umbermark-cli 1.0.0__tar.gz

umbermark_cli-1.0.0/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: umbermark-cli
+Version: 1.0.0
+Summary: Umbermark — Linux server hardening scanner (CLI only).
+Requires-Python: >=3.10
+Requires-Dist: paramiko>=3.4
+Requires-Dist: typer>=0.12
+Requires-Dist: jinja2>=3.1
+Requires-Dist: httpx>=0.27
+Requires-Dist: pynacl>=1.5
+Requires-Dist: itsdangerous>=2.2

umbermark_cli-1.0.0/README.md

@@ -0,0 +1,284 @@
+<div align="center">
+
+# 🛡️ Umbermark
+
+### Get a **0–100 hardening score** for any Linux server in 60 seconds.
+
+*A scored, evidenced, shareable hardening report — read it, share it, watch the score climb.*
+
+<br/>
+
+![Python](https://img.shields.io/badge/Python-3.10%2B-3776AB?style=for-the-badge&logo=python&logoColor=white)
+![FastAPI](https://img.shields.io/badge/FastAPI-009688?style=for-the-badge&logo=fastapi&logoColor=white)
+![Redis](https://img.shields.io/badge/Redis%20%2B%20RQ-DC382D?style=for-the-badge&logo=redis&logoColor=white)
+![SQLite](https://img.shields.io/badge/SQLite-003B57?style=for-the-badge&logo=sqlite&logoColor=white)
+![Docker](https://img.shields.io/badge/Docker%20Compose-2496ED?style=for-the-badge&logo=docker&logoColor=white)
+![Caddy](https://img.shields.io/badge/Caddy-1F88C0?style=for-the-badge&logo=caddy&logoColor=white)
+
+![Checks](https://img.shields.io/badge/checks-26-704428?style=flat-square)
+![Tests](https://img.shields.io/badge/tests-600%2B%20passing-2e7d32?style=flat-square)
+![Trust tiers](https://img.shields.io/badge/scan%20modes-3-00bcd4?style=flat-square)
+![Status](https://img.shields.io/badge/status-live-3fb950?style=flat-square)
+![Repo](https://img.shields.io/badge/repo-private-555?style=flat-square)
+
+<br/>
+
+[![Overview](https://img.shields.io/badge/▾_What_it_is-2a2a2a?style=for-the-badge)](#what)
+[![Trust ladder](https://img.shields.io/badge/▾_Trust_ladder-2a2a2a?style=for-the-badge)](#tiers)
+[![Scoring](https://img.shields.io/badge/▾_Scoring-2a2a2a?style=for-the-badge)](#scoring)
+[![Checks](https://img.shields.io/badge/▾_Checks-2a2a2a?style=for-the-badge)](#checks)
+[![Architecture](https://img.shields.io/badge/▾_Architecture-2a2a2a?style=for-the-badge)](#arch)
+[![Quickstart](https://img.shields.io/badge/▾_Quickstart-2a2a2a?style=for-the-badge)](#quickstart)
+[![Status](https://img.shields.io/badge/▾_Status-2a2a2a?style=for-the-badge)](#status)
+
+</div>
+
+---
+
+<a id="what"></a>
+
+## 🔍 What it is
+
+Umbermark scans a Linux server, runs **26 weighted hardening checks**, and returns a **0–100 score** with a finding for every check — each one **named, evidenced, and remediated**. The scrubbed, shareable report at `/r/<id>` *is* the product: drop it in a PR or Slack, watch the number climb as you fix things.
+
+**📈 Score history & before/after.** Saved servers keep every scan: a per-server score-over-time chart, the change since the previous and the first scan, and a before/after diff that lists which checks you fixed or regressed.
+Owner-only (never on the shared link) and included with Solo, Pro and Agency.
+
+> [!NOTE]
+> The point isn't a wall of CVEs. It's the **"oh, *that's* exposed?"** moment — one scan surfaces something alarming on most real servers, with a copy-pasteable fix beside it.
+
+**Who it's for:** *"I just inherited this box, what's wrong with it?"* · prosumer self-hosters on Hetzner / OVH / DigitalOcean · small MSPs onboarding client servers.
+
+**Supported targets:** Debian / Ubuntu family (Debian 12, Ubuntu 22.04 & 24.04) and the RHEL family (RHEL / Rocky / Alma / Fedora), auto-detected via `/etc/os-release`.
+
+---
+
+<a id="tiers"></a>
+
+## 🪜 The trust ladder — three ways to scan
+
+You decide how much access to give. **The on-box options return the *same* 26-check report** — the only difference is whether Umbermark ever touches your server.
+
+```mermaid
+flowchart LR
+    C["🖥️ Your Linux server"]
+    R["📊 0-100 score<br/>+ evidenced report"]
+    C -->|"① External · hostname only · no access"| R
+    C -->|"② Run and upload · run an auditable<br/>read-only script, upload the output"| R
+    C -->|"③ Managed SSH · read-only key,<br/>we connect from our servers"| R
+```
+
+| # | Mode | Client grants | We get | Depth | Status |
+|:-:|------|---------------|--------|-------|:------:|
+| **1** | **External** | a hostname / IP | public attack surface (open ports, exposed services, TLS + SSH algorithms offered, HTTP headers) | 7 external checks | ✅ live |
+| **2** | **Run & upload** | *nothing* — runs an auditable read-only script, uploads the output | the **data**, never access | full 26 checks | ✅ live |
+| **3** | **Managed SSH** | a read-only SSH key | we connect & run it | full 26 checks | ✅ live |
+
+> [!TIP]
+> **Tier 2 is the "full confidence" path.** The collector script is small, plain, read-only code you `eval` before running — it changes nothing and (optionally) auto-uploads. You hand over **data, never access**, and get the identical report a managed scan produces. Generated *from the live check catalog*, so it can never drift.
+
+---
+
+<a id="scoring"></a>
+
+## 🎯 How scoring works
+
+Opinionated, transparent, and evidence-backed — the 20-years-of-sysadmin judgment is encoded in the **weights**.
+
+- Every check returns a verdict: `pass` · `warn` · `fail` · `skip` (not applicable / couldn't determine).
+- Score starts at **100**. Each `fail` subtracts its weight; each `warn` subtracts half. Clamped to `[0, 100]`.
+- **Coverage %** is shown alongside the number — the report never fakes certainty.
+
+> [!NOTE]
+> **No feeds to keep fresh.** Every finding is derived from the target's *own* state at scan time — its configs, its package-manager metadata (`apt`/`dnf`), its exposed ports/TLS/SSH. There is **no CVE database, signature set, or threat-intel feed** on Umbermark's side, so there is nothing for an operator to update. Sharpening the catalog means editing the check code + weights and redeploying.
+
+| Band | Score | |
+|------|:-----:|--|
+| 🟡 **gold** | 90–100 | hardened |
+| 🟢 **green** | 70–89 | solid |
+| 🟠 **yellow** | 40–69 | needs work |
+| 🔴 **red** | 0–39 | exposed |
+| ⚪ **incomplete** | — | coverage below threshold |
+
+> [!IMPORTANT]
+> **Outside-in scans of an unverified host show a partial score, not a band.** Only the passive checks run, so the report says `Outside-in score · partial` with the count (`3 of 7 checks ran`) and what verification unlocks. The full hardening score appears only for a verified host or an on-box scan, and a partial score is never plotted in score history.
+
+---
+
+<a id="checks"></a>
+
+## 📋 The check catalog (26)
+
+<details>
+<summary><b>Identity &amp; Auth</b> — 9 checks</summary>
+
+| Severity | Wt | Check |
+|----------|:--:|-------|
+| 🔴 critical | 18 | SSH root login disabled |
+| 🔴 critical | 16 | SSH password authentication disabled (keys only) |
+| 🟠 high | 12 | sudoers NOPASSWD audit |
+| 🟠 high | 12 | sudo requires authentication (PAM) |
+| 🟠 high | 10 | SSH disallows weak ciphers / MACs / key exchange |
+| 🟠 high | 8 | fail2ban installed + enabled with active jails |
+| 🟡 medium | 5 | User accounts have a password-aging policy |
+| 🟡 medium | 4 | Failed SSH login attempts (last 7 days) |
+| ⚪ low | 1 | SSH listening on a non-default port (informational) |
+
+</details>
+
+<details>
+<summary><b>Patching &amp; Updates</b> — 5 checks</summary>
+
+| Severity | Wt | Check |
+|----------|:--:|-------|
+| 🟠 high | 14 | Pending security updates |
+| 🟠 high | 12 | Kernel age (running an up-to-date kernel) |
+| 🟠 high | 10 | Reboot required (kernel / init update pending) |
+| 🟡 medium | 6 | Automatic security updates configured |
+| 🟡 medium | 5 | Package repos have signing keys configured |
+
+</details>
+
+<details>
+<summary><b>Network &amp; Firewall</b> — 4 checks</summary>
+
+| Severity | Wt | Check |
+|----------|:--:|-------|
+| 🔴 critical | 20 | Host firewall has protective input rules |
+| 🟠 high | 12 | All public LISTEN sockets have a firewall allow rule |
+| 🟡 medium | 5 | System clock is synced + NTP service is active |
+| 🟡 medium | 3 | DNS resolver is configured and reachable |
+
+</details>
+
+<details>
+<summary><b>Filesystem</b> — 3 checks</summary>
+
+| Severity | Wt | Check |
+|----------|:--:|-------|
+| 🟠 high | 9 | World-writable files + non-standard SUID binaries audit |
+| 🟠 high | 8 | Root disk has free space |
+| 🟡 medium | 4 | /tmp mounted with noexec + nosuid |
+
+</details>
+
+<details>
+<summary><b>Services / Process &amp; Hardening</b> — 5 checks</summary>
+
+| Severity | Wt | Check |
+|----------|:--:|-------|
+| 🟠 high | 10 | Public-facing LISTEN sockets are on expected ports only |
+| 🟠 high | 10 | Mandatory access control (AppArmor / SELinux) enforcing |
+| 🟡 medium | 6 | No failed systemd units |
+| 🟡 medium | 4 | journald configured for persistent storage |
+| ⚪ low | 2 | No sustained swap pressure |
+
+</details>
+
+> Each check ships a one-paragraph *why it matters* and a copy-pasteable remediation snippet. The catalog is the single source of truth: the Tier-2 collector script is **generated from it**, so the two never diverge.
+
+---
+
+<a id="arch"></a>
+
+## 🏗️ Architecture
+
+```mermaid
+flowchart TD
+    B["🌐 Browser / CLI"] --> CADDY["Caddy<br/>TLS + reverse proxy"]
+    CADDY --> API["FastAPI app"]
+
+    API -->|"③ managed scan"| Q[("Redis + RQ")]
+    Q --> W["Worker"]
+    W -->|"paramiko SSH"| RUN["CommandRunner"]
+
+    API -->|"② run + upload"| CAP["capture: replay bundle"]
+    CAP --> RUN
+
+    RUN --> CHK["26 checks"]
+    CHK --> SCORE["weighted scoring → 0-100"]
+    SCORE --> DB[("SQLite")]
+    API --> DB
+
+    POLAR["Polar webhook"] -->|"Standard Webhooks sig"| API
+    DB -.->|"Litestream"| R2[("Cloudflare R2")]
+```
+
+**The reusable core:** `run_scan(target, runner, checks)`. Every tier swaps only the *runner* — live `paramiko` (Tier 3), a replayed command bundle (Tier 2), and an outside-in network probe (Tier 1, via the parallel `run_external_scan`) — so all paths share one scoring model and one report.
+
+<details>
+<summary><b>Stack</b></summary>
+
+| Layer | Choice |
+|-------|--------|
+| Language | Python 3.10+ |
+| Web | FastAPI · Jinja2 templates |
+| SSH | paramiko |
+| Queue | Redis + RQ |
+| Storage | SQLite (+ Litestream → Cloudflare R2) |
+| Crypto | PyNaCl (SecretBox key encryption) |
+| Billing | Polar.sh via Starhold Account · $5 one-shot + PDF · Solo $9 / Pro $19 / Agency $49 monthly |
+| Captcha | Cloudflare Turnstile (not wired: `TURNSTILE_WIRED=0`) |
+| CLI | Typer (`umbermark` ↔ SaaS sync, scheduler, score-drop alerts) |
+| Deploy | Rootless Podman + systemd quadlet (prod) · Docker Compose (local dev) · Caddy |
+
+</details>
+
+---
+
+<a id="quickstart"></a>
+
+## 🚀 Quickstart (local dev)
+
+> [!IMPORTANT]
+> Local stack runs on WSL Docker; web binds to `localhost:8000` with `BASE_URL=http://localhost:8000` (plain http so session cookies aren't `Secure`-gated).
+
+```bash
+# bring up redis + web + worker (dev overlay, no Caddy/TLS)
+docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d redis web worker
+# → http://localhost:8000
+
+# run the test suite (WSL Debian venv: pip install -e .)
+pip install -e .
+pytest -q
+```
+
+<details>
+<summary><b>CLI</b></summary>
+
+> [!NOTE]
+> The CLI is on PyPI as `umbermark-cli` (`pip install umbermark-cli`; it installs the `umbermark` command, and talks to `https://serverscanner.starhold.app` unless you pass `--api-url` or set `UMBERMARK_API_URL`). `umbermark` on PyPI is only a 0.0.0 name-reservation placeholder for the full server package, which is not published. To work on the code, run from a checkout (`pip install -e .`). The live site never tells visitors to `pip install` anything.
+
+```bash
+umbermark doctor                 # environment check
+umbermark login                  # magic-link loopback auth
+umbermark scan <host>            # scan a server from your machine
+umbermark scan-local             # scan localhost
+umbermark push report.json       # attach a report to your account
+```
+
+</details>
+
+---
+
+<a id="status"></a>
+
+## 📦 Status
+
+> [!NOTE]
+> **Live and open (since 2026-11-14).** Serving at [`serverscanner.starhold.app`](https://serverscanner.starhold.app) (canonical since 2026-11-14; `umbermark.starhold.app` keeps working as an alias, and its API, scan script, upload and check-in paths answer directly for older CLIs and installed scripts) (rootless Podman + systemd quadlet on the Starhold fleet, fronted by Caddy). All three scan tiers work end-to-end. Sign-in is open through **Starhold Account**; the $5 report and the Solo / Pro / Agency plans are on sale, with checkout handled by Starhold Account (Polar is the merchant of record).
+
+- [x] 26-check catalog · weighted scoring · distro-aware engine
+- [x] FastAPI backend · Starhold Account sign-in (`STARSHIP_ENABLED=1`, `SIGNIN_ENABLED=1`; magic links retired) · anonymous scan · scrubbed `/r/<id>` share view
+- [x] Billing through Starhold Account · $5 one-shot · Solo $9 / Pro $19 / Agency $49 monthly (`MONTHLY_PLANS_ENABLED=1`, `CHECKOUT_PAUSED=0`) · PDF reports · 3-month retention · ownership key
+- [x] Typer CLI ↔ SaaS sync · scheduler · score-drop alerts
+- [x] Score history, sparkline and before/after diff per saved server (owner-only)
+- [x] Abuse mitigations (rate limits, keyed-IP-hash audit log kept 1 year) · hourly retention purge
+- [x] Dark **"Slate Vault"** web theme · 3-tier trust-ladder landing
+- [x] **Tier 2 — run & upload** (auditable script → captured bundle → identical report)
+- [x] **Tier 1 — external (outside-in) scanner** (7 credential-less checks · `POST /scan/external` live)
+- [ ] PyPI publish of the CLI (operator account action, still open)
+
+<div align="center">
+<sub>© 2026 Umbermark · built with the help of <a href="https://claude.com/claude-code">Claude Code</a></sub>
+</div>

umbermark_cli-1.0.0/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "umbermark-cli"
+version = "1.0.0"
+description = "Umbermark — Linux server hardening scanner (CLI only)."
+requires-python = ">=3.10"
+dependencies = [
+    "paramiko>=3.4",
+    "typer>=0.12",
+    "jinja2>=3.1",
+    # UMBR-60: imported on the CLI path (push, signing, key encryption); missing
+    # from the first slim build, so the wheel crashed on import in a clean venv.
+    "httpx>=0.27",
+    "pynacl>=1.5",
+    "itsdangerous>=2.2",
+]
+
+[project.scripts]
+umbermark = "umbermark.cli:app"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["umbermark", "umbermark.core*", "umbermark.checks*", "umbermark.cli*"]

umbermark_cli-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

umbermark_cli-1.0.0/src/umbermark/__init__.py

@@ -0,0 +1,18 @@
+"""Umbermark — Linux server hardening scanner."""
+from importlib import metadata as _metadata
+
+# The version is whatever is installed: the slim CLI wheel is "umbermark-cli", the full
+# package is "umbermark". Fall back to a source checkout that is not pip-installed.
+_FALLBACK_VERSION = "0.0.1"
+
+
+def _installed_version() -> str:
+    for dist in ("umbermark-cli", "umbermark"):
+        try:
+            return _metadata.version(dist)
+        except _metadata.PackageNotFoundError:
+            continue
+    return _FALLBACK_VERSION
+
+
+__version__ = _installed_version()

umbermark_cli-1.0.0/src/umbermark/checks/__init__.py

@@ -0,0 +1,88 @@
+"""Check registry — order is the display order in reports."""
+from __future__ import annotations
+
+from umbermark.checks.auto_updates_configured import AutoUpdatesConfiguredCheck
+from umbermark.checks.dns_resolver_sanity import DnsResolverSanityCheck
+from umbermark.checks.fail2ban_enabled import Fail2banEnabledCheck
+from umbermark.checks.failed_login_anomaly import FailedLoginAnomalyCheck
+from umbermark.checks.failed_systemd_units import FailedSystemdUnitsCheck
+from umbermark.checks.firewall_protective import FirewallProtectiveCheck
+from umbermark.checks.journald_persistence import JournaldPersistenceCheck
+from umbermark.checks.kernel_age import KernelAgeCheck
+from umbermark.checks.listen_vs_firewall_delta import ListenVsFirewallDeltaCheck
+from umbermark.checks.mac_framework_enforcing import MacFrameworkEnforcingCheck
+from umbermark.checks.pending_security_updates import PendingSecurityUpdatesCheck
+from umbermark.checks.public_listen_anomalies import PublicListenAnomaliesCheck
+from umbermark.checks.reboot_pending import RebootPendingCheck
+from umbermark.checks.repo_gpg_trust import RepoGpgTrustCheck
+from umbermark.checks.root_disk_free import RootDiskFreeCheck
+from umbermark.checks.ssh_non_default_port import SSHNonDefaultPortCheck
+from umbermark.checks.ssh_password_auth import SSHPasswordAuthCheck
+from umbermark.checks.ssh_permit_root import SSHPermitRootLoginCheck
+from umbermark.checks.ssh_weak_ciphers import SSHWeakCiphersCheck
+from umbermark.checks.sudo_requires_authentication import SudoRequiresAuthenticationCheck
+from umbermark.checks.sudoers_nopasswd import SudoersNopasswdCheck
+from umbermark.checks.swap_pressure import SwapPressureCheck
+from umbermark.checks.time_sync import TimeSyncCheck
+from umbermark.checks.tmp_hardening import TmpHardeningCheck
+from umbermark.checks.user_password_aging import UserPasswordAgingCheck
+from umbermark.checks.world_writable_suid_audit import WorldWritableSuidAuditCheck
+
+ALL_CHECKS = [
+    SSHPermitRootLoginCheck(),
+    SSHPasswordAuthCheck(),
+    SSHWeakCiphersCheck(),
+    SSHNonDefaultPortCheck(),
+    SudoersNopasswdCheck(),
+    SudoRequiresAuthenticationCheck(),
+    UserPasswordAgingCheck(),
+    FailedLoginAnomalyCheck(),
+    Fail2banEnabledCheck(),
+    KernelAgeCheck(),
+    PendingSecurityUpdatesCheck(),
+    RebootPendingCheck(),
+    AutoUpdatesConfiguredCheck(),
+    RepoGpgTrustCheck(),
+    FirewallProtectiveCheck(),
+    TimeSyncCheck(),
+    DnsResolverSanityCheck(),
+    RootDiskFreeCheck(),
+    TmpHardeningCheck(),
+    FailedSystemdUnitsCheck(),
+    SwapPressureCheck(),
+    JournaldPersistenceCheck(),
+    MacFrameworkEnforcingCheck(),
+    PublicListenAnomaliesCheck(),
+    ListenVsFirewallDeltaCheck(),
+    WorldWritableSuidAuditCheck(),
+]
+
+__all__ = [
+    "ALL_CHECKS",
+    "SSHPermitRootLoginCheck",
+    "SSHPasswordAuthCheck",
+    "SSHWeakCiphersCheck",
+    "SSHNonDefaultPortCheck",
+    "SudoersNopasswdCheck",
+    "SudoRequiresAuthenticationCheck",
+    "UserPasswordAgingCheck",
+    "FailedLoginAnomalyCheck",
+    "Fail2banEnabledCheck",
+    "KernelAgeCheck",
+    "PendingSecurityUpdatesCheck",
+    "RebootPendingCheck",
+    "AutoUpdatesConfiguredCheck",
+    "RepoGpgTrustCheck",
+    "FirewallProtectiveCheck",
+    "TimeSyncCheck",
+    "DnsResolverSanityCheck",
+    "RootDiskFreeCheck",
+    "TmpHardeningCheck",
+    "FailedSystemdUnitsCheck",
+    "SwapPressureCheck",
+    "JournaldPersistenceCheck",
+    "MacFrameworkEnforcingCheck",
+    "PublicListenAnomaliesCheck",
+    "ListenVsFirewallDeltaCheck",
+    "WorldWritableSuidAuditCheck",
+]

umbermark_cli-1.0.0/src/umbermark/checks/auto_updates_configured.py

@@ -0,0 +1,149 @@
+"""Automatic security updates configured (unattended-upgrades / dnf-automatic)."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# apt.systemd.daily (apt 2.x) semantics, read from the script on real Ubuntu 24.04:
+#   Enable: numeric, 0 disables the whole job (absent = 1).
+#   Update-Package-Lists / Unattended-Upgrade: "always" or N days; check_stamp treats 0 as off.
+_APT_KEY = r'APT::Periodic::{key}\s+"([^"]*)"'
+
+
+def _apt_value(dump: str, key: str) -> str | None:
+    m = re.search(_APT_KEY.format(key=re.escape(key)), dump)
+    return m.group(1).strip() if m else None
+
+
+def _interval_on(value: str | None) -> bool:
+    """Mirror apt.systemd.daily check_stamp, which compares CASE-SENSITIVELY as shell strings.
+
+    On: exactly "always", or digits with an optional lowercase s/m/h/d suffix. "Always", "1D", "12H"
+    never run in apt, so they are off here. Exactly "0" is off (`[ "$interval" = 0 ]` returns early);
+    "00" and "0d" are not that string, so apt proceeds and they run every time -> on."""
+    if value is None:
+        return False
+    v = value.strip()
+    if v == "always":
+        return True
+    if v == "0":
+        return False
+    return re.fullmatch(r"\d+[smhd]?", v) is not None
+
+
+_TRUTHY = ("yes", "true", "1", "on")
+
+
+def _dnf_applies_updates(conf: str) -> bool:
+    """dnf-automatic only *downloads* unless [commands] apply_updates is truthy (default: no).
+
+    Section-aware: only [commands] counts. The last apply_updates line there wins, with inline
+    ` #`/` ;` comments stripped; a value that is not a recognised yes is treated as NOT yes (never
+    skipped, so it cannot let an earlier `yes` win)."""
+    section = None
+    value = None
+    for line in conf.splitlines():
+        s = line.strip()
+        if not s or s[0] in "#;":
+            continue
+        m = re.fullmatch(r"\[([^\]]+)\]", s)
+        if m:
+            section = m.group(1).strip().lower()
+            continue
+        if section == "commands":
+            kv = re.match(r"apply_updates\s*[=:]\s*(.*)$", s, re.I)
+            if kv:
+                value = re.split(r"\s[#;]", kv.group(1), maxsplit=1)[0].strip().lower()
+    return value in _TRUTHY
+
+class AutoUpdatesConfiguredCheck(Check):
+    id = "auto_updates_configured"
+    title = "Automatic security updates configured"
+    category = "patching"
+    severity = Severity.MEDIUM
+    weight = 6
+    applicable_distros = ("debian", "rhel")
+    remediation = (
+        "Enable automated security patching so you don't have to chase every CVE.\n"
+        "Debian/Ubuntu:\n"
+        "    sudo apt install unattended-upgrades\n"
+        "    sudo dpkg-reconfigure -plow unattended-upgrades\n"
+        "RHEL/Rocky:\n"
+        "    sudo dnf install dnf-automatic\n"
+        "    # dnf-automatic only DOWNLOADS by default; make it install:\n"
+        "    sudo sed -i 's/^apply_updates *=.*/apply_updates = yes/' /etc/dnf/automatic.conf\n"
+        "    sudo systemctl enable --now dnf-automatic.timer\n"
+        "Fedora 41+ (dnf5): sudo dnf install dnf5-plugin-automatic, set apply_updates = yes\n"
+        "under [commands] in /etc/dnf/automatic.conf, then\n"
+        "    sudo systemctl enable --now dnf5-automatic.timer"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # Debian/Ubuntu stock images: unattended-upgrades runs from apt-daily-upgrade.timer ->
+        # apt.systemd.daily, which needs Enable != 0, Update-Package-Lists on (else it upgrades from
+        # stale lists) and Unattended-Upgrade on; plus the package. There is no
+        # unattended-upgrades.timer unit on them (verified on real Ubuntu 24.04 / Debian 12, UMBR-23).
+        timer = runner.run("systemctl is-enabled apt-daily-upgrade.timer 2>/dev/null", timeout=5)
+        lists_timer = runner.run("systemctl is-enabled apt-daily.timer 2>/dev/null", timeout=5)
+        dump = runner.run("apt-config dump APT::Periodic 2>/dev/null", timeout=5)
+        pkg = runner.run(
+            "dpkg-query -W -f='${db:Status-Abbrev}' unattended-upgrades 2>/dev/null", timeout=5
+        )
+        enable = _apt_value(dump.stdout, "Enable")
+        enable_on = enable is None or not (enable.isdigit() and int(enable) == 0)
+        if (
+            timer.ok and timer.stdout.strip() == "enabled"
+            # apt-daily.timer runs `apt.systemd.daily update` (refreshes lists); upgrade timer only installs.
+            and lists_timer.ok and lists_timer.stdout.strip() == "enabled"
+            and pkg.stdout.strip().startswith("ii")
+            and enable_on
+            and _interval_on(_apt_value(dump.stdout, "Update-Package-Lists"))
+            and _interval_on(_apt_value(dump.stdout, "Unattended-Upgrade"))
+        ):
+            return self._finding(
+                Verdict.PASS,
+                evidence=(
+                    "apt-daily-upgrade.timer enabled, unattended-upgrades installed, "
+                    "APT::Periodic Enable/Update-Package-Lists/Unattended-Upgrade all on"
+                ),
+            )
+        # Older/other layouts: a dedicated unattended-upgrades.timer
+        r = runner.run("systemctl is-enabled unattended-upgrades.timer 2>/dev/null", timeout=5)
+        if r.ok and r.stdout.strip() == "enabled":
+            return self._finding(
+                Verdict.PASS, evidence="unattended-upgrades.timer is enabled"
+            )
+        # RHEL: dnf-automatic.timer (dnf4) or dnf5-automatic.timer (dnf5: Fedora 41+, UMBR-33),
+        # but only counts if it APPLIES updates (both default to download only).
+        r2 = runner.run("systemctl is-enabled dnf-automatic.timer 2>/dev/null", timeout=5)
+        r5 = runner.run("systemctl is-enabled dnf5-automatic.timer 2>/dev/null", timeout=5)
+        conf = runner.run("cat /etc/dnf/automatic.conf 2>/dev/null", timeout=5)
+        # dnf5-automatic(8): defaults from this file, then /etc/dnf/automatic.conf applied on top.
+        # Absent on dnf4 hosts, so prepending it is a no-op there; last apply_updates wins.
+        dnf5_defaults = runner.run(
+            "cat /usr/share/dnf5/dnf5-plugins/automatic.conf 2>/dev/null", timeout=5
+        )
+        merged = (dnf5_defaults.stdout if dnf5_defaults.ok else "") + "\n" + conf.stdout
+        for unit, timer in (("dnf5-automatic.timer", r5), ("dnf-automatic.timer", r2)):
+            if not (timer.ok and timer.stdout.strip() == "enabled"):
+                continue
+            if _dnf_applies_updates(merged):
+                return self._finding(
+                    Verdict.PASS, evidence=f"{unit} enabled with apply_updates = yes"
+                )
+            return self._finding(
+                Verdict.WARN,
+                evidence=(
+                    f"{unit} is enabled but the automatic.conf in effect does not set "
+                    "apply_updates = yes (default: only downloads, never installs)"
+                ),
+            )
+        return self._finding(
+            Verdict.WARN,
+            evidence=(
+                "no automatic updates enabled (apt periodic/unattended-upgrades, "
+                "unattended-upgrades.timer and dnf-automatic/dnf5-automatic timers all off or incomplete)"
+            ),
+        )

umbermark_cli-1.0.0/src/umbermark/checks/dns_resolver_sanity.py

@@ -0,0 +1,47 @@
+"""DNS resolver sanity — resolv.conf populated + a known name resolves."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class DnsResolverSanityCheck(Check):
+    id = "dns_resolver_sanity"
+    title = "DNS resolver is configured and reachable"
+    category = "network"
+    severity = Severity.MEDIUM
+    weight = 3
+    applicable_distros = ()
+    remediation = (
+        "Ensure DNS is configured:\n"
+        "    cat /etc/resolv.conf   # should have at least one 'nameserver <ip>' line\n"
+        "If managed by systemd-resolved, point /etc/resolv.conf at it:\n"
+        "    sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        rr = runner.run("cat /etc/resolv.conf 2>/dev/null", timeout=5)
+        # Issue the lookup BEFORE any early return: the capture script is enumerated by running
+        # every check against an all-failing runner, so a command gated behind a successful
+        # resolv.conf read is never captured and replays as "lookup failed" (UMBR-23).
+        rg = runner.run("getent hosts deb.debian.org 2>/dev/null", timeout=8)
+        if not rr.ok or not rr.stdout:
+            return self._finding(
+                Verdict.SKIP, skip_reason="could not read /etc/resolv.conf"
+            )
+        nameservers = [
+            line for line in rr.stdout.splitlines() if line.strip().startswith("nameserver")
+        ]
+        if not nameservers:
+            return self._finding(
+                Verdict.FAIL, evidence="/etc/resolv.conf has 0 nameserver lines"
+            )
+        if rg.ok and rg.stdout.strip():
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"{len(nameservers)} nameserver(s), test lookup succeeded",
+            )
+        return self._finding(
+            Verdict.WARN,
+            evidence=f"{len(nameservers)} nameserver(s) configured but test lookup failed",
+        )