kaizen-agentic/roles/host-operator/protocols/os-security-pass.md

agent	slug	title	version	last_updated
host-operator	os-security-pass	OS and Security Pass	0.1.0	2026-07-16

OS and Security Pass

Purpose

Weekly (or on-demand) review of OS currency and basic security posture on a named Linux host. Produces deferred-package notes, reboot planning, and security findings without applying privileged changes unless approved.

Scope

• Package update availability and critical security updates
• Kernel vs running kernel (reboot-needed signal)
• Listening services and unexpected open ports
• Basic firewall / packet filter presence (if tools available)
• SSH and admin session leftovers (observe)
• TLS/cert expiry awareness where local files or cluster ingress are visible
• User accounts with recent login activity (observe)

Prerequisites

• Observe-class shell access (or better)
• Tools as available: uname, package manager (apt/dnf/apk), ss/netstat, systemctl, journalctl, timedatectl, needrestart (if present)
• Do not run upgrades or firewall changes without human approval record

---

Procedure

Step 1 — Identity and time

hostname
uname -a
cat /etc/os-release 2>/dev/null || true
timedatectl 2>/dev/null || date
uptime

Step 2 — Package currency (read-only first)

Debian/Ubuntu example:

# Refresh metadata only if approved for network use; else report last cache age
apt-get -s upgrade 2>/dev/null | tail -20
# or
apt list --upgradable 2>/dev/null | head -40

Record:

• Count of upgradable packages (if known)
• Security-related package names if identifiable
• Whether reboot is likely required (needrestart -b or kernel package pending)

Step 3 — Listening services

ss -tulpn 2>/dev/null || ss -tuln

Flag unexpected public listeners; compare to prior baseline.

Step 4 — Auth and session hygiene

who
last -n 15 2>/dev/null || true
# Failed auth samples (careful with log volume)
journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30

Step 5 — Local firewall signal

systemctl is-active ufw nftables firewalld 2>/dev/null || true
nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true

Note presence/absence; do not rewrite rules in this pass without approval.

Step 6 — Cluster-adjacent security (if k3s)

# Node conditions only; no secret dumps
kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true

Step 7 — Report

Update vault:

• ## OS & Patch State
• ## Security Posture
• Findings with severity
• Explicit list of proposed privileged actions (upgrades, reboots) awaiting approval

Output template

# OS & Security Pass — <hostname> — <date>

## Summary
## OS currency
## Security findings
## Proposed privileged actions (awaiting approval)
## Deferred / accepted risk