umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/__init__.py

@@ -0,0 +1,3 @@
+"""Umbermark — Linux server hardening scanner."""
+
+__version__ = "0.0.1"

umbermark/checks/__init__.py

@@ -0,0 +1,88 @@
+"""Check registry — order is the display order in reports."""
+from __future__ import annotations
+
+from umbermark.checks.auto_updates_configured import AutoUpdatesConfiguredCheck
+from umbermark.checks.dns_resolver_sanity import DnsResolverSanityCheck
+from umbermark.checks.fail2ban_enabled import Fail2banEnabledCheck
+from umbermark.checks.failed_login_anomaly import FailedLoginAnomalyCheck
+from umbermark.checks.failed_systemd_units import FailedSystemdUnitsCheck
+from umbermark.checks.firewall_protective import FirewallProtectiveCheck
+from umbermark.checks.journald_persistence import JournaldPersistenceCheck
+from umbermark.checks.kernel_age import KernelAgeCheck
+from umbermark.checks.listen_vs_firewall_delta import ListenVsFirewallDeltaCheck
+from umbermark.checks.mac_framework_enforcing import MacFrameworkEnforcingCheck
+from umbermark.checks.pending_security_updates import PendingSecurityUpdatesCheck
+from umbermark.checks.public_listen_anomalies import PublicListenAnomaliesCheck
+from umbermark.checks.reboot_pending import RebootPendingCheck
+from umbermark.checks.repo_gpg_trust import RepoGpgTrustCheck
+from umbermark.checks.root_disk_free import RootDiskFreeCheck
+from umbermark.checks.ssh_non_default_port import SSHNonDefaultPortCheck
+from umbermark.checks.ssh_password_auth import SSHPasswordAuthCheck
+from umbermark.checks.ssh_permit_root import SSHPermitRootLoginCheck
+from umbermark.checks.ssh_weak_ciphers import SSHWeakCiphersCheck
+from umbermark.checks.sudo_requires_authentication import SudoRequiresAuthenticationCheck
+from umbermark.checks.sudoers_nopasswd import SudoersNopasswdCheck
+from umbermark.checks.swap_pressure import SwapPressureCheck
+from umbermark.checks.time_sync import TimeSyncCheck
+from umbermark.checks.tmp_hardening import TmpHardeningCheck
+from umbermark.checks.user_password_aging import UserPasswordAgingCheck
+from umbermark.checks.world_writable_suid_audit import WorldWritableSuidAuditCheck
+
+ALL_CHECKS = [
+    SSHPermitRootLoginCheck(),
+    SSHPasswordAuthCheck(),
+    SSHWeakCiphersCheck(),
+    SSHNonDefaultPortCheck(),
+    SudoersNopasswdCheck(),
+    SudoRequiresAuthenticationCheck(),
+    UserPasswordAgingCheck(),
+    FailedLoginAnomalyCheck(),
+    Fail2banEnabledCheck(),
+    KernelAgeCheck(),
+    PendingSecurityUpdatesCheck(),
+    RebootPendingCheck(),
+    AutoUpdatesConfiguredCheck(),
+    RepoGpgTrustCheck(),
+    FirewallProtectiveCheck(),
+    TimeSyncCheck(),
+    DnsResolverSanityCheck(),
+    RootDiskFreeCheck(),
+    TmpHardeningCheck(),
+    FailedSystemdUnitsCheck(),
+    SwapPressureCheck(),
+    JournaldPersistenceCheck(),
+    MacFrameworkEnforcingCheck(),
+    PublicListenAnomaliesCheck(),
+    ListenVsFirewallDeltaCheck(),
+    WorldWritableSuidAuditCheck(),
+]
+
+__all__ = [
+    "ALL_CHECKS",
+    "SSHPermitRootLoginCheck",
+    "SSHPasswordAuthCheck",
+    "SSHWeakCiphersCheck",
+    "SSHNonDefaultPortCheck",
+    "SudoersNopasswdCheck",
+    "SudoRequiresAuthenticationCheck",
+    "UserPasswordAgingCheck",
+    "FailedLoginAnomalyCheck",
+    "Fail2banEnabledCheck",
+    "KernelAgeCheck",
+    "PendingSecurityUpdatesCheck",
+    "RebootPendingCheck",
+    "AutoUpdatesConfiguredCheck",
+    "RepoGpgTrustCheck",
+    "FirewallProtectiveCheck",
+    "TimeSyncCheck",
+    "DnsResolverSanityCheck",
+    "RootDiskFreeCheck",
+    "TmpHardeningCheck",
+    "FailedSystemdUnitsCheck",
+    "SwapPressureCheck",
+    "JournaldPersistenceCheck",
+    "MacFrameworkEnforcingCheck",
+    "PublicListenAnomaliesCheck",
+    "ListenVsFirewallDeltaCheck",
+    "WorldWritableSuidAuditCheck",
+]

umbermark/checks/auto_updates_configured.py

@@ -0,0 +1,149 @@
+"""Automatic security updates configured (unattended-upgrades / dnf-automatic)."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# apt.systemd.daily (apt 2.x) semantics, read from the script on real Ubuntu 24.04:
+#   Enable: numeric, 0 disables the whole job (absent = 1).
+#   Update-Package-Lists / Unattended-Upgrade: "always" or N days; check_stamp treats 0 as off.
+_APT_KEY = r'APT::Periodic::{key}\s+"([^"]*)"'
+
+
+def _apt_value(dump: str, key: str) -> str | None:
+    m = re.search(_APT_KEY.format(key=re.escape(key)), dump)
+    return m.group(1).strip() if m else None
+
+
+def _interval_on(value: str | None) -> bool:
+    """Mirror apt.systemd.daily check_stamp, which compares CASE-SENSITIVELY as shell strings.
+
+    On: exactly "always", or digits with an optional lowercase s/m/h/d suffix. "Always", "1D", "12H"
+    never run in apt, so they are off here. Exactly "0" is off (`[ "$interval" = 0 ]` returns early);
+    "00" and "0d" are not that string, so apt proceeds and they run every time -> on."""
+    if value is None:
+        return False
+    v = value.strip()
+    if v == "always":
+        return True
+    if v == "0":
+        return False
+    return re.fullmatch(r"\d+[smhd]?", v) is not None
+
+
+_TRUTHY = ("yes", "true", "1", "on")
+
+
+def _dnf_applies_updates(conf: str) -> bool:
+    """dnf-automatic only *downloads* unless [commands] apply_updates is truthy (default: no).
+
+    Section-aware: only [commands] counts. The last apply_updates line there wins, with inline
+    ` #`/` ;` comments stripped; a value that is not a recognised yes is treated as NOT yes (never
+    skipped, so it cannot let an earlier `yes` win)."""
+    section = None
+    value = None
+    for line in conf.splitlines():
+        s = line.strip()
+        if not s or s[0] in "#;":
+            continue
+        m = re.fullmatch(r"\[([^\]]+)\]", s)
+        if m:
+            section = m.group(1).strip().lower()
+            continue
+        if section == "commands":
+            kv = re.match(r"apply_updates\s*[=:]\s*(.*)$", s, re.I)
+            if kv:
+                value = re.split(r"\s[#;]", kv.group(1), maxsplit=1)[0].strip().lower()
+    return value in _TRUTHY
+
+class AutoUpdatesConfiguredCheck(Check):
+    id = "auto_updates_configured"
+    title = "Automatic security updates configured"
+    category = "patching"
+    severity = Severity.MEDIUM
+    weight = 6
+    applicable_distros = ("debian", "rhel")
+    remediation = (
+        "Enable automated security patching so you don't have to chase every CVE.\n"
+        "Debian/Ubuntu:\n"
+        "    sudo apt install unattended-upgrades\n"
+        "    sudo dpkg-reconfigure -plow unattended-upgrades\n"
+        "RHEL/Rocky:\n"
+        "    sudo dnf install dnf-automatic\n"
+        "    # dnf-automatic only DOWNLOADS by default; make it install:\n"
+        "    sudo sed -i 's/^apply_updates *=.*/apply_updates = yes/' /etc/dnf/automatic.conf\n"
+        "    sudo systemctl enable --now dnf-automatic.timer\n"
+        "Fedora 41+ (dnf5): sudo dnf install dnf5-plugin-automatic, set apply_updates = yes\n"
+        "under [commands] in /etc/dnf/automatic.conf, then\n"
+        "    sudo systemctl enable --now dnf5-automatic.timer"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # Debian/Ubuntu stock images: unattended-upgrades runs from apt-daily-upgrade.timer ->
+        # apt.systemd.daily, which needs Enable != 0, Update-Package-Lists on (else it upgrades from
+        # stale lists) and Unattended-Upgrade on; plus the package. There is no
+        # unattended-upgrades.timer unit on them (verified on real Ubuntu 24.04 / Debian 12, UMBR-23).
+        timer = runner.run("systemctl is-enabled apt-daily-upgrade.timer 2>/dev/null", timeout=5)
+        lists_timer = runner.run("systemctl is-enabled apt-daily.timer 2>/dev/null", timeout=5)
+        dump = runner.run("apt-config dump APT::Periodic 2>/dev/null", timeout=5)
+        pkg = runner.run(
+            "dpkg-query -W -f='${db:Status-Abbrev}' unattended-upgrades 2>/dev/null", timeout=5
+        )
+        enable = _apt_value(dump.stdout, "Enable")
+        enable_on = enable is None or not (enable.isdigit() and int(enable) == 0)
+        if (
+            timer.ok and timer.stdout.strip() == "enabled"
+            # apt-daily.timer runs `apt.systemd.daily update` (refreshes lists); upgrade timer only installs.
+            and lists_timer.ok and lists_timer.stdout.strip() == "enabled"
+            and pkg.stdout.strip().startswith("ii")
+            and enable_on
+            and _interval_on(_apt_value(dump.stdout, "Update-Package-Lists"))
+            and _interval_on(_apt_value(dump.stdout, "Unattended-Upgrade"))
+        ):
+            return self._finding(
+                Verdict.PASS,
+                evidence=(
+                    "apt-daily-upgrade.timer enabled, unattended-upgrades installed, "
+                    "APT::Periodic Enable/Update-Package-Lists/Unattended-Upgrade all on"
+                ),
+            )
+        # Older/other layouts: a dedicated unattended-upgrades.timer
+        r = runner.run("systemctl is-enabled unattended-upgrades.timer 2>/dev/null", timeout=5)
+        if r.ok and r.stdout.strip() == "enabled":
+            return self._finding(
+                Verdict.PASS, evidence="unattended-upgrades.timer is enabled"
+            )
+        # RHEL: dnf-automatic.timer (dnf4) or dnf5-automatic.timer (dnf5: Fedora 41+, UMBR-33),
+        # but only counts if it APPLIES updates (both default to download only).
+        r2 = runner.run("systemctl is-enabled dnf-automatic.timer 2>/dev/null", timeout=5)
+        r5 = runner.run("systemctl is-enabled dnf5-automatic.timer 2>/dev/null", timeout=5)
+        conf = runner.run("cat /etc/dnf/automatic.conf 2>/dev/null", timeout=5)
+        # dnf5-automatic(8): defaults from this file, then /etc/dnf/automatic.conf applied on top.
+        # Absent on dnf4 hosts, so prepending it is a no-op there; last apply_updates wins.
+        dnf5_defaults = runner.run(
+            "cat /usr/share/dnf5/dnf5-plugins/automatic.conf 2>/dev/null", timeout=5
+        )
+        merged = (dnf5_defaults.stdout if dnf5_defaults.ok else "") + "\n" + conf.stdout
+        for unit, timer in (("dnf5-automatic.timer", r5), ("dnf-automatic.timer", r2)):
+            if not (timer.ok and timer.stdout.strip() == "enabled"):
+                continue
+            if _dnf_applies_updates(merged):
+                return self._finding(
+                    Verdict.PASS, evidence=f"{unit} enabled with apply_updates = yes"
+                )
+            return self._finding(
+                Verdict.WARN,
+                evidence=(
+                    f"{unit} is enabled but the automatic.conf in effect does not set "
+                    "apply_updates = yes (default: only downloads, never installs)"
+                ),
+            )
+        return self._finding(
+            Verdict.WARN,
+            evidence=(
+                "no automatic updates enabled (apt periodic/unattended-upgrades, "
+                "unattended-upgrades.timer and dnf-automatic/dnf5-automatic timers all off or incomplete)"
+            ),
+        )

umbermark/checks/dns_resolver_sanity.py

@@ -0,0 +1,47 @@
+"""DNS resolver sanity — resolv.conf populated + a known name resolves."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class DnsResolverSanityCheck(Check):
+    id = "dns_resolver_sanity"
+    title = "DNS resolver is configured and reachable"
+    category = "network"
+    severity = Severity.MEDIUM
+    weight = 3
+    applicable_distros = ()
+    remediation = (
+        "Ensure DNS is configured:\n"
+        "    cat /etc/resolv.conf   # should have at least one 'nameserver <ip>' line\n"
+        "If managed by systemd-resolved, point /etc/resolv.conf at it:\n"
+        "    sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        rr = runner.run("cat /etc/resolv.conf 2>/dev/null", timeout=5)
+        # Issue the lookup BEFORE any early return: the capture script is enumerated by running
+        # every check against an all-failing runner, so a command gated behind a successful
+        # resolv.conf read is never captured and replays as "lookup failed" (UMBR-23).
+        rg = runner.run("getent hosts deb.debian.org 2>/dev/null", timeout=8)
+        if not rr.ok or not rr.stdout:
+            return self._finding(
+                Verdict.SKIP, skip_reason="could not read /etc/resolv.conf"
+            )
+        nameservers = [
+            line for line in rr.stdout.splitlines() if line.strip().startswith("nameserver")
+        ]
+        if not nameservers:
+            return self._finding(
+                Verdict.FAIL, evidence="/etc/resolv.conf has 0 nameserver lines"
+            )
+        if rg.ok and rg.stdout.strip():
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"{len(nameservers)} nameserver(s), test lookup succeeded",
+            )
+        return self._finding(
+            Verdict.WARN,
+            evidence=f"{len(nameservers)} nameserver(s) configured but test lookup failed",
+        )

umbermark/checks/fail2ban_enabled.py

@@ -0,0 +1,67 @@
+"""fail2ban — installed, enabled, and actively jailing things."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import Reachability, get_access_context, is_nonpublic
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class Fail2banEnabledCheck(Check):
+    id = "fail2ban_enabled"
+    title = "fail2ban installed + enabled with active jails"
+    category = "identity_auth"
+    severity = Severity.HIGH
+    weight = 8
+    applicable_distros = ()
+    remediation = (
+        "Install + enable fail2ban with at least the sshd jail:\n"
+        "    Debian/Ubuntu: sudo apt install fail2ban && sudo systemctl enable --now fail2ban\n"
+        "    RHEL/Rocky:    sudo dnf install epel-release && sudo dnf install fail2ban\n"
+        "                   sudo systemctl enable --now fail2ban\n"
+        "Confirm with: sudo fail2ban-client status sshd"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("systemctl is-active fail2ban 2>/dev/null", timeout=5)
+        # Issued before the early return so the capture enumerator (all-failing runner) sees it (UMBR-23).
+        r2 = runner.run("fail2ban-client status 2>/dev/null", sudo=True, timeout=5)
+        if not r.ok or r.stdout.strip() != "active":
+            evidence = f"fail2ban not active (systemctl is-active -> {r.stdout.strip() or 'n/a'})"
+            ctx = get_access_context(runner)
+            if is_nonpublic(ctx):
+                # Informational: fail2ban's job is throttling brute force against
+                # reachable services; SSH here is not reachable from the internet.
+                return self._finding(
+                    Verdict.WARN,
+                    evidence=(
+                        f"{evidence}. Informational only: SSH is not publicly reachable "
+                        f"({ctx.reachability.value}: {ctx.reachability_note}), so there is "
+                        "little brute-force traffic for fail2ban to act on."
+                    ),
+                    severity=Severity.LOW,
+                    weight=0,
+                )
+            if ctx.reachability == Reachability.UNKNOWN:
+                evidence += f". Exposure could not be determined ({ctx.reachability_note}); severity not reduced."
+            return self._finding(Verdict.FAIL, evidence=evidence)
+        if not r2.ok or not r2.stdout:
+            return self._finding(
+                Verdict.WARN,
+                evidence="fail2ban active but status query failed — daemon may be unhealthy",
+            )
+        m = re.search(r"Number of jail:\s*(\d+)", r2.stdout)
+        if m:
+            jails = int(m.group(1))
+            if jails == 0:
+                return self._finding(
+                    Verdict.WARN,
+                    evidence="fail2ban active but 0 jails configured",
+                )
+            return self._finding(
+                Verdict.PASS, evidence=f"fail2ban active, {jails} jail(s)"
+            )
+        return self._finding(
+            Verdict.WARN, evidence="fail2ban active but jail count unparseable"
+        )

umbermark/checks/failed_login_anomaly.py

@@ -0,0 +1,48 @@
+"""Failed SSH login attempts in the last 7 days — anomaly threshold."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+_CMD = (
+    "journalctl _COMM=sshd _COMM=sshd-session --since '7 days ago' --no-pager 2>/dev/null "
+    "| grep -cE 'Failed password|Invalid user'"
+)
+
+
+class FailedLoginAnomalyCheck(Check):
+    id = "failed_login_anomaly"
+    title = "Failed SSH login attempts (last 7 days)"
+    category = "identity_auth"
+    severity = Severity.MEDIUM
+    weight = 4
+    applicable_distros = ()
+    remediation = (
+        "Reduce brute-force exposure (drive-by scanners cause most failed logins):\n"
+        "  - install + enable fail2ban (auto-bans repeat offenders)\n"
+        "  - move SSH off port 22 to reduce scan traffic\n"
+        "  - restrict SSH source IPs at the firewall when feasible\n"
+        "  - confirm no real account is being targeted (look for repeated\n"
+        "    Failed-password attempts against the SAME username)"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run(_CMD, sudo=True, timeout=15)
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="could not parse journalctl sshd output (requires root + systemd-journald)",
+            )
+        try:
+            count = int(r.stdout.strip())
+        except ValueError:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason=f"unparseable count: {r.stdout.strip()!r}",
+            )
+        evidence = f"{count} failed SSH login attempts in last 7 days"
+        if count < 50:
+            return self._finding(Verdict.PASS, evidence=evidence)
+        if count < 500:
+            return self._finding(Verdict.WARN, evidence=evidence + " — elevated")
+        return self._finding(Verdict.FAIL, evidence=evidence + " — high volume")

umbermark/checks/failed_systemd_units.py

@@ -0,0 +1,41 @@
+"""Failed systemd units."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class FailedSystemdUnitsCheck(Check):
+    id = "failed_systemd_units"
+    title = "No failed systemd units"
+    category = "services"
+    severity = Severity.MEDIUM
+    weight = 6
+    applicable_distros = ()
+    remediation = (
+        "Investigate each failed unit:\n"
+        "    sudo systemctl --failed\n"
+        "    sudo systemctl status <unit>\n"
+        "    sudo journalctl -u <unit> -n 100\n"
+        "Common causes: misconfigured timer dependency, missing binary, OOM-killed."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("systemctl --failed --no-legend 2>/dev/null", timeout=5)
+        if not r.ok:
+            return self._finding(
+                Verdict.SKIP, skip_reason="systemctl --failed failed (non-systemd init?)"
+            )
+        units = [ln for ln in r.stdout.splitlines() if ln.strip()]
+        count = len(units)
+        if count == 0:
+            return self._finding(Verdict.PASS, evidence="0 failed units")
+        if count <= 2:
+            return self._finding(
+                Verdict.WARN,
+                evidence=f"{count} failed unit(s): {', '.join(u.split()[0] for u in units[:3])}",
+            )
+        return self._finding(
+            Verdict.FAIL,
+            evidence=f"{count} failed units (first 3: {', '.join(u.split()[0] for u in units[:3])})",
+        )