umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/core/webhooks.py

@@ -0,0 +1,177 @@
+"""Outbound alert webhooks: URL validation, SSRF-safe delivery, message bodies (UMBR-66 alert channels).
+
+Three kinds of destination, all customer-configured:
+  webhook  any https URL; gets JSON, signed with HMAC-SHA256 (X-Umbermark-Signature: sha256=<hex>)
+  slack    https://hooks.slack.com/services/...      ({"text": ...})
+  discord  https://discord.com/api/webhooks/...      ({"content": ...}; discordapp.com accepted)
+
+SSRF rules (every send, not only on save):
+  * https only, port 443 only for generic webhooks, no credentials in the URL, no IP-literal hosts;
+  * the host must resolve and EVERY address must be public (core.external.ownership.resolve_public_ips refuses
+    loopback, RFC1918, CGNAT/tailnet, link-local/metadata, multicast and the rest);
+  * the TCP connection goes to the address that was checked (pinned), with SNI and certificate checks against
+    the hostname, so a DNS answer cannot change between the check and the connect;
+  * redirects are never followed (a 3xx counts as a failed delivery);
+  * short timeouts and a capped response read.
+The host's egress firewall (deploy/umk-egress.nft) blocks the same ranges for the app's uid as a second layer.
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import http.client
+import json
+import socket
+import ssl
+from dataclasses import dataclass
+from urllib.parse import urlsplit
+
+KINDS: tuple[str, ...] = ("webhook", "slack", "discord")
+KIND_LABELS = {"webhook": "Webhook (JSON)", "slack": "Slack", "discord": "Discord"}
+MAX_URL_LEN = 500
+TIMEOUT_SECONDS = 8
+_SLACK_HOSTS = {"hooks.slack.com"}
+_DISCORD_HOSTS = {"discord.com", "discordapp.com", "ptb.discord.com", "canary.discord.com"}
+
+
+class WebhookError(ValueError):
+    """The URL is not acceptable, or delivery was refused before any bytes were sent."""
+
+
+@dataclass(frozen=True, slots=True)
+class Target:
+    host: str
+    port: int
+    path: str  # path + query, as sent
+
+
+def validate(kind: str, url: str) -> Target:
+    """Shape checks only (no DNS). Raises WebhookError with a message fit for the form."""
+    if kind not in KINDS:
+        raise WebhookError("Choose webhook, Slack or Discord")
+    url = (url or "").strip()
+    if not url or len(url) > MAX_URL_LEN:
+        raise WebhookError(f"Paste the full https URL (at most {MAX_URL_LEN} characters)")
+    try:
+        u = urlsplit(url)
+        port = u.port or 443
+    except ValueError as exc:
+        raise WebhookError("That is not a valid URL") from exc
+    host = (u.hostname or "").lower().rstrip(".")
+    if u.scheme != "https" or not host:
+        raise WebhookError("The URL must start with https://")
+    if u.username or u.password:
+        raise WebhookError("The URL must not contain a user name or password")
+    if port != 443:
+        raise WebhookError("Only the standard https port (443) is allowed")
+    if _is_ip_literal(host):
+        raise WebhookError("Use a host name, not an IP address")
+    path = (u.path or "/") + (f"?{u.query}" if u.query else "")
+    if kind == "slack" and (host not in _SLACK_HOSTS or not u.path.startswith("/services/")):
+        raise WebhookError("A Slack incoming-webhook URL starts with https://hooks.slack.com/services/")
+    if kind == "discord" and (host not in _DISCORD_HOSTS or not u.path.startswith("/api/webhooks/")):
+        raise WebhookError("A Discord webhook URL starts with https://discord.com/api/webhooks/")
+    return Target(host, port, path)
+
+
+def masked(url: str) -> str:
+    """What the page shows: scheme, host and the last 4 characters (the rest of a Slack/Discord URL is a secret)."""
+    try:
+        u = urlsplit(url)
+        tail = url[-4:] if len(url) > 12 else ""
+        return f"https://{u.hostname}/…{tail}"
+    except ValueError:
+        return "(invalid URL)"
+
+
+def _is_ip_literal(host: str) -> bool:
+    import ipaddress
+
+    try:
+        ipaddress.ip_address(host.strip("[]"))
+        return True
+    except ValueError:
+        return False
+
+
+def _resolve(host: str) -> str:
+    """The first public address of `host`; WebhookError unless every address is public."""
+    from umbermark.core.external.ownership import BlockedTarget, resolve_public_ips
+
+    try:
+        return resolve_public_ips(host)[0]
+    except BlockedTarget as exc:
+        raise WebhookError("That host does not resolve to a public address") from exc
+
+
+class _PinnedHTTPS(http.client.HTTPSConnection):
+    """HTTPS to a fixed IP while SNI and the certificate check use the hostname."""
+
+    def __init__(self, host: str, ip: str, port: int, timeout: float):
+        super().__init__(host, port, timeout=timeout, context=ssl.create_default_context())
+        self._ip = ip
+
+    def connect(self):  # noqa: D401 - http.client hook
+        sock = socket.create_connection((self._ip, self.port), self.timeout)
+        self.sock = self._context.wrap_socket(sock, server_hostname=self.host)
+
+
+def body_for(kind: str, event: dict) -> bytes:
+    """The request body for one alert event (see `drop_event`)."""
+    text = event["text"]
+    if kind == "slack":
+        return json.dumps({"text": text}).encode()
+    if kind == "discord":
+        return json.dumps({"content": text[:1900], "allowed_mentions": {"parse": []}}).encode()
+    return json.dumps({k: v for k, v in event.items() if k != "text"} | {"text": text}, sort_keys=True).encode()
+
+
+def signature(secret: str, body: bytes) -> str:
+    return "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
+
+
+def send(kind: str, url: str, event: dict, *, secret: str | None = None, resolve=None,
+         connection_factory=None) -> int:
+    """Deliver one event. Returns the HTTP status (2xx = delivered). Raises WebhookError before sending when the
+    URL or its addresses are not acceptable; OSError/ssl errors propagate for the caller to record."""
+    t = validate(kind, url)
+    ip = (resolve or _resolve)(t.host)
+    connection_factory = connection_factory or _PinnedHTTPS
+    body = body_for(kind, event)
+    headers = {"Content-Type": "application/json", "User-Agent": "Umbermark-Alerts/1"}
+    if kind == "webhook" and secret:
+        headers["X-Umbermark-Signature"] = signature(secret, body)
+    conn = connection_factory(t.host, ip, t.port, TIMEOUT_SECONDS)
+    try:
+        conn.request("POST", t.path, body=body, headers=headers)
+        resp = conn.getresponse()
+        resp.read(4096)  # capped; never kept
+        return resp.status
+    finally:
+        conn.close()
+
+
+def drop_event(*, label: str, server_id: int, previous: int, current: int, threshold: int, report_url: str) -> dict:
+    """The one alert Umbermark sends today: a score drop at or past the server's threshold."""
+    delta = previous - current
+    return {
+        "event": "score_drop", "server": {"id": server_id, "label": label},
+        "score": {"previous": previous, "current": current, "drop": delta, "threshold": threshold},
+        "report_url": report_url,
+        "text": f"Umbermark: {label} score dropped {delta} points ({previous} -> {current}). {report_url}",
+    }
+
+
+def missed_event(*, label: str, server_id: int, last_checkin_at: str | None, server_url: str) -> dict:
+    """A check-in server did not check in within its interval plus grace (UMBR-66)."""
+    last = (last_checkin_at or "never")[:16].replace("T", " ")
+    return {
+        "event": "missed_checkin", "server": {"id": server_id, "label": label}, "score": None,
+        "last_checkin_at": last_checkin_at, "report_url": server_url,
+        "text": f"Umbermark: {label} missed its scheduled check-in (last check-in: {last} UTC). {server_url}",
+    }
+
+
+def sample_event(label: str = "test") -> dict:
+    return {"event": "test", "server": None, "score": None, "report_url": None,
+            "text": f"Umbermark: test alert for channel '{label}'. If you can read this, alerts reach you."}

umbermark/core/wording.py

@@ -0,0 +1,371 @@
+"""Report wording: how a check's result reads to a human.
+
+A check has three strings, kept apart from the check classes so existing
+stored reports (which only carry ``check_id`` + the old ``title``) pick up new
+wording at render time with no migration:
+
+* ``control``   neutral name of the thing being checked ("SSH cipher strength").
+                Used on SEO pages, the checks index and anywhere no verdict is
+                implied.
+* ``pass_text`` what is right on the server (shown on PASS rows).
+* ``fail_text`` what is wrong on the server (shown on FAIL / WARN rows and in
+                "What cost you points"). Present tense, no "should".
+
+Rule of thumb: ``fail_text`` is a finding, never a control name. A reader who
+only sees the fail text must never think the *good* thing is the problem.
+"""
+from __future__ import annotations
+
+import datetime as dt
+import html
+import re
+from dataclasses import dataclass
+
+from markupsafe import Markup
+
+
+@dataclass(frozen=True)
+class Wording:
+    control: str
+    pass_text: str
+    fail_text: str
+
+
+WORDING: dict[str, Wording] = {
+    # --- identity / auth ---------------------------------------------------
+    "ssh_permit_root_login": Wording(
+        "SSH root login",
+        "SSH does not allow direct root login",
+        "SSH allows direct root login",
+    ),
+    "ssh_password_authentication": Wording(
+        "SSH password login",
+        "SSH only accepts keys; password login is off",
+        "SSH still accepts password logins",
+    ),
+    "ssh_weak_ciphers": Wording(
+        "SSH cipher strength",
+        "SSH only accepts strong ciphers, MACs and key exchange",
+        "SSH still accepts weak ciphers, MACs or key exchange",
+    ),
+    "ssh_non_default_port": Wording(
+        "SSH port",
+        "SSH listens on a non-default port",
+        "SSH listens on the default port 22",
+    ),
+    "sudoers_nopasswd": Wording(
+        "Passwordless sudo rules",
+        "No risky passwordless sudo rules",
+        "Passwordless sudo (NOPASSWD) rules are in place",
+    ),
+    "sudo_requires_authentication": Wording(
+        "sudo authentication",
+        "sudo asks users to authenticate",
+        "sudo lets users in without authenticating",
+    ),
+    "user_password_aging": Wording(
+        "Password aging policy",
+        "Account passwords have an expiry policy",
+        "Some accounts have passwords that never expire",
+    ),
+    "failed_login_anomaly": Wording(
+        "Failed SSH logins (7 days)",
+        "Few failed SSH logins in the last 7 days",
+        "Many failed SSH login attempts in the last 7 days",
+    ),
+    "fail2ban_enabled": Wording(
+        "fail2ban brute-force protection",
+        "fail2ban is running with active jails",
+        "fail2ban is missing, stopped or has no active jails",
+    ),
+    # --- patching ----------------------------------------------------------
+    "kernel_age": Wording(
+        "Kernel age",
+        "The running kernel is recent",
+        "The running kernel is more than 6 months old",
+    ),
+    "pending_security_updates": Wording(
+        "Security updates",
+        "No security updates are waiting",
+        "Security updates are waiting to be installed",
+    ),
+    "reboot_pending": Wording(
+        "Pending reboot",
+        "No reboot is pending",
+        "A reboot is pending, so updates are not active yet",
+    ),
+    "auto_updates_configured": Wording(
+        "Automatic security updates",
+        "Automatic security updates are turned on",
+        "Automatic security updates are not set up",
+    ),
+    "repo_gpg_trust": Wording(
+        "Package signing keys",
+        "Package repositories have signing keys configured",
+        "Package repositories have no signing keys configured",
+    ),
+    # --- network -----------------------------------------------------------
+    "firewall_protective": Wording(
+        "Host firewall",
+        "The host firewall blocks unsolicited inbound traffic",
+        "The host firewall is off or lets inbound traffic through",
+    ),
+    "time_sync": Wording(
+        "Clock synchronisation",
+        "The clock is synced and an NTP service is running",
+        "The clock is not synced or no NTP service is running",
+    ),
+    "dns_resolver_sanity": Wording(
+        "DNS resolver",
+        "DNS is configured and answering",
+        "DNS is misconfigured or not answering",
+    ),
+    # --- filesystem / services / logging / hardening -----------------------
+    "root_disk_free": Wording(
+        "Root disk space",
+        "The root disk has plenty of free space",
+        "The root disk is nearly full",
+    ),
+    "tmp_hardening": Wording(
+        "/tmp mount options",
+        "/tmp is mounted noexec and nosuid",
+        "/tmp allows running programs or setuid files",
+    ),
+    "failed_systemd_units": Wording(
+        "Failed systemd units",
+        "No systemd units have failed",
+        "One or more systemd units have failed",
+    ),
+    "swap_pressure": Wording(
+        "Swap pressure",
+        "The server is not swapping memory to disk",
+        "The server is swapping memory to disk",
+    ),
+    "journald_persistence": Wording(
+        "Persistent system logs",
+        "System logs survive a reboot",
+        "System logs are lost on reboot",
+    ),
+    "mac_framework_enforcing": Wording(
+        "AppArmor / SELinux",
+        "AppArmor or SELinux is enforcing",
+        "AppArmor or SELinux is off or not enforcing",
+    ),
+    "public_listen_anomalies": Wording(
+        "Public listening ports",
+        "Only expected ports listen on public addresses",
+        "Unexpected ports listen on public addresses",
+    ),
+    "listen_vs_firewall_delta": Wording(
+        "Firewall cover for listening ports",
+        "Public listening ports are covered by a deny-by-default firewall",
+        "Public ports are reachable only because the firewall allows everything by default",
+    ),
+    "world_writable_suid_audit": Wording(
+        "World-writable files and SUID binaries",
+        "No unexpected world-writable files or SUID binaries",
+        "Unexpected world-writable files or SUID binaries exist",
+    ),
+    # --- external (outside-in) --------------------------------------------
+    "external_exposed_datastores": Wording(
+        "Exposed data stores",
+        "No database or cache is reachable from the internet",
+        "A database or cache is reachable from the internet",
+    ),
+    "external_legacy_plaintext_services": Wording(
+        "Legacy plaintext services",
+        "No telnet, FTP or r-services are reachable from the internet",
+        "A plaintext service (telnet, FTP or r-service) is reachable from the internet",
+    ),
+    "external_open_management_ports": Wording(
+        "Remote-management ports",
+        "No remote-management ports are reachable from the internet",
+        "Remote-management ports (RDP, VNC, Docker, etcd...) are reachable from the internet",
+    ),
+    "external_ssh_weak_algorithms": Wording(
+        "SSH algorithms (outside view)",
+        "SSH offers only modern algorithms to the internet",
+        "SSH offers weak or deprecated algorithms to the internet",
+    ),
+    "external_ssh_alt_ports": Wording(
+        "SSH algorithms on alternate ports (outside view)",
+        "SSH on alternate ports offers only modern algorithms to the internet",
+        "SSH on an alternate port offers weak or deprecated algorithms to the internet",
+    ),
+    "external_tls_hygiene": Wording(
+        "TLS and certificate",
+        "TLS is modern and the certificate is valid",
+        "TLS uses old protocols or the certificate has a problem",
+    ),
+    "external_http_security_headers": Wording(
+        "HTTP security headers",
+        "HTTPS responses set the core security headers",
+        "HTTPS responses are missing or weakly set core security headers",
+    ),
+}
+
+
+def wording_for(check_id: str, fallback_title: str = "") -> Wording:
+    """Wording for a check; unknown ids (old/foreign payloads) fall back to the
+    stored title for all three strings."""
+    w = WORDING.get(check_id)
+    if w is not None:
+        return w
+    t = fallback_title or check_id
+    return Wording(t, t, t)
+
+
+def control_name(check_id: str, fallback_title: str = "") -> str:
+    return wording_for(check_id, fallback_title).control
+
+
+# --- skip reasons -----------------------------------------------------------
+
+def skip_note(reason: str) -> str:
+    """Public-safe, human reason a check was skipped (no raw command output)."""
+    r = (reason or "").lower()
+    if not r:
+        return "Skipped: no data was available for this check."
+    if "ownership" in r or "re-verify" in r or "not probed (unverified)" in r:
+        return "Skipped: this check only runs after you verify you own the server."
+    if "not applicable" in r or "no protective firewall" in r or "non-systemd" in r:
+        return "Skipped: not applicable to this server."
+    if "check raised" in r:
+        return "Skipped: the check hit an internal error."
+    if "requires root" in r or "needs root" in r:
+        return "Skipped: needs root access, which this scan did not have."
+    if "no tls service" in r or "no https service" in r or "kexinit" in r:
+        return "Skipped: the service did not answer on the expected port."
+    return "Skipped: the data was not available on this server."
+
+
+# --- presentation -------------------------------------------------------------
+
+def points_lost(verdict: str, weight: int) -> int:
+    if verdict == "fail":
+        return int(weight)
+    if verdict == "warn":
+        return int(weight) // 2
+    return 0
+
+
+def _val(x):
+    return x.value if hasattr(x, "value") else x
+
+
+def annotate_finding(f: dict) -> dict:
+    """Add display fields to a finding dict (in place) and return it."""
+    verdict = str(_val(f.get("verdict", "")))
+    w = wording_for(f.get("check_id", ""), f.get("title", ""))
+    f["control"] = w.control
+    if verdict == "pass":
+        f["text"] = w.pass_text
+    elif verdict in ("fail", "warn"):
+        f["text"] = w.fail_text
+    else:
+        f["text"] = w.control
+    lost = points_lost(verdict, f.get("weight", 0))
+    f["points_lost"] = lost
+    f["informational"] = verdict == "warn" and lost == 0
+    if verdict == "skip":
+        f["skip_note"] = f.get("skip_note") or skip_note(f.get("skip_reason", ""))
+    f["remediation_html"] = remediation_html(f.get("remediation", ""))
+    return f
+
+
+def present_payload(payload: dict) -> dict:
+    """Return the payload with display fields added to findings and the
+    deduction list split into points-costing vs informational (0-point) rows."""
+    findings = [annotate_finding(dict(f)) for f in payload.get("findings", [])]
+    out = dict(payload)
+    out["findings"] = findings
+    by_id = {f.get("check_id"): f for f in findings}
+    cost, info = [], []
+    for d in payload.get("result", {}).get("deductions", []):
+        d = dict(d)
+        f = by_id.get(d.get("check_id"))
+        d["text"] = f["text"] if f else wording_for(d.get("check_id", ""), d.get("title", "")).fail_text
+        (cost if d.get("points_lost", 0) > 0 else info).append(d)
+    # Zero-point findings that never produced a Deduction row (e.g. weight 0).
+    seen = {d.get("check_id") for d in cost + info}
+    for f in findings:
+        if f["informational"] and f.get("check_id") not in seen:
+            info.append({"check_id": f.get("check_id"), "severity": _val(f.get("severity", "")),
+                         "verdict": "warn", "points_lost": 0, "text": f["text"]})
+    out["cost_deductions"] = cost
+    out["info_deductions"] = info
+    return out
+
+
+# --- remediation text -> safe HTML -------------------------------------------
+
+_BULLET = re.compile(r"^\s{1,3}(?:-|\d+\.)\s+(.*)$")
+_BACKTICK = re.compile(r"`([^`]+)`")
+
+
+def _inline(s: str) -> str:
+    return _BACKTICK.sub(lambda m: "<code>" + m.group(1) + "</code>", html.escape(s, quote=False))
+
+
+def remediation_html(text: str) -> Markup:
+    """Render a remediation string: indented (4+ spaces) lines become <pre><code>
+    blocks, "  - " / "  1. " lines become list items, hard-wrapped prose lines
+    are joined into paragraphs, `x` becomes <code>x</code>. Everything is
+    HTML-escaped first."""
+    if not text:
+        return Markup("")
+    out: list[str] = []
+    para: list[str] = []
+    code: list[str] = []
+    items: list[str] = []
+
+    def flush() -> None:
+        if para:
+            out.append("<p>" + _inline(" ".join(para)) + "</p>")
+            para.clear()
+        if code:
+            out.append("<pre><code>" + html.escape("\n".join(code), quote=False) + "</code></pre>")
+            code.clear()
+        if items:
+            out.append("<ul>" + "".join("<li>" + _inline(i) + "</li>" for i in items) + "</ul>")
+            items.clear()
+
+    for raw in text.split("\n"):
+        line = raw.rstrip()
+        if not line.strip():
+            flush()
+            continue
+        indent = len(line) - len(line.lstrip(" "))
+        b = _BULLET.match(line) if indent < 4 else None
+        if b:
+            if para or code:
+                flush()
+            items.append(b.group(1))
+            continue
+        if items and indent >= 2:  # wrapped continuation of a bullet
+            items[-1] += " " + line.strip()
+            continue
+        if indent >= 4:
+            if para or items:
+                flush()
+            code.append(line[4:])
+            continue
+        if code or items:
+            flush()
+        para.append(line.strip())
+    flush()
+    return Markup("".join(out))
+
+
+# --- dates ----------------------------------------------------------------
+
+def human_date(iso: str | None) -> str:
+    """'2026-11-21T10:00:00.123456+00:00' -> '21 Nov 2026'. Unparseable input is
+    returned unchanged so we never hide a value."""
+    if not iso:
+        return ""
+    try:
+        d = dt.datetime.fromisoformat(iso)
+    except ValueError:
+        return iso
+    return f"{d.day} {d.strftime('%b %Y')}"

umbermark_cli-1.0.0rc1.dist-info/METADATA

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: umbermark-cli
+Version: 1.0.0rc1
+Summary: Umbermark — Linux server hardening scanner (CLI only).
+Requires-Python: >=3.10
+Requires-Dist: paramiko>=3.4
+Requires-Dist: typer>=0.12
+Requires-Dist: jinja2>=3.1
+Requires-Dist: httpx>=0.27
+Requires-Dist: pynacl>=1.5
+Requires-Dist: itsdangerous>=2.2

umbermark_cli-1.0.0rc1.dist-info/RECORD

@@ -0,0 +1,93 @@
+umbermark/__init__.py,sha256=f15smPp8ezk4d4DQ77dhLtpHz1Vzyz1i8AE-bmxsvvQ,75
+umbermark/checks/__init__.py,sha256=meATU7ey2y7yN1Z34X6nnyB1V4IEQkHD8BlqMsXv_kI,3536
+umbermark/checks/auto_updates_configured.py,sha256=SGUeKPIPzZmSOVkUmXPoe-6dnQXQEAiXFNM75zub_OY,7226
+umbermark/checks/dns_resolver_sanity.py,sha256=pkvlq7AOU1c52YoJRjrJG-tHMMKKvAcrNTlnu6DUHV4,2043
+umbermark/checks/fail2ban_enabled.py,sha256=bXTY1sVCaeLTNodT1ef5lpnts5lgBl3f8Ezpyf1HUu0,3131
+umbermark/checks/failed_login_anomaly.py,sha256=wyL6xFVSKQnDhQ2GMnR80ocCMoIDjDzJOiql7whp7_Q,1978
+umbermark/checks/failed_systemd_units.py,sha256=xQhn00oF1HqpN0Is0n0GIZURG-H7D4kc2xucmiJrmQE,1524
+umbermark/checks/firewall_protective.py,sha256=JjT8SlTyo-suTa3DyicCLm3MkpiOhcH_3JXopq9GH0k,11349
+umbermark/checks/journald_persistence.py,sha256=QXDdz6sqgoUFtxLEbgiImqV1oaGh2pODbw4K3Ua6Hbw,2255
+umbermark/checks/kernel_age.py,sha256=RaPDg4OTdE92qF-3Xf8RzzgilYPHHO1-X1QSPqrM2TA,2753
+umbermark/checks/listen_vs_firewall_delta.py,sha256=mXCrJNGHxoYyZ5TOjsPkwaL2ysbXMvLehLgmQY8XTWU,6045
+umbermark/checks/mac_framework_enforcing.py,sha256=uGFam024Le7Q2uYssaVfaq6CIWs8TW_J95PpnsvDlDI,4385
+umbermark/checks/pending_security_updates.py,sha256=vriHpGaHn-T46LkPm8AVEJjrhlKORqPYzKabbibdMO0,9023
+umbermark/checks/public_listen_anomalies.py,sha256=fLLhR0201bYS2061BOz1mpuMsaPE6ubGDJ1881Zc7cA,8953
+umbermark/checks/reboot_pending.py,sha256=7sWI-Bu6LdFuaRiMn9xJIg2hemtqZHzxrv2jPyv4ZPc,3372
+umbermark/checks/repo_gpg_trust.py,sha256=tV1F7JfCPdZQ6f3P3Hs1W1_CMF-OsBVFzYEHAe5U0G8,4405
+umbermark/checks/root_disk_free.py,sha256=Wl-yAgsK3KwQKRf7L60iz2YE0-t5oTlge51zdimbTF8,1967
+umbermark/checks/ssh_non_default_port.py,sha256=0poTmvUcsZX3gygetFV0O-dDhttw-PIf2Ni10xQ3IQk,2382
+umbermark/checks/ssh_password_auth.py,sha256=NpH1Z6jxWUMkISRwS0dDWMHnkJtT0UJtOeeXDWA_zjE,3516
+umbermark/checks/ssh_permit_root.py,sha256=995A5PvpVkBGbkOF-g9GEKqnNLDrK2rEe7AwryBj6qo,2304
+umbermark/checks/ssh_weak_ciphers.py,sha256=9zrI3baYNeVb30gNoluovSF41gXxlRGt1FMh1hpRuX4,3419
+umbermark/checks/sudo_requires_authentication.py,sha256=h4ssUIVQMRfqHgykuxHb2zcANj0HA-jOfxVUV8VFyZI,2252
+umbermark/checks/sudoers_nopasswd.py,sha256=EGlsZIY_wrXJhWKieCKXhfhoRAyq8MbHWSdWfchxrn0,4807
+umbermark/checks/swap_pressure.py,sha256=aW2ulos4RL1KEJiW5vwnnZLpiD_waSeElrBhjoBdzsI,2046
+umbermark/checks/time_sync.py,sha256=QvXQTl1Va7sGfs0uXXc-vhf_qYIqzWGHO1-BLuY3BwQ,2138
+umbermark/checks/tmp_hardening.py,sha256=OXPGKUJvyL0MtgFpDngKf4QDdx6ab0opJ1bvjQxTaQY,1693
+umbermark/checks/user_password_aging.py,sha256=PV-6yzxGn59S-eTGlQaW1f8Kdz7SZ0-Grc2HG0hcVWI,4139
+umbermark/checks/world_writable_suid_audit.py,sha256=_6jP5MvdCKZqUNLWi6DfTJWT2U5vuq0BP_vz7Blep9A,7969
+umbermark/cli/__init__.py,sha256=OafcDkXjKNGtcm9Jq94td3ziRxmSomi4eyuJ-kDWS0w,82
+umbermark/cli/app.py,sha256=zcrMgD8WRs3xq1KTR4AwOkvrHGKXx1kNO7aeOilcuqE,982
+umbermark/cli/auth.py,sha256=tVHU6A0BWN7ZS12hrcmbQGv5m6vBHLl5NQXsOZc4lBE,1322
+umbermark/cli/config.py,sha256=b-8KF6-LtiXVfEi-WPFuMs2Tb2sCAt3Q8xqpm6TeKD8,386
+umbermark/cli/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+umbermark/cli/commands/doctor.py,sha256=Z4RLfwHawKAkgetjyjYX0ndL5zs9LO5P7KAQ9YHGVSM,527
+umbermark/cli/commands/login.py,sha256=jKFnVjj-2r7JImPXhpCF_unS3WXgivbJeYHnJykYr04,2623
+umbermark/cli/commands/push.py,sha256=ykyiWgNaG7abwrTpkFRr53otPvODJMUS3n74lp_okik,1591
+umbermark/cli/commands/report.py,sha256=OqaVZj7Msux0oGg0B8vrjUsZGTecL-9nO7FzzSS2LUI,825
+umbermark/cli/commands/scan.py,sha256=zVrqksoDMqE-7b5873oPlyPqpyV0VSQE9hP_nD3RXKU,2395
+umbermark/cli/commands/scan_local.py,sha256=fnypb-9iceBR-Ly6_3MywIZIBSYKfkCT1YO3qlTt59k,2212
+umbermark/cli/commands/scan_wsl.py,sha256=P-0pi3YwvtKEHf2kzuNYs9yxV7r64-p-BQpa7QwXfSA,1021
+umbermark/cli/commands/version.py,sha256=H3LVWwojlQp6Sc8vxquSxf89yCCExcTfirmqnWloNf8,249
+umbermark/core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+umbermark/core/accepted.py,sha256=YTfmNw3zVQpderKyje-Fbm8fyAKTGAnrz8pktSU4Z8U,2783
+umbermark/core/access.py,sha256=8FogW5EfcLaec3sD5ZkQjjG2H7WUW0fOQ0VJyOwWi9A,39801
+umbermark/core/capture.py,sha256=MnD3cLC3eIaMxT6pt-JSm9V136i7jp38WdL0R_w9j0M,9208
+umbermark/core/check.py,sha256=xgpGu6wBwycBk4KrgKOHzza7JwLLn4rEUNPbjLPPw20,2289
+umbermark/core/checkin.py,sha256=YZKHU6uxrB2cPZy2NFWkUFIBXm0RmSETwg2Ow8rKByw,4073
+umbermark/core/crypto.py,sha256=FioGtwhLM61hZvA__L9mNN7vVfPtqGUTGnO4PFCpdGI,552
+umbermark/core/duration.py,sha256=9ArbjuIGhrYxI9B6jkr4_HBC6Rw9YANe_D1GDumoMG8,1704
+umbermark/core/engine.py,sha256=NvpQlfjFKa_S76_g6NZ4bUbL5TS8QWDJ3ubr7JpEzvA,2434
+umbermark/core/firewall.py,sha256=phz079QyUBglp_-4BsCQvS7xfJLiX5jocAGDSPjVjrc,28651
+umbermark/core/fleet.py,sha256=CJoqoUmoBBwxkE8ppIxH2fWOtArKjq9r8DcUZ_fQkQs,3747
+umbermark/core/history.py,sha256=qCNbRdijXXBNwoCG-IwOqcrOoKXALMUevxIQ5t5aeRY,9449
+umbermark/core/html_report.py,sha256=KZXirarag99yuZJROJWY_i7WYV70J5J9uHvXimwYD-o,11826
+umbermark/core/keyenc.py,sha256=8xocjqYFR8zKhX1g455ZW2LtNYxrjQgHFFvGHhnb6uk,1464
+umbermark/core/labels.py,sha256=Ir_JH2dSq3uGKLP3tTl6xr-QNHWhNexmHHpUMYtn-pc,844
+umbermark/core/lifecycle.py,sha256=oBilfueGuqL3YiLjW4rlxEEplRABCY000KBJK7rRmYk,3975
+umbermark/core/logredact.py,sha256=fj9FJ-E5c_9DR3AaVi7HbgfaFZe3O9SZpsAApQJ62mA,1523
+umbermark/core/partial.py,sha256=OkfQuMjJYUJBdigNXwf-j_XcazhRpoKBTfVlkXrDWNM,2232
+umbermark/core/platform.py,sha256=QRY5Yzz1t4YlNUSgqd8n-C_fDvrOBNe0VNP-y1R8Nck,2355
+umbermark/core/redact.py,sha256=LesaIucpdiNKl5JAxsIhwuF-ayyuDWn2-OjUK-9J0Nc,3159
+umbermark/core/report.py,sha256=UM9VDYHivLTuNmYFGFreosgtjAIh5d3QitecxyAET60,746
+umbermark/core/scoring.py,sha256=vDTeaHp8mqZKBofs2xIJ40P7v_FdSXZv-kSQogl7EZM,2833
+umbermark/core/settings.py,sha256=BIp83Cfp5dwmHjxCzHwkvPg0CVGsypp65Y0vy8JPooQ,12542
+umbermark/core/short_id.py,sha256=LFRLtScYRgilCa1EEnnjdVJNImBaA7-1QxOnMH4I4OQ,817
+umbermark/core/signing.py,sha256=07Cc7f16PKhTbatznzexGTGOeNZhbJGap5QvcTllNTs,909
+umbermark/core/ssh.py,sha256=K40zfyd26K-lZT8mi0E6hWSt-wQYwiLKZlO8z6TWYAE,4392
+umbermark/core/ssh_fingerprint.py,sha256=s2eGduJBxbmpjD2tAkVWd1XQE9cgMfpT1zY36aE6d5c,632
+umbermark/core/tiers.py,sha256=ZDpPrbLDC68K5CgO1SKZ5Ey7mqDCjsNbQJBeNX3OB1A,5345
+umbermark/core/webhooks.py,sha256=AdkqeaCRMilJufZ5oxQCoaXKBMa0Di3s4S5TMOn8MGc,7792
+umbermark/core/wording.py,sha256=Yw0eB2zsMWJBm81X11A35KxRnlpS7GgLiGB-5_sKhYc,13924
+umbermark/core/external/__init__.py,sha256=NMyipAiYW4PpAfkonW6tGmesTBMRxnE8vmDNFv301Vw,288
+umbermark/core/external/check.py,sha256=1Ql1FkgD3u4K8ALlPOboJexC5CIFLfsCrUBf1K-jC9U,1827
+umbermark/core/external/engine.py,sha256=35AJVhM9VWnvlL9cWtjlpjJX8HiJVLAXZBlI3CPS86o,3226
+umbermark/core/external/ownership.py,sha256=zpvz9QkSEUegzNJWA8LnSiNXUxdQicdz8fDZLbCAspE,20794
+umbermark/core/external/probe.py,sha256=wkqGZg-AU3P8jJLyWNHgsbaKDde18A2OmdUap0YaQrY,3861
+umbermark/core/external/socket_probe.py,sha256=pCt9bKguSsYDah6HjYq71NLIAhrgeMfD8TO63V1TeQ8,16157
+umbermark/core/external/checks/__init__.py,sha256=sibKeKHcgUm8DeweGF0ROnap8zcxkzRwZucPkRWwzB0,1169
+umbermark/core/external/checks/exposed_datastores.py,sha256=ssFUxGSJoCkTm9VwmtErPUq4DEhsnH4bbXSTrfCJ24U,2140
+umbermark/core/external/checks/http_security_headers.py,sha256=vqLEQuNYr10WhdTzcCkmqjmJG96QSLHIEECL0mKILCk,10602
+umbermark/core/external/checks/legacy_services.py,sha256=iAAxHEdDkY7NCrv3UViH83d1EOtKK65qV1ofLROxVxA,1898
+umbermark/core/external/checks/open_management_ports.py,sha256=wpuJUGpytXiZxp-wsD2bORxgmp2SH3QduTsDZmaMXKQ,2681
+umbermark/core/external/checks/ssh_alt_ports.py,sha256=PAdEOTrvhGFjUQwHUIf0yAU5Cef94KVORULhYxTXa5c,3600
+umbermark/core/external/checks/ssh_weak_algorithms.py,sha256=9PKozJwfOvE-xrYcyajh6iyouEkN10EQOD6RKeefvUw,3603
+umbermark/core/external/checks/tls_hygiene.py,sha256=sCkM0RH22fiWH6LLRYLe6Og-KatMcYQ3nVI_Et7vYLA,4989
+umbermark/core/pdf/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+umbermark/core/pdf/renderer.py,sha256=05XW10Yqh3Ndwyv7zfdrUBea-haNu7WY4p-zLlAXwXM,815
+umbermark/core/pdf/weasyprint_renderer.py,sha256=tQbrSNOM-1Y-YNB6HCchA4dYkF4jTWXpCY-Sn6w2j88,616
+umbermark_cli-1.0.0rc1.dist-info/METADATA,sha256=auk3QsD9expQZE4LE3FI0zm_5RbrwCXQewhO-IDgF64,331
+umbermark_cli-1.0.0rc1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+umbermark_cli-1.0.0rc1.dist-info/entry_points.txt,sha256=QN7Tr9MH2fInhCNRYDOz9H5YFJwuGuo7WgpgEHMWZcY,48
+umbermark_cli-1.0.0rc1.dist-info/top_level.txt,sha256=d3SP0jhXKY0P_B_52xzKfnpLWnbUhedUltMqcA8BFEA,10
+umbermark_cli-1.0.0rc1.dist-info/RECORD,,

umbermark_cli-1.0.0rc1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

umbermark_cli-1.0.0rc1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+umbermark = umbermark.cli:app

umbermark_cli-1.0.0rc1.dist-info/top_level.txt

@@ -0,0 +1 @@
+umbermark