---
agent: host-operator
slug: os-security-pass
title: OS and Security Pass
version: 0.1.0
last_updated: "2026-07-16"
---

# OS and Security Pass

## Purpose

Weekly (or on-demand) review of OS currency and basic security posture on a
named Linux host. Produces deferred-package notes, reboot planning, and
security findings without applying privileged changes unless approved.

## Scope

- Package update availability and critical security updates
- Kernel vs running kernel (reboot-needed signal)
- Listening services and unexpected open ports
- Basic firewall / packet filter presence (if tools available)
- SSH and admin session leftovers (observe)
- TLS/cert expiry awareness where local files or cluster ingress are visible
- User accounts with recent login activity (observe)

## Prerequisites

- Observe-class shell access (or better)
- Tools as available: `uname`, package manager (`apt`/`dnf`/`apk`), `ss`/`netstat`,
  `systemctl`, `journalctl`, `timedatectl`, `needrestart` (if present)
- **Do not** run upgrades or firewall changes without human approval record

---

## Procedure

### Step 1 — Identity and time

```bash
hostname
uname -a
cat /etc/os-release 2>/dev/null || true
timedatectl 2>/dev/null || date
uptime
```

### Step 2 — Package currency (read-only first)

Debian/Ubuntu example:

```bash
# Refresh metadata only if approved for network use; else report last cache age
apt-get -s upgrade 2>/dev/null | tail -20
# or
apt list --upgradable 2>/dev/null | head -40
```

Record:
- Count of upgradable packages (if known)
- Security-related package names if identifiable
- Whether reboot is likely required (`needrestart -b` or kernel package pending)

### Step 3 — Listening services

```bash
ss -tulpn 2>/dev/null || ss -tuln
```

Flag unexpected public listeners; compare to prior baseline.

### Step 4 — Auth and session hygiene

```bash
who
last -n 15 2>/dev/null || true
# Failed auth samples (careful with log volume)
journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30
```

### Step 5 — Local firewall signal

```bash
systemctl is-active ufw nftables firewalld 2>/dev/null || true
nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true
```

Note presence/absence; do not rewrite rules in this pass without approval.

### Step 6 — Cluster-adjacent security (if k3s)

```bash
# Node conditions only; no secret dumps
kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true
```

### Step 7 — Report

Update vault:

- `## OS & Patch State`
- `## Security Posture`
- Findings with severity
- Explicit list of **proposed** privileged actions (upgrades, reboots) awaiting approval

## Output template

```markdown
# OS & Security Pass — <hostname> — <date>

## Summary
## OS currency
## Security findings
## Proposed privileged actions (awaiting approval)
## Deferred / accepted risk
```