umbermark-cli 1.0.0rc1__py3-none-any.whl

umbermark/checks/pending_security_updates.py

@@ -0,0 +1,188 @@
+"""Pending security updates — apt-check on Ubuntu, apt-get -s fallback on Debian."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# First token of a `dnf check-update` row: "<name>.<arch>". Continuation and header lines may
+# also match; that only adds keys no advisory package will ever hit.
+_NAME_ARCH = re.compile(r"^(\S+)\.([A-Za-z0-9_]+)$")
+
+
+def _upgradable(check_update) -> set[tuple[str, str]] | None:
+    """(name, arch) pairs `dnf check-update` would upgrade, or None if it gave no usable answer.
+
+    check-update compares against the NEWEST installed version of each package, so it is the
+    authority on what is still pending. Exit 0 means nothing to upgrade (its stdout can still
+    carry "Security: ..." notices); exit 100 means the rows are upgrades."""
+    if check_update.exit_code == 0:
+        return set()
+    if check_update.exit_code != 100:
+        return None
+    out: set[tuple[str, str]] = set()
+    for ln in check_update.stdout.splitlines():
+        parts = ln.split()
+        m = _NAME_ARCH.match(parts[0]) if parts else None
+        if m:
+            out.add((m.group(1), m.group(2)))
+    return out
+
+
+def _is_security_row(line: str) -> bool:
+    """dnf4 rows are (ID, "<Severity>/Sec.", package). dnf5 rows have FIVE columns, in this order:
+    Name, Type, Severity, Package, Issued (libdnf5 advisorylist.cpp; dnf5-advisory(8)). Type is
+    "security" (bugfix/enhancement/... are other types); Issued is a date plus time, so the LAST token
+    is NOT the package: use _row_nevra() to find it."""
+    if not line.strip():
+        return False
+    if "Sec." in line:
+        return True
+    parts = line.split()
+    return len(parts) >= 3 and parts[1].lower() == "security"
+
+
+def _row_nevra(line: str) -> str:
+    """Package NEVRA of an updateinfo row. dnf4: last column. dnf5 (Name, Type, Severity, Package,
+    Issued): the fourth column, because the last token is the Issued time."""
+    parts = line.split()
+    if len(parts) >= 3 and parts[1].lower() == "security":
+        # An empty Severity cell collapses under split(), shifting Package to index 2: take the
+        # first token after Type that parses as a NEVRA (not the fixed index 3). Package names may
+        # start with a digit (7zip, 389-ds-base); date/time/severity tokens have no "." so never parse.
+        for tok in parts[2:]:
+            if _advisory_name_arch(tok) is not None and "-" in tok:
+                return tok
+        return parts[3] if len(parts) > 3 else parts[-1]
+    return parts[-1]
+
+
+def _advisory_name_arch(nevra: str) -> tuple[str, str] | None:
+    """"kernel-core-5.14.0-687.58.1.el9_8.x86_64" -> ("kernel-core", "x86_64"); epoch-safe."""
+    if "." not in nevra:
+        return None
+    nevr, arch = nevra.rsplit(".", 1)
+    return nevr.rsplit("-", 2)[0], arch
+
+
+class PendingSecurityUpdatesCheck(Check):
+    id = "pending_security_updates"
+    title = "Pending security updates"
+    category = "patching"
+    severity = Severity.HIGH
+    weight = 14
+    applicable_distros = ("debian", "rhel")
+    remediation = (
+        "Install pending security updates:\n"
+        "    sudo apt update && sudo unattended-upgrade -d\n"
+        "Or interactively:\n"
+        "    sudo apt update && sudo apt upgrade\n"
+        "Consider enabling unattended-upgrades for automated security patching."
+    )
+
+    def _verdict_for_counts(self, total: int, security: int) -> Finding:
+        evidence = f"{security} security updates pending (of {total} total)"
+        if security == 0:
+            return self._finding(Verdict.PASS, evidence=evidence)
+        if security <= 5:
+            return self._finding(Verdict.WARN, evidence=evidence)
+        return self._finding(Verdict.FAIL, evidence=evidence + " — install promptly")
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # Issued up front, not inside the RHEL branch: the capture enumerator runs checks against an
+        # all-failing runner, so a gated command is never captured and uploads get a wrong total (UMBR-23).
+        r4_total = runner.run("dnf -q check-update 2>/dev/null")
+        # UMBR-42: dnf5 (Fedora 41+) treats the bare word "security" as a package spec, so the
+        # positional form below prints nothing at all (a false PASS). `--security` works on dnf4 and dnf5.
+        r4_flag = runner.run("dnf -q updateinfo list --security 2>/dev/null")
+        # 1) Ubuntu-style: update-notifier-common ships apt-check.
+        r = runner.run("/usr/lib/update-notifier/apt-check 2>&1")
+        if r.ok and ";" in r.stdout:
+            parts = r.stdout.strip().split(";", 1)
+            try:
+                return self._verdict_for_counts(int(parts[0]), int(parts[1]))
+            except (ValueError, IndexError):
+                pass  # fall through to generic fallback
+
+        # 2) Generic Debian/Ubuntu fallback: simulate an upgrade and count
+        #    "Inst" lines whose archive parenthetical mentions "security".
+        r2 = runner.run(
+            "apt-get -s -o Debug::NoLocking=true upgrade 2>/dev/null"
+        )
+        if r2.ok and r2.stdout:
+            inst_lines = [
+                ln for ln in r2.stdout.splitlines() if ln.startswith("Inst")
+            ]
+            if inst_lines or "0 upgraded" in r2.stdout:
+                total = len(inst_lines)
+                security = sum(
+                    1 for ln in inst_lines if re.search(r"[Ss]ecurity", ln)
+                )
+                return self._verdict_for_counts(total, security)
+
+        # 3) Tertiary fallback: `apt list --upgradable` is robust against
+        #    broken package state (which is a real production scenario, not
+        #    a hypothetical — surfaced by the WSL dogfood). Format example:
+        #    libnghttp2-14/stable-security 1.64.0-1.1+deb13u1 amd64 [upgradable from: ...]
+        r3 = runner.run("apt list --upgradable 2>/dev/null")
+        if r3.ok and r3.stdout and "Listing" in r3.stdout:
+            pkg_lines = [
+                ln for ln in r3.stdout.splitlines()
+                if "[upgradable from:" in ln
+            ]
+            total = len(pkg_lines)
+            security = sum(
+                1 for ln in pkg_lines
+                if re.match(r"^\S+/\S*[Ss]ecurity\b", ln)
+            )
+            return self._verdict_for_counts(total, security)
+
+        # 4) RHEL/Rocky/Alma: dnf updateinfo for security count, dnf check-update for total.
+        #    `dnf check-update` exits 100 when updates are available, 0 when none.
+        r4_sec = runner.run("dnf -q updateinfo list security 2>/dev/null")
+        if r4_flag.ok:
+            r4_sec = r4_flag  # the flag form is authoritative: empty output means no security advisories
+        elif r4_sec.ok and not r4_sec.stdout.strip() and r4_total.exit_code == 100:
+            # Positional form printed nothing while updates ARE pending: on dnf5 that is the broken
+            # spec, not "zero security updates". Never PASS on it.
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason=(
+                    "dnf reports pending updates but `dnf updateinfo list security` returned nothing "
+                    "(dnf5 needs --security); security status cannot be determined"
+                ),
+            )
+        if r4_sec.ok or r4_sec.stdout:
+            sec_lines = [ln for ln in r4_sec.stdout.splitlines() if _is_security_row(ln)]
+            # UMBR-39: updateinfo's default ("available") view also reports advisories that only
+            # apply to OLDER installed copies of installonly packages (kernel, kernel-core, ...):
+            # after a kernel update, before the reboot, a fully patched Rocky 9 showed 132. Keep
+            # only advisories for packages check-update would actually upgrade; with no usable
+            # check-update answer, count them all (over-report rather than PASS on missing data).
+            upgradable = _upgradable(r4_total)
+            if upgradable is not None:
+                sec_lines = [
+                    ln for ln in sec_lines
+                    if _advisory_name_arch(_row_nevra(ln)) in upgradable
+                ]
+            security = len(sec_lines)
+            total = 0
+            if r4_total.exit_code == 100 and r4_total.stdout:
+                total = sum(
+                    1 for ln in r4_total.stdout.splitlines()
+                    if ln.strip()
+                    and not ln.startswith(("Last metadata", "Loaded plugins"))
+                    and len(ln.split()) >= 3
+                )
+            # Total can't be less than security (the security ones ARE upgradable)
+            total = max(total, security)
+            return self._verdict_for_counts(total, security)
+
+        return self._finding(
+            Verdict.SKIP,
+            skip_reason=(
+                "none of apt-check, apt-get -s upgrade, apt list --upgradable, "
+                "or dnf updateinfo produced parseable output"
+            ),
+        )

umbermark/checks/public_listen_anomalies.py

@@ -0,0 +1,200 @@
+"""Public-facing LISTEN sockets not in the expected allow-list.
+
+Catches the 'I forgot Redis was listening on 0.0.0.0' class of mistake.
+The default allow-list is 22, 80, 443. Operators with intentional non-standard
+public listeners can override SCANNER_LISTEN_ALLOWLIST in their env (CSV).
+"""
+from __future__ import annotations
+
+import os
+import re
+
+from umbermark.core.access import get_access_context
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.firewall import Exposure
+from umbermark.core.ssh import CommandRunner
+
+_DEFAULT_ALLOWLIST = {22, 80, 443}
+
+# Well-known services that stock distro images bind on every address, with the one-line fix (UMBR-20: Debian 12/13
+# and Fedora images ship systemd-resolved LLMNR on 5355; Rocky/Alma ship rpcbind on 111). They are real
+# listeners reachable from the internet when no firewall drops them, so they stay findings; the hint makes them
+# actionable. No absolute paths here: this text is also shown on scrubbed share links.
+_KNOWN_PORTS = {
+    111: "rpcbind (NFS portmapper); if this host serves no NFS: systemctl disable --now rpcbind.socket rpcbind.service",
+    5355: "systemd-resolved LLMNR; set LLMNR=no in resolved.conf, then restart systemd-resolved",
+}
+
+_PROC_RE = re.compile(r'users:\(\("([^"]+)"')
+
+
+def _bind_scopes(ss_output: str) -> dict[int, set[str]]:
+    """Port -> {'IPv4', 'IPv6'} for wildcard LISTEN sockets. Never the address itself (no IPs in evidence)."""
+    out: dict[int, set[str]] = {}
+    for line in ss_output.splitlines():
+        cols = line.split()
+        if len(cols) < 4 or cols[0] != "LISTEN":
+            continue
+        local = cols[3]
+        port = local.rsplit(":", 1)[-1]
+        if not port.isdigit():
+            continue
+        if local.startswith(("0.0.0.0:", "*:")):
+            out.setdefault(int(port), set()).add("IPv4" if local.startswith("0.0.0.0:") else "IPv4+IPv6")
+        elif local.startswith(("[::]:", ":::")):
+            out.setdefault(int(port), set()).add("IPv6")
+    return out
+
+
+def _processes(ssp_output: str) -> dict[int, set[str]]:
+    """Port -> process names, from `ss -tlnp` (needs root; empty when unavailable)."""
+    out: dict[int, set[str]] = {}
+    for line in ssp_output.splitlines():
+        cols = line.split()
+        if len(cols) < 4 or cols[0] != "LISTEN":
+            continue
+        port = cols[3].rsplit(":", 1)[-1]
+        m = _PROC_RE.search(line)
+        if port.isdigit() and m:
+            out.setdefault(int(port), set()).add(m.group(1))
+    return out
+
+
+def describe_ports(ports: list[int], ss_output: str, ssp_output: str = "") -> str:
+    """'5355/tcp on all IPv4 and IPv6 addresses (systemd-resolve: systemd-resolved LLMNR; ...)' per port, '; '-joined.
+
+    Built only from port numbers, bind scope words and process names, so it carries no IP address or path and is
+    safe to show on a scrubbed share link (UMBR-20).
+    """
+    scopes, procs = _bind_scopes(ss_output), _processes(ssp_output)
+    parts = []
+    for p in ports:
+        s = scopes.get(p, set())
+        where = ("all IPv4 and IPv6 addresses" if ("IPv4+IPv6" in s or {"IPv4", "IPv6"} <= s)
+                 else "all IPv4 addresses" if "IPv4" in s else "all IPv6 addresses" if "IPv6" in s else "a public address")
+        detail = []
+        if procs.get(p):
+            detail.append("process " + ", ".join(sorted(procs[p])))
+        if p in _KNOWN_PORTS:
+            detail.append(_KNOWN_PORTS[p])
+        parts.append(f"{p}/tcp on {where}" + (f" ({'; '.join(detail)})" if detail else ""))
+    return "; ".join(parts)
+
+
+def _public_listen_ports(ss_output: str) -> list[int]:
+    """Extract ports from `ss -tln` LISTEN lines bound to 0.0.0.0 / * / ::."""
+    ports: list[int] = []
+    for line in ss_output.splitlines():
+        if not line.startswith("LISTEN"):
+            continue
+        # The Local Address:Port column is the 5th whitespace-separated field
+        # in `ss -tln` output (State, Recv-Q, Send-Q, Local Addr:Port, Peer).
+        cols = line.split()
+        if len(cols) < 4:
+            continue
+        local = cols[3]
+        # IPv6: [::]:PORT or :::PORT
+        # IPv4: 0.0.0.0:PORT or *:PORT
+        m = re.match(r"^(?:0\.0\.0\.0|\*|\[::\]|:::)(?::|)(\d+)$", local)
+        if m:
+            try:
+                ports.append(int(m.group(1)))
+            except ValueError:
+                pass
+            continue
+        # Older ss versions render '*:PORT' without brackets
+        if local.startswith(("0.0.0.0:", "*:", "[::]:", ":::")):
+            tail = local.rsplit(":", 1)[-1]
+            if tail.isdigit():
+                ports.append(int(tail))
+    return ports
+
+
+class PublicListenAnomaliesCheck(Check):
+    id = "public_listen_anomalies"
+    title = "Public-facing LISTEN sockets are on expected ports only"
+    category = "services"
+    severity = Severity.HIGH
+    weight = 10
+    applicable_distros = ()
+    remediation = (
+        "Close or restrict each unexpected public listener, since each is reachable\n"
+        "from the internet:\n"
+        "  1. Bind to 127.0.0.1 if the service only needs local consumers\n"
+        "     (most databases, cache servers, internal admin UIs)\n"
+        "  2. Restrict at the firewall with explicit allow rules from known IPs\n"
+        "  3. If the listener IS intended public, add its port to the env var:\n"
+        "     SCANNER_LISTEN_ALLOWLIST=22,80,443,2222,5432"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("ss -tln 2>/dev/null", sudo=True, timeout=10)
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.SKIP, skip_reason="ss -tln produced no output"
+            )
+        ports = _public_listen_ports(r.stdout)
+        allowlist = self._allowlist_from_env()
+        unexpected = sorted(set(p for p in ports if p not in allowlist))
+        # Judge exposure AFTER the firewall: a wildcard-bound socket the host
+        # firewall drops is not reachable, so it is not an exposure finding.
+        ctx = get_access_context(runner)
+        fw = ctx.firewall
+        firewalled: list[int] = []
+        if fw.readable and unexpected:
+            # An INPUT drop proves nothing for ports reachable via DNAT / published ports
+            # (docker, rootful podman): keep those findings.
+            firewalled = [
+                p for p in unexpected
+                if fw.evaluate(p, "tcp").state == Exposure.BLOCKED and not ctx.dnat_suspect(p)
+            ]
+            unexpected = [p for p in unexpected if p not in firewalled]
+        ssp = ""
+        if firewalled or unexpected:  # name the process behind each port (UMBR-20); root-only, best effort
+            rp = runner.run("ss -tlnp 2>/dev/null", sudo=True, timeout=10)
+            ssp = rp.stdout if rp.ok else ""
+        if firewalled and not unexpected:
+            labels = describe_ports(firewalled, r.stdout, ssp)
+            return self._finding(
+                Verdict.WARN,
+                evidence=(
+                    f"Informational: wildcard-bound LISTEN port(s) {labels} are not on the allow-list "
+                    "but the host firewall drops them, so they are not reachable. Consider binding "
+                    "them to loopback or disabling the listener."
+                ),
+                severity=Severity.LOW,
+                weight=0,
+                remediation=(
+                    "Optional tidy-up, not an exposure: the firewall already blocks these ports.\n"
+                    "Bind the service to 127.0.0.1 or disable the listener so a future firewall\n"
+                    "change cannot expose it (for systemd-resolved LLMNR: LLMNR=no in\n"
+                    "/etc/systemd/resolved.conf, then restart systemd-resolved)."
+                ),
+            )
+        if not unexpected:
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"{len(ports)} public LISTEN sockets, all on allow-listed ports {sorted(allowlist)}",
+            )
+        allowed = ", ".join(str(p) for p in sorted(allowlist))
+        if len(unexpected) == 1:
+            return self._finding(
+                Verdict.WARN,
+                evidence=(f"1 unexpected public LISTEN: port {describe_ports(unexpected, r.stdout, ssp)}. "
+                          f"Allow-listed ports: {allowed}"),
+            )
+        return self._finding(
+            Verdict.FAIL,
+            evidence=(f"{len(unexpected)} unexpected public LISTEN ports: {describe_ports(unexpected[:8], r.stdout, ssp)}. "
+                      f"Allow-listed ports: {allowed}"),
+        )
+
+    @staticmethod
+    def _allowlist_from_env() -> set[int]:
+        raw = os.environ.get("SCANNER_LISTEN_ALLOWLIST", "")
+        if not raw:
+            return set(_DEFAULT_ALLOWLIST)
+        try:
+            return {int(p.strip()) for p in raw.split(",") if p.strip().isdigit()}
+        except ValueError:
+            return set(_DEFAULT_ALLOWLIST)

umbermark/checks/reboot_pending.py

@@ -0,0 +1,71 @@
+"""Reboot-pending state — pending kernel/init update awaiting a reboot."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.platform import _family_for, _parse_os_release
+from umbermark.core.ssh import CommandRunner
+
+_REBOOT_MSG = re.compile(r"reboot is required", re.I)
+
+
+class RebootPendingCheck(Check):
+    id = "reboot_pending"
+    title = "Reboot required (kernel / init update pending)"
+    category = "patching"
+    severity = Severity.HIGH
+    weight = 10
+    applicable_distros = ("debian", "rhel")
+    remediation = (
+        "Schedule a reboot at a convenient maintenance window:\n"
+        "    sudo shutdown -r +5 'kernel update reboot'\n"
+        "Until you reboot, you're running the OLD kernel even though the new\n"
+        "one is installed on disk. Security updates that require a reboot\n"
+        "(notably kernel CVEs) are NOT in effect yet."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # All three commands are issued up front (UMBR-31). The flag-file test answers "no" on
+        # RHEL too (the file never exists there), so returning on it first meant the dnf branch
+        # was unreachable on every RHEL host and a pending kernel reboot scored PASS.
+        r = runner.run(
+            "[ -f /var/run/reboot-required ] && echo yes || echo no", timeout=5
+        )
+        # RHEL family: dnf needs-restarting -r exits 1 if a reboot is required, 0 if not.
+        r2 = runner.run("dnf needs-restarting -r 2>/dev/null; echo exit:$?", sudo=True, timeout=10)
+        # Already captured by platform detection, so bundles replay it without a new command.
+        osr = runner.run("cat /etc/os-release 2>/dev/null", timeout=5)
+        family = "unknown"
+        if osr.ok and osr.stdout:
+            parsed = _parse_os_release(osr.stdout)
+            family = _family_for(parsed.get("ID", ""), parsed.get("ID_LIKE", ""))
+
+        flag = r.stdout.strip() if r.ok else ""
+        if flag == "yes":
+            return self._finding(Verdict.FAIL, evidence="/var/run/reboot-required exists")
+
+        out = r2.stdout if r2.ok else ""
+        ec = out.strip().rsplit("exit:", 1)[-1] if "exit:" in out else None
+        # Exit 1 alone is ambiguous: over SSH the runner prefixes `sudo -n`, so on a host without
+        # dnf (or without passwordless sudo) `sudo -n dnf ...; echo exit:$?` also prints exit:1.
+        # dnf (4 and 5) prints this message when, and only when, a reboot is required.
+        if ec == "1" and _REBOOT_MSG.search(out):
+            return self._finding(
+                Verdict.FAIL, evidence="dnf needs-restarting -r: reboot required"
+            )
+        if ec == "0":
+            return self._finding(
+                Verdict.PASS, evidence="dnf needs-restarting -r: no reboot needed"
+            )
+        # The flag file only speaks for Debian/Ubuntu; on RHEL its "no" says nothing.
+        if flag == "no" and family != "rhel":
+            return self._finding(Verdict.PASS, evidence="no pending reboot")
+        return self._finding(
+            Verdict.SKIP,
+            skip_reason=(
+                "dnf needs-restarting -r gave no answer (needs root and dnf-plugins-core)"
+                if family == "rhel"
+                else "neither Debian nor dnf reboot-required check succeeded"
+            ),
+        )

umbermark/checks/repo_gpg_trust.py

@@ -0,0 +1,97 @@
+"""Package repos have valid GPG signing trust configured."""
+from __future__ import annotations
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+# Keyring files that apt sources actually name: deb822 "Signed-By:" lines and
+# one-line "[signed-by=...]" options. Only referenced paths that exist count, so
+# distro keyring packages (including *-removed-keys.gpg) are not evidence.
+SIGNED_BY_CMD = (
+    "{ grep -hiE '^[[:space:]]*Signed-By:' /etc/apt/sources.list.d/*.sources"
+    " 2>/dev/null | sed -E 's/^[^:]*://';"
+    " grep -hoE 'signed-by=[^] ]+' /etc/apt/sources.list"
+    " /etc/apt/sources.list.d/*.list 2>/dev/null | sed 's/^signed-by=//'; }"
+    " | tr ', ' '\\n\\n' | grep '^/' | sort -u"
+    ' | while read -r f; do [ -f "$f" ] && echo "$f"; done | wc -l'
+)
+# Legacy single-file apt keyring (non-empty file => 1).
+LEGACY_CMD = "[ -s /etc/apt/trusted.gpg ] && echo 1 || echo 0"
+HAS_APT_CMD = "command -v apt-get"
+
+
+def _num(res):
+    out = res.stdout.strip()
+    return int(out) if res.ok and out.isdigit() else None
+
+
+class RepoGpgTrustCheck(Check):
+    id = "repo_gpg_trust"
+    title = "Package repos have signing keys configured"
+    category = "patching"
+    severity = Severity.MEDIUM
+    weight = 5
+    applicable_distros = ("debian", "rhel")
+    remediation = (
+        "Restore the distribution's signing keys before installing more packages:\n"
+        "Debian/Ubuntu: ensure /etc/apt/trusted.gpg.d/ contains the distro key set\n"
+        "    sudo apt install --reinstall ubuntu-keyring debian-archive-keyring\n"
+        "RHEL/Rocky: ensure gpg-pubkey package(s) are present\n"
+        "    sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-<distro>"
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # Every probe is issued unconditionally so capture enumeration (which
+        # runs checks under an all-failing runner) sees every command.
+        trusted = _num(runner.run("ls /etc/apt/trusted.gpg.d/ 2>/dev/null | wc -l", timeout=5))
+        signed_by = _num(runner.run(SIGNED_BY_CMD, timeout=10))
+        legacy = _num(runner.run(LEGACY_CMD, timeout=5))
+        has_apt = runner.run(HAS_APT_CMD, timeout=5)
+        has_rpm = runner.run("command -v rpm", timeout=5)
+        rpm_count = _num(runner.run("rpm -qa gpg-pubkey 2>/dev/null | wc -l", timeout=5))
+
+        if trusted:
+            return self._finding(
+                Verdict.PASS, evidence=f"apt trusted-gpg keyrings: {trusted} file(s)"
+            )
+        # Debian 12+/Ubuntu 22.04+ keep keys in keyring files that sources
+        # reference via Signed-By, so an empty trusted.gpg.d is normal there.
+        # Only keyrings a source really names (and that exist) count.
+        if signed_by:
+            return self._finding(
+                Verdict.PASS,
+                evidence=f"apt Signed-By keyring files referenced by sources: {signed_by} file(s)",
+            )
+        if legacy:
+            return self._finding(
+                Verdict.PASS, evidence="apt legacy keyring /etc/apt/trusted.gpg present"
+            )
+        # A positive pubkey count proves an RPM host even when an older capture
+        # lacks the `command -v rpm` probe.
+        if rpm_count:
+            return self._finding(
+                Verdict.PASS, evidence=f"rpm gpg-pubkey packages: {rpm_count}"
+            )
+        if has_apt.ok:
+            return self._finding(
+                Verdict.FAIL,
+                evidence=(
+                    "apt: no keys in /etc/apt/trusted.gpg.d, /etc/apt/trusted.gpg, or any "
+                    "existing Signed-By keyring named by the apt sources — repo signature "
+                    "trust is broken (or sources use trusted=yes)"
+                ),
+            )
+        # No apt and no rpm binary: not a host this check can judge (a missing
+        # rpm prints "0" via wc, which must never become FAIL).
+        if not has_rpm.ok:
+            return self._finding(
+                Verdict.SKIP, skip_reason="neither apt nor rpm is installed"
+            )
+        if rpm_count == 0:
+            return self._finding(
+                Verdict.FAIL,
+                evidence="rpm: zero gpg-pubkey packages installed — repo signature trust is broken",
+            )
+        return self._finding(
+            Verdict.SKIP, skip_reason="neither apt nor rpm keyring query produced a number"
+        )

umbermark/checks/root_disk_free.py

@@ -0,0 +1,46 @@
+"""Root disk free space — % used threshold."""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class RootDiskFreeCheck(Check):
+    id = "root_disk_free"
+    title = "Root disk has free space"
+    category = "filesystem"
+    severity = Severity.HIGH
+    weight = 8
+    applicable_distros = ()
+    remediation = (
+        "Free up space on the root filesystem. Common offenders:\n"
+        "    sudo journalctl --vacuum-time=7d       # trim systemd logs\n"
+        "    sudo apt clean && sudo apt autoremove  # apt cache + orphaned packages\n"
+        "    sudo docker system prune -a            # if Docker is installed\n"
+        "Servers can lock up entirely when / hits 100%; address before it does."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        # `df -P /` is the POSIX-portable form (line 2 = the data, field 5 = Capacity%).
+        # The previous "df -P / --output=pcent" was rejected by modern coreutils
+        # ("options -P and --output are mutually exclusive") — surfaced by the
+        # 2026-05-15 WSL Dogfood Run #3.
+        r = runner.run("df -P / 2>/dev/null | awk 'NR==2 {print $5}'", timeout=5)
+        if not r.ok or not r.stdout.strip():
+            return self._finding(
+                Verdict.SKIP, skip_reason="df / failed or produced no data"
+            )
+        m = re.search(r"(\d+)%", r.stdout)
+        if not m:
+            return self._finding(
+                Verdict.SKIP, skip_reason=f"df output unparseable: {r.stdout!r}"
+            )
+        pct = int(m.group(1))
+        evidence = f"root disk {pct}% used"
+        if pct < 80:
+            return self._finding(Verdict.PASS, evidence=evidence)
+        if pct < 95:
+            return self._finding(Verdict.WARN, evidence=evidence + " — getting tight")
+        return self._finding(Verdict.FAIL, evidence=evidence + " — imminent full")

umbermark/checks/ssh_non_default_port.py

@@ -0,0 +1,62 @@
+"""SSH: informational check — is sshd listening on the default port 22?
+
+Weight 1 + WARN-on-default makes this near-zero impact on the score; it
+exists to inform the report rather than to ding it. Changing SSH port
+is mild obscurity, not real security; most hardening guides treat this
+as optional.
+"""
+from __future__ import annotations
+
+import re
+
+from umbermark.core.access import get_access_context, is_nonpublic
+from umbermark.core.check import Check, Finding, Severity, Verdict
+from umbermark.core.ssh import CommandRunner
+
+
+class SSHNonDefaultPortCheck(Check):
+    id = "ssh_non_default_port"
+    title = "SSH listening on a non-default port (informational)"
+    category = "identity_auth"
+    severity = Severity.LOW
+    weight = 1
+    applicable_distros = ()
+    remediation = (
+        "Optionally move SSH off port 22 in /etc/ssh/sshd_config. This cuts scan\n"
+        "noise but is NOT real security:\n"
+        "    Port 2222   # any non-22 port you control firewall access to\n"
+        "and remember to allow the new port in your firewall."
+    )
+
+    def run(self, runner: CommandRunner) -> Finding:
+        r = runner.run("sshd -T 2>/dev/null", sudo=True, timeout=10)
+        if not r.ok or not r.stdout:
+            return self._finding(
+                Verdict.SKIP,
+                skip_reason="could not run sshd -T (requires root and openssh-server)",
+            )
+        m = re.search(r"^port\s+(\d+)", r.stdout, re.M | re.I)
+        if not m:
+            return self._finding(
+                Verdict.SKIP, skip_reason="no port line in sshd -T output"
+            )
+        port = int(m.group(1))
+        if port == 22:
+            ctx = get_access_context(runner)
+            if is_nonpublic(ctx):
+                return self._finding(
+                    Verdict.PASS,
+                    evidence=(
+                        f"SSH on default port 22, but not publicly reachable "
+                        f"({ctx.reachability.value}: {ctx.reachability_note}); "
+                        "a port change would add nothing"
+                    ),
+                )
+            return self._finding(
+                Verdict.WARN,
+                evidence="SSH on default port 22 (informational; not a real vulnerability)",
+            )
+        return self._finding(
+            Verdict.PASS,
+            evidence=f"SSH on non-default port {port}",
+        )