vllixn 0.2.0__tar.gz

vllixn-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TSVMV
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vllixn-0.2.0/PKG-INFO

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: vllixn
+Version: 0.2.0
+Summary: Read-only Linux host security checkup: audit accounts, SSH, permissions, network and kernel
+License-Expression: MIT
+Keywords: security,linux,hardening,audit,blue-team,cis
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+Dynamic: license-file
+
+# vllixn
+
+只读 Linux 主机安全体检工具：一条命令检查账户、SSH、文件权限、网络、服务、内核、补丁、启动与审计配置，输出中文报告、分类雷达图与 0-100 评分，还能与上一次报告对比出新增/已修复的问题。
+
+- 纯 Python 标准库，零第三方依赖
+- 全程只读：不写任何系统配置，只读取文件元数据与白名单内的只读命令（`ss`、`sysctl`、`systemctl`、`nft`、`iptables`、`ufw`、`firewall-cmd`、`getenforce`、`auditctl`、`timedatectl` 等）
+- 面向蓝队：每个未通过项给出说明、建议与证据；支持白名单忽略与基线对比，便于持续跟踪加固进展
+- 报告可导出自包含 HTML（纯 SVG，无 JS，可直接截图存档）与 JSON
+
+## 安装
+
+```bash
+pip install vllixn
+```
+
+## 使用
+
+```bash
+# 本机体检，终端输出报告与分类得分
+vllixn
+
+# 同时导出自包含 HTML（含分类雷达图，无 JS）
+vllixn --html report.html
+
+# 导出 JSON 供其他系统消费
+vllixn --json report.json
+
+# 忽略误报项（可重复传入检查项 ID）
+vllixn --ignore ssh.x11_forwarding --ignore accounts.default_umask
+
+# 与上次报告对比，看新增问题与已修复项
+vllixn --baseline last.json --html now.html
+
+# 对挂载的镜像目录做离线分析（命令探测会自动跳过）
+vllixn --root /mnt/target-image
+
+# 非 root 也能跑：需要读 /etc/shadow、防火墙规则的检查会标记为跳过并说明原因
+```
+
+## 检查范围
+
+| 分类 | 内容 |
+|------|------|
+| 账户 | UID 0 别名、空口令、系统账户可登录 shell、重复 UID、sudo NOPASSWD、authorized_keys 权限、口令有效期(login.defs)、默认 umask、PAM 口令复杂度、登录失败锁定 |
+| SSH | root 登录、口令认证、空口令、端口转发、X11 转发、MaxAuthTries、协议 1、LoginGraceTime、ClientAliveInterval、登录用户范围、HostbasedAuthentication（含 Include 子配置） |
+| 文件权限 | /etc/passwd、shadow、sudoers 等敏感文件，系统目录与家目录全局可写，高风险 SUID/SGID |
+| 网络 | 对外监听端口（明文协议与数据服务单独定级）、nftables/iptables/ufw/firewalld 活动规则 |
+| 服务 | systemd 开机启用的高风险服务、/etc/rc.local、cron/at 访问控制 |
+| 内核 | 网络加固（含 syncookies、IPv6 重定向）、信息泄露、ASLR、文件系统保护四组 sysctl 参数 |
+| 补丁 | 依据 apt/dnf 更新日志判断超过 60 天未安装更新 |
+| 启动 | GRUB 配置权限、高危内核模块黑名单、core dump 限制 |
+| 审计 | SELinux/AppArmor 运行状态、auditd、时间同步、日志持久化 |
+
+## 评分
+
+每个未通过项按严重程度扣分：严重 -25、高 -12、中 -5、低 -2，下限 0 分。
+等级：90 优秀 / 75 良好 / 60 一般 / 40 较差 / 其余危险。
+跳过的检查项不计分。HTML 报告额外提供各分类独立雷达图，便于定位短板。
+
+## 开发
+
+```bash
+# 运行测试（fixture 目录树 + 脚本化命令注入，无需真实系统）
+python3 -m pytest tests/ -q
+
+# 静态检查
+python3 -m ruff check .
+```
+
+架构说明：`probe.py` 提供 rooted 文件访问与白名单命令执行，检查逻辑全部基于注入的 probe，可在测试中用 fixture 目录树与脚本化命令结果离线复现；`checks/` 下每个模块一个分类，向 `checks/__init__.py` 的 MODULES 注册；`compare.py` 做基线对比；`report/` 负责终端、HTML、JSON 三种渲染；`score.py` 计分。
+
+## License
+
+MIT

vllixn-0.2.0/README.md

@@ -0,0 +1,74 @@
+# vllixn
+
+只读 Linux 主机安全体检工具：一条命令检查账户、SSH、文件权限、网络、服务、内核、补丁、启动与审计配置，输出中文报告、分类雷达图与 0-100 评分，还能与上一次报告对比出新增/已修复的问题。
+
+- 纯 Python 标准库，零第三方依赖
+- 全程只读：不写任何系统配置，只读取文件元数据与白名单内的只读命令（`ss`、`sysctl`、`systemctl`、`nft`、`iptables`、`ufw`、`firewall-cmd`、`getenforce`、`auditctl`、`timedatectl` 等）
+- 面向蓝队：每个未通过项给出说明、建议与证据；支持白名单忽略与基线对比，便于持续跟踪加固进展
+- 报告可导出自包含 HTML（纯 SVG，无 JS，可直接截图存档）与 JSON
+
+## 安装
+
+```bash
+pip install vllixn
+```
+
+## 使用
+
+```bash
+# 本机体检，终端输出报告与分类得分
+vllixn
+
+# 同时导出自包含 HTML（含分类雷达图，无 JS）
+vllixn --html report.html
+
+# 导出 JSON 供其他系统消费
+vllixn --json report.json
+
+# 忽略误报项（可重复传入检查项 ID）
+vllixn --ignore ssh.x11_forwarding --ignore accounts.default_umask
+
+# 与上次报告对比，看新增问题与已修复项
+vllixn --baseline last.json --html now.html
+
+# 对挂载的镜像目录做离线分析（命令探测会自动跳过）
+vllixn --root /mnt/target-image
+
+# 非 root 也能跑：需要读 /etc/shadow、防火墙规则的检查会标记为跳过并说明原因
+```
+
+## 检查范围
+
+| 分类 | 内容 |
+|------|------|
+| 账户 | UID 0 别名、空口令、系统账户可登录 shell、重复 UID、sudo NOPASSWD、authorized_keys 权限、口令有效期(login.defs)、默认 umask、PAM 口令复杂度、登录失败锁定 |
+| SSH | root 登录、口令认证、空口令、端口转发、X11 转发、MaxAuthTries、协议 1、LoginGraceTime、ClientAliveInterval、登录用户范围、HostbasedAuthentication（含 Include 子配置） |
+| 文件权限 | /etc/passwd、shadow、sudoers 等敏感文件，系统目录与家目录全局可写，高风险 SUID/SGID |
+| 网络 | 对外监听端口（明文协议与数据服务单独定级）、nftables/iptables/ufw/firewalld 活动规则 |
+| 服务 | systemd 开机启用的高风险服务、/etc/rc.local、cron/at 访问控制 |
+| 内核 | 网络加固（含 syncookies、IPv6 重定向）、信息泄露、ASLR、文件系统保护四组 sysctl 参数 |
+| 补丁 | 依据 apt/dnf 更新日志判断超过 60 天未安装更新 |
+| 启动 | GRUB 配置权限、高危内核模块黑名单、core dump 限制 |
+| 审计 | SELinux/AppArmor 运行状态、auditd、时间同步、日志持久化 |
+
+## 评分
+
+每个未通过项按严重程度扣分：严重 -25、高 -12、中 -5、低 -2，下限 0 分。
+等级：90 优秀 / 75 良好 / 60 一般 / 40 较差 / 其余危险。
+跳过的检查项不计分。HTML 报告额外提供各分类独立雷达图，便于定位短板。
+
+## 开发
+
+```bash
+# 运行测试（fixture 目录树 + 脚本化命令注入，无需真实系统）
+python3 -m pytest tests/ -q
+
+# 静态检查
+python3 -m ruff check .
+```
+
+架构说明：`probe.py` 提供 rooted 文件访问与白名单命令执行，检查逻辑全部基于注入的 probe，可在测试中用 fixture 目录树与脚本化命令结果离线复现；`checks/` 下每个模块一个分类，向 `checks/__init__.py` 的 MODULES 注册；`compare.py` 做基线对比；`report/` 负责终端、HTML、JSON 三种渲染；`score.py` 计分。
+
+## License
+
+MIT

vllixn-0.2.0/pyproject.toml

@@ -0,0 +1,39 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vllixn"
+version = "0.2.0"
+description = "Read-only Linux host security checkup: audit accounts, SSH, permissions, network and kernel"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+keywords = ["security", "linux", "hardening", "audit", "blue-team", "cis"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Operating System :: POSIX :: Linux",
+    "Topic :: Security",
+]
+dependencies = []
+
+[project.scripts]
+vllixn = "vllixn.cli:main"
+
+[project.optional-dependencies]
+test = ["pytest"]
+
+[tool.setuptools.packages.find]
+include = ["vllixn*"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+ignore = ["B905", "FLY002"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["E501"]

vllixn-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vllixn-0.2.0/tests/test_accounts.py

@@ -0,0 +1,146 @@
+"""Tests for account and privilege checks."""
+
+from __future__ import annotations
+
+from conftest import make_probe, write
+
+from vllixn.checks import accounts
+from vllixn.model import Severity, Status
+
+PASSWD_BASE = "\n".join(
+    [
+        "root:x:0:0:root:/root:/bin/bash",
+        "daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin",
+        "alice:x:1000:1000:Alice:/home/alice:/bin/bash",
+    ]
+)
+
+
+def test_uid_zero_alias_fails(root):
+    write(root, "/etc/passwd", PASSWD_BASE + "\ntoor:x:0:0:backdoor:/root:/bin/bash")
+    finding = accounts._uid_zero(accounts.parse_passwd(make_probe(root)))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.CRITICAL
+    assert "toor" in finding.evidence
+
+
+def test_uid_zero_clean(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    finding = accounts._uid_zero(accounts.parse_passwd(make_probe(root)))
+    assert finding.status is Status.PASS
+
+
+def test_empty_password_detected_as_root(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    write(root, "/etc/shadow", "root:$6$hash:1:0:99:7:::\nalice::1:0:99:7:::\n")
+    findings = accounts._password_fields(make_probe(root), accounts.parse_passwd(make_probe(root)))
+    by_id = {item.id: item for item in findings}
+    assert by_id["accounts.empty_password"].status is Status.FAIL
+    assert "alice" in by_id["accounts.empty_password"].evidence
+
+
+def test_empty_password_skipped_without_root(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    findings = accounts._password_fields(
+        make_probe(root, uid=1000), accounts.parse_passwd(make_probe(root, uid=1000))
+    )
+    assert all(item.id != "accounts.empty_password" or item.status is Status.SKIP for item in findings)
+
+
+def test_sudo_nopasswd_found(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    write(root, "/etc/sudoers.d/admin", "alice ALL=(ALL) NOPASSWD: ALL\n")
+    finding = accounts._sudo_nopasswd(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert "NOPASSWD" in finding.evidence
+
+
+def test_duplicate_uid(root):
+    write(root, "/etc/passwd", PASSWD_BASE + "\ndup:x:1000:1000:Dup:/home/dup:/bin/bash")
+    finding = accounts._duplicate_uids(accounts.parse_passwd(make_probe(root)))
+    assert finding.status is Status.FAIL
+    assert "UID 1000" in finding.evidence
+
+
+def test_system_account_with_login_shell(root):
+    rows = "\n".join(
+        [
+            "root:x:0:0:root:/root:/bin/bash",
+            "svc:x:999:999:svc:/srv:/bin/bash",
+        ]
+    )
+    write(root, "/etc/passwd", rows)
+    finding = accounts._system_login_shells(accounts.parse_passwd(make_probe(root)))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_writable_authorized_keys(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    write(root, "/home/alice/.ssh/authorized_keys", "ssh-ed25519 AAAA demo\n", mode=0o666)
+    finding_by_id = {
+        item.id: item
+        for item in accounts._ssh_key_perms(make_probe(root), accounts.parse_passwd(make_probe(root)))
+    }
+    assert finding_by_id["accounts.ssh_key_writable"].status is Status.FAIL
+    assert finding_by_id["accounts.ssh_key_writable"].severity is Severity.HIGH
+
+
+def test_module_run_smoke(root):
+    write(root, "/etc/passwd", PASSWD_BASE)
+    findings = accounts.run(make_probe(root))
+    assert findings
+    assert all(isinstance(item.id, str) and item.category == "账户" for item in findings)
+
+
+def test_password_policy_too_long_fails(root):
+    write(root, "/etc/login.defs", "PASS_MAX_DAYS 999\nUMASK 027\n")
+    findings = {item.id: item for item in accounts._password_policy(make_probe(root))}
+    assert findings["accounts.password_policy"].status is Status.FAIL
+    assert findings["accounts.password_policy"].severity is Severity.MEDIUM
+
+
+def test_password_policy_reasonable_passes(root):
+    write(root, "/etc/login.defs", "PASS_MAX_DAYS 90\nUMASK 027\n")
+    findings = {item.id: item for item in accounts._password_policy(make_probe(root))}
+    assert findings["accounts.password_policy"].status is Status.PASS
+    assert findings["accounts.default_umask"].status is Status.PASS
+
+
+def test_umask_022_flagged_low(root):
+    write(root, "/etc/login.defs", "PASS_MAX_DAYS 90\nUMASK 022\n")
+    findings = {item.id: item for item in accounts._password_policy(make_probe(root))}
+    assert findings["accounts.default_umask"].status is Status.FAIL
+    assert findings["accounts.default_umask"].severity is Severity.LOW
+
+
+def test_pam_pwquality_missing_fails(root):
+    write(root, "/etc/pam.d/common-password", "password requisite pam_unix.so\n")
+    assert accounts._pam_quality(make_probe(root)).status is Status.FAIL
+
+
+def test_pam_pwquality_enabled_passes(root):
+    write(root, "/etc/pam.d/common-password", "password requisite pam_pwquality.so retry=3\n")
+    assert accounts._pam_quality(make_probe(root)).status is Status.PASS
+
+
+def test_pam_pwquality_short_minlen_low(root):
+    write(root, "/etc/pam.d/common-password", "password requisite pam_pwquality.so\n")
+    write(root, "/etc/security/pwquality.conf", "minlen = 6\n")
+    finding = accounts._pam_quality(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_pam_faillock_missing_fails(root):
+    write(root, "/etc/pam.d/common-auth", "auth required pam_unix.so\n")
+    assert accounts._pam_faillock(make_probe(root)).status is Status.FAIL
+
+
+def test_pam_faillock_enabled_passes(root):
+    write(root, "/etc/pam.d/common-auth", "auth required pam_faillock.so deny=5\n")
+    assert accounts._pam_faillock(make_probe(root)).status is Status.PASS
+
+
+def test_pam_faillock_no_pam_files_skips(root):
+    assert accounts._pam_faillock(make_probe(root)).status is Status.SKIP

vllixn-0.2.0/tests/test_audit.py

@@ -0,0 +1,92 @@
+"""Tests for audit and hardening layer checks."""
+
+from __future__ import annotations
+
+from conftest import make_probe, write
+
+from vllixn.checks import audit
+from vllixn.model import Severity, Status
+from vllixn.probe import CommandResult
+
+DATECTL_SYNCED = "System clock synchronized: yes\nNTP service: active\n"
+DATECTL_UNSYNCED = "System clock synchronized: no\nNTP service: inactive\n"
+
+
+def test_selinux_enforcing_passes(root):
+    probe = make_probe(root, {("getenforce",): CommandResult((), 0, "Enforcing\n")})
+    assert audit._mac(probe).status is Status.PASS
+
+
+def test_selinux_permissive_is_medium(root):
+    probe = make_probe(root, {("getenforce",): CommandResult((), 0, "Permissive\n")})
+    finding = audit._mac(probe)
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.MEDIUM
+
+
+def test_apparmor_enabled_passes(root):
+    write(root, "/sys/module/apparmor/parameters/enabled", "Y\n")
+    assert audit._mac(make_probe(root)).status is Status.PASS
+
+
+def test_no_mac_layer_fails_low(root):
+    finding = audit._mac(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_auditd_enabled_passes(root):
+    probe = make_probe(root, {("auditctl", "-s"): CommandResult((), 0, "enabled 1\npid 100\n")})
+    assert audit._auditd(probe).status is Status.PASS
+
+
+def test_auditd_disabled_fails(root):
+    probe = make_probe(root, {("auditctl", "-s"): CommandResult((), 0, "enabled 0\n")})
+    finding = audit._auditd(probe)
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.MEDIUM
+
+
+def test_auditd_absent_fails_low(root):
+    finding = audit._auditd(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_auditd_installed_but_unreadable_skips(root):
+    write(root, "/etc/audit/auditd.conf", "log_file = /var/log/audit/audit.log\n")
+    finding = audit._auditd(make_probe(root))
+    assert finding.status is Status.SKIP
+
+
+def test_time_synced_passes(root):
+    probe = make_probe(root, {("timedatectl",): CommandResult((), 0, DATECTL_SYNCED)})
+    assert audit._time_sync(probe).status is Status.PASS
+
+
+def test_time_unsynced_fails(root):
+    probe = make_probe(root, {("timedatectl",): CommandResult((), 0, DATECTL_UNSYNCED)})
+    finding = audit._time_sync(probe)
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_time_sync_config_only_skips(root):
+    write(root, "/etc/chrony.conf", "pool pool.ntp.org iburst\n")
+    assert audit._time_sync(make_probe(root)).status is Status.SKIP
+
+
+def test_persistent_logs_rsyslog_passes(root):
+    write(root, "/etc/rsyslog.conf", "*.* /var/log/syslog\n")
+    assert audit._persistent_logs(make_probe(root)).status is Status.PASS
+
+
+def test_persistent_logs_missing_fails(root):
+    finding = audit._persistent_logs(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_persistent_logs_journald_dir_passes(root):
+    (root / "var" / "log" / "journal").mkdir(parents=True)
+    assert audit._persistent_logs(make_probe(root)).status is Status.PASS

vllixn-0.2.0/tests/test_boot.py

@@ -0,0 +1,59 @@
+"""Tests for boot loader, module blacklist and core dump checks."""
+
+from __future__ import annotations
+
+from conftest import make_probe, write
+
+from vllixn.checks import boot
+from vllixn.model import Severity, Status
+
+
+def test_grub_world_writable_is_high(root):
+    write(root, "/boot/grub/grub.cfg", "set default=0\n", mode=0o666)
+    finding = boot._grub_perms(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.HIGH
+    assert "grub.cfg" in finding.evidence
+
+
+def test_grub_clean_passes(root):
+    write(root, "/boot/grub/grub.cfg", "set default=0\n", mode=0o600)
+    assert boot._grub_perms(make_probe(root)).status is Status.PASS
+
+
+def test_grub_missing_skips(root):
+    assert boot._grub_perms(make_probe(root)).status is Status.SKIP
+
+
+def test_module_blacklist_empty_fails_low(root):
+    write(root, "/etc/modprobe.d/dummy.conf", "# nothing\n")
+    finding = boot._module_blacklist(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_module_blacklist_full_passes(root):
+    lines = "\n".join(f"blacklist {name}" for name in boot.RISKY_MODULES)
+    write(root, "/etc/modprobe.d/cis.conf", lines + "\n")
+    assert boot._module_blacklist(make_probe(root)).status is Status.PASS
+
+
+def test_core_dump_limits_conf_passes(root):
+    write(root, "/etc/security/limits.conf", "* hard core 0\n")
+    assert boot._core_dump(make_probe(root)).status is Status.PASS
+
+
+def test_core_dump_systemd_config_passes(root):
+    write(root, "/etc/systemd/coredump.conf", "[Coredump]\nStorage=none\n")
+    assert boot._core_dump(make_probe(root)).status is Status.PASS
+
+
+def test_core_dump_missing_fails(root):
+    finding = boot._core_dump(make_probe(root))
+    assert finding.status is Status.FAIL
+    assert finding.severity is Severity.LOW
+
+
+def test_module_smoke(root):
+    findings = boot.run(make_probe(root))
+    assert {item.category for item in findings} == {"启动"}