)
+        rows.append({
+            "check_id": cid, "title": f.get("title", ""), "verdict": verdict, "severity": f.get("severity", ""),
+            "points_lost": lost.get(cid, 0), "cis_controls_v8": cis.label(cid),
+            "evidence": f.get("evidence", "") or f.get("skip_reason", ""),
+            "accepted_until": acc["expires_at"][:10] if acc else "", "accepted_reason": acc["reason"] if acc else "",
+        })
+    by_sg: dict[str, list[tuple[str, str]]] = {}
+    for r in rows:
+        for sg in cis.CHECK_SAFEGUARDS.get(r["check_id"], ()):
+            by_sg.setdefault(sg, []).append((r["check_id"], r["verdict"]))
+    sg_rows = [{
+        "safeguard": sg, "title": cis.SAFEGUARDS[sg],
+        "checks": " ".join(c for c, _ in items),
+        "worst_verdict": min((v for _, v in items), key=lambda v: _ORDER.get(v, 9)),
+    } for sg, items in sorted(by_sg.items(), key=lambda kv: [int(x) for x in kv[0].split(".")])]
+    readme = "\n".join([
+        "Umbermark evidence pack",
+        "",
+        f"Server: {server_label or report_row.target_display}",
+        f"Target: {report_row.target_display}",
+        f"Scanned: {report_row.created_at}",
+        f"Report id: {report_row.id}",
+        f"Score: {report_row.score}/100 ({report_row.band}), coverage {round(report_row.coverage * 100)}%",
+        (f"Score with accepted risks: {adjusted.score}/100 ({adjusted.band}); accepted: {', '.join(adjusted.accepted)}"
+         if adjusted else "Accepted risks: none applied"),
+        "",
+        "Files: findings.csv (one row per check), cis_controls.csv (one row per safeguard), report.json (as scanned).",
+        f"Framework: {cis.FRAMEWORK}. {cis.NOTE}",
+        "Verdicts: pass = the check found the expected state; warn and fail cost points; skip = not assessed.",
+        "",
+    ])
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as z:
+        z.writestr("README.txt", readme)
+        z.writestr("findings.csv", _csv(rows))
+        z.writestr("cis_controls.csv", _csv(sg_rows))
+        z.writestr("report.json", json.dumps(payload, indent=2, sort_keys=True, default=str))
+    return buf.getvalue()

umbermark/core/external/__init__.py

@@ -0,0 +1,6 @@
+"""Tier-1 external (outside-in) scanner.
+
+Probes a host's public surface from Umbermark infra using only a hostname/IP —
+no credentials, no access. Mirrors the on-box engine but swaps the CommandRunner
+for a network `ExternalProbe`, reusing the same Finding / scoring / ScanReport.
+"""

umbermark/core/external/check.py

@@ -0,0 +1,54 @@
+"""Base class for external (outside-in) checks.
+
+Reuses the on-box `Finding` / `Severity` / `Verdict` model so external findings
+flow through the same scoring and report rendering — only the input (a network
+`ExternalProbe` instead of a `CommandRunner`) differs.
+"""
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from typing import TYPE_CHECKING
+
+from umbermark.core.check import Finding, Severity, Verdict
+
+if TYPE_CHECKING:
+    from umbermark.core.external.probe import ExternalProbe
+
+
+class ExternalCheck(ABC):
+    id: str = ""
+    title: str = ""
+    category: str = "external"
+    severity: Severity = Severity.MEDIUM
+    weight: int = 5
+    remediation: str = ""
+    # ACTIVE checks probe ports beyond what a browser/client would touch
+    # (data stores, legacy services, management sweeps). The engine refuses to
+    # run them unless the target's ownership has been verified (UMBR-26).
+    # PASSIVE checks (TLS on 443, HTTP headers, SSH KEXINIT on 22) stay False.
+    active: bool = False
+    # Optional check-specific SKIP reason shown when the ownership gate stops an
+    # ACTIVE check (UMBR-38). Empty = use the engine's generic reason.
+    unverified_skip_reason: str = ""
+
+    @abstractmethod
+    def run(self, probe: "ExternalProbe") -> Finding:
+        ...
+
+    def _finding(
+        self,
+        verdict: Verdict,
+        evidence: str = "",
+        skip_reason: str = "",
+    ) -> Finding:
+        return Finding(
+            check_id=self.id,
+            title=self.title,
+            category=self.category,
+            severity=self.severity,
+            weight=self.weight,
+            verdict=verdict,
+            evidence=evidence,
+            remediation=self.remediation if verdict in (Verdict.FAIL, Verdict.WARN) else "",
+            skip_reason=skip_reason,
+        )

umbermark/core/external/checks/__init__.py

@@ -0,0 +1,31 @@
+"""External check catalog (Tier-1). Grows one slice at a time."""
+from __future__ import annotations
+
+from umbermark.core.external.checks.exposed_datastores import ExposedDataStoresCheck
+from umbermark.core.external.checks.legacy_services import LegacyPlaintextServicesCheck
+from umbermark.core.external.checks.http_security_headers import HttpSecurityHeadersCheck
+from umbermark.core.external.checks.open_management_ports import OpenManagementPortsCheck
+from umbermark.core.external.checks.ssh_alt_ports import SshAltPortsCheck
+from umbermark.core.external.checks.ssh_weak_algorithms import SshWeakAlgorithmsCheck
+from umbermark.core.external.checks.tls_hygiene import TlsHygieneCheck
+
+ALL_EXTERNAL_CHECKS = [
+    ExposedDataStoresCheck(),
+    LegacyPlaintextServicesCheck(),
+    OpenManagementPortsCheck(),
+    SshWeakAlgorithmsCheck(),
+    SshAltPortsCheck(),
+    TlsHygieneCheck(),
+    HttpSecurityHeadersCheck(),
+]
+
+__all__ = [
+    "ALL_EXTERNAL_CHECKS",
+    "ExposedDataStoresCheck",
+    "LegacyPlaintextServicesCheck",
+    "OpenManagementPortsCheck",
+    "SshWeakAlgorithmsCheck",
+    "SshAltPortsCheck",
+    "TlsHygieneCheck",
+    "HttpSecurityHeadersCheck",
+]

umbermark/core/external/checks/exposed_datastores.py

@@ -0,0 +1,55 @@
+"""External check: data stores reachable from the internet.
+
+A database/cache directly exposed to the public internet is one of the highest-
+signal outside-in findings — it routinely leads to data theft or ransom. We only
+test whether the port answers; we never authenticate or read data.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Common data-store ports that should never be open to the internet.
+_DATASTORES = {
+    6379: "Redis",
+    5432: "PostgreSQL",
+    3306: "MySQL/MariaDB",
+    27017: "MongoDB",
+    9200: "Elasticsearch",
+    11211: "Memcached",
+    9000: "ClickHouse",
+    5984: "CouchDB",
+}
+
+
+class ExposedDataStoresCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_exposed_datastores"
+    title = "Data stores not exposed to the internet"
+    category = "external_network"
+    severity = Severity.CRITICAL
+    weight = 25
+    remediation = (
+        "Bind data stores to localhost or a private network and block their "
+        "ports at the host/edge firewall. Never expose Redis, PostgreSQL, MySQL, "
+        "MongoDB, Elasticsearch, or Memcached directly to the internet; put them "
+        "behind your application, a VPN, or an SSH tunnel."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _DATASTORES.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue  # a probe error for one port shouldn't sink the check
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.FAIL, evidence=f"reachable from the internet: {listing}"
+            )
+        return self._finding(
+            Verdict.PASS, evidence="no common data-store ports reachable from the internet"
+        )

umbermark/core/external/checks/http_security_headers.py

@@ -0,0 +1,249 @@
+"""External check: HTTP security response headers.
+
+A single unauthenticated request to the site's HTTPS endpoint. Missing hardening
+headers don't breach anything on their own — they remove defenses against
+downgrade, clickjacking, and MIME-sniffing — so this is advisory (WARN, medium).
+
+A header that is present but set to a useless value (HSTS max-age=0, a CSP that
+allows any script, a bogus X-Frame-Options) gives no protection, so it is
+reported the same way as a missing one.
+"""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Header -> what it defends against, in report-friendly order.
+_EXPECTED = {
+    "strict-transport-security": "forces HTTPS (HSTS)",
+    "content-security-policy": "limits script/content sources (CSP)",
+    "x-frame-options": "blocks clickjacking",
+    "x-content-type-options": "stops MIME-sniffing",
+}
+
+# HSTS shorter than 6 months (Mozilla Observatory's floor, 15768000 s) is only a
+# note, not a WARN: Umbermark's own fix starts at max-age=300 on purpose, so a
+# mistake fixes itself, and tells the user to raise it once the site is stable.
+_MIN_HSTS_MAX_AGE = 15768000
+# Anchored to a directive start so "xmax-age=..." is not read as max-age.
+_MAX_AGE_RE = re.compile(r"(?:^|;)\s*max-age\s*=\s*\"?(\d+)\"?(?=\s*(?:;|,|$))",
+    re.IGNORECASE,
+)
+# Host-source with a bare "*" host: "*", "https://*", "http://*:443", "*:443".
+# Also a wildcard TLD ("https://*.com"): "*." plus a single label allows a whole TLD.
+_ANY_HOST_RE = re.compile(
+    r"^(?:[a-z][a-z0-9+.-]*:)?(?://)?\*(?:\.[a-z0-9-]+)?(?::|/|$)"
+)
+_ANY_SCHEME = {"http:", "https:", "data:", "blob:", "filesystem:"}
+_INTEGRITY_RE = re.compile(r"'(?:nonce|sha256|sha384|sha512)-[A-Za-z0-9+/_=-]+'")
+_XFO_OK = {"deny", "sameorigin"}
+
+
+def _first_header(value: str) -> str:
+    """First of several repeated headers (joined with ',').
+
+    RFC 6797 s8.1: a UA processes only the first Strict-Transport-Security
+    header and ignores the rest, so only that one is judged.
+    """
+    return value.split(",")[0]
+
+
+def _weak_hsts(value: str) -> str | None:
+    found = _MAX_AGE_RE.findall(_first_header(value))
+    if not found:
+        return "no valid max-age"
+    if len(found) > 1:
+        # RFC 6797 s6.1: each directive once; browsers ignore a non-conforming header.
+        return "max-age is repeated, so browsers ignore the header"
+    if int(found[0]) == 0:
+        return "max-age=0 switches HSTS off"
+    return None
+
+
+def _hsts_note(value: str) -> str | None:
+    """Advisory (not WARN) note for a sound but short HSTS max-age."""
+    found = _MAX_AGE_RE.findall(_first_header(value))
+    if len(found) == 1 and 0 < int(found[0]) < _MIN_HSTS_MAX_AGE:
+        return (f"note: Strict-Transport-Security max-age={int(found[0])} is short; "
+                "raise to >=6 months (15768000) when stable")
+    return None
+
+
+_UNRESOLVED = "no script-src/default-src"
+
+
+def _csp_policy(policy: str) -> tuple[bool, str | None]:
+    """Judge one CSP policy. Returns (has_script_policy, weakness)."""
+    directives: dict[str, list[str]] = {}
+    for part in policy.split(";"):
+        tokens = part.strip().split()
+        if tokens:
+            # First occurrence of a directive wins, per the CSP spec.
+            directives.setdefault(tokens[0].lower(), [t.lower() for t in tokens[1:]])
+    # CSP3 fallback chains differ per use, so judge each separately:
+    #   <script> elements : script-src-elem -> script-src -> default-src
+    #   inline handlers   : script-src-attr -> script-src -> default-src
+    #   eval()/string code: script-src -> default-src (never the -elem/-attr forms)
+    def pick(*names: str) -> list[str] | None:
+        for n in names:
+            if n in directives:
+                return directives[n]
+        return None
+
+    elem = pick("script-src-elem", "script-src", "default-src")
+    attr = pick("script-src-attr", "script-src", "default-src")
+    ev = pick("script-src", "default-src")
+    if elem is None and attr is None and ev is None:
+        # No script policy to judge (e.g. frame-ancestors only); _weak_csp decides.
+        return False, None
+    # Explicit weaknesses first: they count even when another chain is unresolved.
+    if ev is not None and "'unsafe-eval'" in ev:
+        return True, "script sources allow 'unsafe-eval'"
+    # CSP3: with 'strict-dynamic', browsers ignore host/scheme sources and
+    # 'unsafe-inline' (kept only as a fallback for old browsers). This is the
+    # recommended strict policy, so it is exempt, per list.
+    def inline_ok(sources: list[str]) -> bool:
+        # A nonce or hash makes browsers ignore 'unsafe-inline'.
+        # (a valid, non-empty base64 value is required; browsers drop invalid ones).
+        hardened = any(_INTEGRITY_RE.fullmatch(t) for t in sources)
+        return "'unsafe-inline'" not in sources or hardened
+
+    if elem is not None and "'strict-dynamic'" not in elem:
+        if any(t in _ANY_SCHEME or _ANY_HOST_RE.match(t) for t in elem):
+            return True, "script sources allow any origin (wildcard or bare scheme)"
+        if not inline_ok(elem):
+            return True, "script sources allow 'unsafe-inline'"
+    # Origins are meaningless for inline handlers; only 'unsafe-inline' matters.
+    if attr is not None and "'strict-dynamic'" not in attr and not inline_ok(attr):
+        return True, "script sources allow 'unsafe-inline' (inline event handlers)"
+    # A chain that resolves to nothing means that use has no restriction at all.
+    if elem is None:
+        return True, _UNRESOLVED + ": <script> elements are unrestricted"
+    if attr is None:
+        return True, _UNRESOLVED + ": inline event handlers are unrestricted"
+    if ev is None:
+        return True, _UNRESOLVED + ": eval() is unrestricted"
+    return True, None
+
+
+def _frame_ancestors(policy: str) -> list[str] | None:
+    """Sources of the first frame-ancestors directive in one policy, if any."""
+    for part in policy.split(";"):
+        toks = part.strip().lower().split()
+        if toks and toks[0] == "frame-ancestors":
+            return toks[1:]
+    return None
+
+
+def _weak_csp(value: str) -> str | None:
+    """Flag a CSP whose script controls let any / inline script run, or whose
+    frame-ancestors lets any site frame the page.
+
+    Several policies (repeated headers, folded with ',') are enforced together,
+    so the result is as strong as the strongest of them, in any order.
+    """
+    policies = value.split(",")
+    # Browsers enforce every policy: framing is allowed only if all of them allow
+    # it, so one restrictive frame-ancestors is enough (order does not matter).
+    fa = [f for f in (_frame_ancestors(p) for p in policies) if f is not None]
+    fa_restricts = any(
+        not any(t in _ANY_SCHEME or _ANY_HOST_RE.match(t) for t in srcs) for srcs in fa
+    )
+    if fa and not fa_restricts:
+        return "frame-ancestors allows any site to frame the page"
+
+    reasons: list[str] = []
+    for policy in policies:
+        judged, reason = _csp_policy(policy)
+        if judged and reason is None:
+            return None
+        if reason:
+            reasons.append(reason)
+    definite = [r for r in reasons if not r.startswith(_UNRESOLVED)]
+    if definite:
+        return definite[0]
+    if fa_restricts:
+        # A restrictive frame-ancestors is the deliberately conservative baseline
+        # Umbermark's own fix ships. It stays accepted when the policy only adds
+        # partial script directives: those leave nothing weaker than the baseline.
+        return None
+    if reasons:
+        return reasons[0]
+    return "no script-src, default-src or frame-ancestors: the policy restricts nothing"
+
+
+def _tokens(value: str) -> set[str]:
+    """Distinct lowercased comma-separated tokens (proxy + app may both set it)."""
+    return {t.strip().lower() for t in value.split(",") if t.strip()}
+
+
+def _weak_xfo(value: str) -> str | None:
+    toks = _tokens(value)
+    # Browsers accept a repeated identical value; conflicting/bad ones are weak.
+    if len(toks) != 1 or not toks <= _XFO_OK:
+        return f"value {value.strip()!r} is not DENY or SAMEORIGIN"
+    return None
+
+
+def _weak_xcto(value: str) -> str | None:
+    if _tokens(value) != {"nosniff"}:
+        return f"value {value.strip()!r} is not nosniff"
+    return None
+
+
+_VALUE_CHECKS = {
+    "strict-transport-security": _weak_hsts,
+    "content-security-policy": _weak_csp,
+    "x-frame-options": _weak_xfo,
+    "x-content-type-options": _weak_xcto,
+}
+
+
+class HttpSecurityHeadersCheck(ExternalCheck):
+    id = "external_http_security_headers"
+    title = "HTTP responses set the core security headers"
+    category = "external_web"
+    severity = Severity.MEDIUM
+    weight = 6
+    remediation = (
+        "Set the standard hardening headers on HTTPS responses: "
+        "Strict-Transport-Security (HSTS, max-age of at least 6 months), Content-Security-Policy, "
+        "X-Frame-Options (or CSP frame-ancestors), and X-Content-Type-Options: "
+        "nosniff. Add them at the web server or reverse proxy."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        headers = probe.http_headers(443, tls=True)
+        if headers is None:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="no HTTPS service answered on port 443",
+            )
+
+        lowered = {k.lower(): str(v) for k, v in headers.items()}
+        missing = [name for name in _EXPECTED if name not in lowered]
+        weak = [
+            f"{name} ({reason})"
+            for name, judge in _VALUE_CHECKS.items()
+            if name in lowered and (reason := judge(lowered[name]))
+        ]
+        if missing or weak:
+            parts = []
+            if missing:
+                listing = ", ".join(f"{n} ({_EXPECTED[n]})" for n in missing)
+                parts.append(f"missing security headers: {listing}")
+            if weak:
+                parts.append("weak header values: " + "; ".join(weak))
+            hsts = lowered.get("strict-transport-security")
+            note = _hsts_note(hsts) if hsts is not None else None
+            if note:
+                parts.append(note)
+            return self._finding(Verdict.WARN, evidence=" | ".join(parts))
+        evidence = "all core security headers present with sound values"
+        note = _hsts_note(lowered["strict-transport-security"])
+        if note:
+            evidence += f" ({note})"
+        return self._finding(Verdict.PASS, evidence=evidence)

umbermark/core/external/checks/legacy_services.py

@@ -0,0 +1,52 @@
+"""External check: legacy plaintext services exposed to the internet.
+
+Telnet, FTP, and the BSD r-services transmit credentials and data in the clear
+and have no place facing the public internet. We only test whether the port
+answers; we never authenticate.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Plaintext / legacy services that should never be internet-facing.
+_LEGACY = {
+    23: "Telnet",
+    21: "FTP",
+    69: "TFTP",
+    512: "rexec",
+    513: "rlogin",
+    514: "rsh",
+}
+
+
+class LegacyPlaintextServicesCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_legacy_plaintext_services"
+    title = "No legacy plaintext services exposed (telnet, FTP, r-services)"
+    category = "external_network"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Disable telnet, FTP, and the BSD r-services on the public interface. "
+        "Use SSH/SFTP instead, and block ports 21/23/69/512-514 at the firewall. "
+        "These protocols send credentials and data in cleartext."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _LEGACY.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.FAIL, evidence=f"plaintext service reachable: {listing}"
+            )
+        return self._finding(
+            Verdict.PASS, evidence="no legacy plaintext services reachable"
+        )

umbermark/core/external/checks/open_management_ports.py

@@ -0,0 +1,65 @@
+"""External check: remote-management interfaces exposed to the internet.
+
+The attack-surface inventory. Remote desktop, container/orchestrator control
+planes, and cluster databases should sit behind a VPN or firewall — not answer
+the public internet. Unlike the data-store (critical) and plaintext-legacy (high)
+checks, an open management port is expanded surface rather than a guaranteed
+breach, so this is advisory (WARN). We only test whether the port answers; we
+never authenticate.
+
+SSH (22) and the conventional web ports (80/443) are the expected baseline and
+are deliberately NOT flagged — open SSH is normal, and SSH crypto hygiene is
+covered separately.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.probe import ExternalProbe
+
+# Remote-management / control-plane ports that should not face the public
+# internet. Kept distinct from data stores (port-disjoint) and plaintext legacy.
+_MGMT = {
+    3389: "RDP",
+    5900: "VNC",
+    5901: "VNC",
+    2375: "Docker API (plaintext)",
+    2376: "Docker API (TLS)",
+    6443: "Kubernetes API",
+    10250: "Kubelet API",
+    2379: "etcd",
+}
+
+
+class OpenManagementPortsCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    id = "external_open_management_ports"
+    title = "Remote-management interfaces not exposed to the internet"
+    category = "external_network"
+    severity = Severity.MEDIUM
+    weight = 6
+    remediation = (
+        "Restrict remote-management interfaces (RDP, VNC, the Docker/Kubernetes "
+        "control plane, etcd) to a VPN or a trusted IP allow-list at the firewall. "
+        "These should never be reachable from the open internet — expose only the "
+        "ports your service actually needs (typically 80/443, plus SSH)."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        exposed: list[tuple[int, str]] = []
+        for port, name in _MGMT.items():
+            try:
+                if probe.tcp_connect(port):
+                    exposed.append((port, name))
+            except Exception:
+                continue  # one port's probe error shouldn't sink the check
+        if exposed:
+            listing = ", ".join(f"{name} ({port})" for port, name in sorted(exposed))
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"management interface reachable from the internet: {listing}",
+            )
+        return self._finding(
+            Verdict.PASS,
+            evidence="no remote-management ports reachable from the internet",
+        )

umbermark/core/external/checks/ssh_alt_ports.py

@@ -0,0 +1,77 @@
+"""External check: weak SSH algorithms on alternate SSH ports (UMBR-38).
+
+``external_ssh_weak_algorithms`` only reads port 22. An external scanner has no
+shell on the host, so it cannot read sshd's ``Port`` directives or an
+``ssh.socket`` override. Instead this ACTIVE check probes a short list of the
+ports administrators commonly move SSH to and runs the same weak-algorithm
+evaluation on every one that answers with an SSH banner. The finding names the
+port. Port probing is gated behind verified ownership (UMBR-26): for an
+unverified target the engine skips this check with an explanatory reason.
+
+The on-box ``ssh_weak_ciphers`` check (``sshd -T``) already covers every
+configured port; this is the outside-in complement for hosts scanned without
+credentials.
+"""
+from __future__ import annotations
+
+from umbermark.core.check import Finding, Severity, Verdict
+from umbermark.core.external.check import ExternalCheck
+from umbermark.core.external.checks.ssh_weak_algorithms import find_weak_algorithms
+from umbermark.core.external.engine import ALT_SSH_UNVERIFIED_SKIP_REASON
+from umbermark.core.external.probe import ExternalProbe
+
+# Common non-default SSH ports (22 itself is covered by the passive check).
+_ALT_SSH_PORTS = (2222, 22222, 2022, 822, 2200, 22022, 2322)
+
+
+class SshAltPortsCheck(ExternalCheck):
+    active = True  # port probing: ownership-verified targets only (UMBR-26)
+    unverified_skip_reason = ALT_SSH_UNVERIFIED_SKIP_REASON
+    id = "external_ssh_alt_ports"
+    title = "SSH on alternate ports offers no weak or deprecated algorithms"
+    category = "external_network"
+    severity = Severity.HIGH
+    weight = 12
+    remediation = (
+        "Apply the same algorithm restrictions to every SSH port. KexAlgorithms, Ciphers, MACs "
+        "and HostKeyAlgorithms in sshd_config apply to all ports sshd listens on: pin them to a "
+        "modern list (e.g. curve25519-sha256, chacha20-poly1305@openssh.com / aes256-gcm, "
+        "hmac-sha2-512-etm, ssh-ed25519 / rsa-sha2-512). If an extra SSH port is not needed, "
+        "remove its Port line (and any ssh.socket override) and close it at the firewall."
+    )
+
+    def run(self, probe: ExternalProbe) -> Finding:
+        found: list[int] = []  # ports that answered with an SSH banner
+        weak_by_port: dict[int, list[tuple[str, str]]] = {}
+        for port in _ALT_SSH_PORTS:
+            try:
+                algos = probe.ssh_algorithms(port)
+            except Exception:
+                continue  # one port's probe error shouldn't sink the check
+            if algos is None:
+                continue
+            found.append(port)
+            weak = find_weak_algorithms(algos)
+            if weak:
+                weak_by_port[port] = weak
+        if weak_by_port:
+            parts = [
+                f"port {port}: " + ", ".join(f"{n} ({cat})" for cat, n in weak)
+                for port, weak in sorted(weak_by_port.items())
+            ]
+            return self._finding(
+                Verdict.FAIL,
+                evidence="weak/deprecated SSH algorithms offered on alternate ports: "
+                + "; ".join(parts),
+            )
+        if found:
+            ports = ", ".join(str(p) for p in sorted(found))
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"SSH on alternate port(s) {ports} offers only modern algorithms",
+            )
+        tried = ", ".join(str(p) for p in _ALT_SSH_PORTS)
+        return self._finding(
+            Verdict.PASS,
+            evidence=f"no SSH service answered on the alternate ports checked ({tried})",
+        )