tegwick
2d347d062f
Lock DEC-FDA-001 working defaults; add roles/host-operator package with OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001 with bound agent, vault, ramp checklists, and Kai quote/ledger.
116 lines
2.9 KiB
Markdown
116 lines
2.9 KiB
Markdown
---
|
|
agent: host-operator
|
|
slug: os-security-pass
|
|
title: OS and Security Pass
|
|
version: 0.1.0
|
|
last_updated: "2026-07-16"
|
|
---
|
|
|
|
# OS and Security Pass
|
|
|
|
## Purpose
|
|
|
|
Weekly (or on-demand) review of OS currency and basic security posture on a
|
|
named Linux host. Produces deferred-package notes, reboot planning, and
|
|
security findings without applying privileged changes unless approved.
|
|
|
|
## Scope
|
|
|
|
- Package update availability and critical security updates
|
|
- Kernel vs running kernel (reboot-needed signal)
|
|
- Listening services and unexpected open ports
|
|
- Basic firewall / packet filter presence (if tools available)
|
|
- SSH and admin session leftovers (observe)
|
|
- TLS/cert expiry awareness where local files or cluster ingress are visible
|
|
- User accounts with recent login activity (observe)
|
|
|
|
## Prerequisites
|
|
|
|
- Observe-class shell access (or better)
|
|
- Tools as available: `uname`, package manager (`apt`/`dnf`/`apk`), `ss`/`netstat`,
|
|
`systemctl`, `journalctl`, `timedatectl`, `needrestart` (if present)
|
|
- **Do not** run upgrades or firewall changes without human approval record
|
|
|
|
---
|
|
|
|
## Procedure
|
|
|
|
### Step 1 — Identity and time
|
|
|
|
```bash
|
|
hostname
|
|
uname -a
|
|
cat /etc/os-release 2>/dev/null || true
|
|
timedatectl 2>/dev/null || date
|
|
uptime
|
|
```
|
|
|
|
### Step 2 — Package currency (read-only first)
|
|
|
|
Debian/Ubuntu example:
|
|
|
|
```bash
|
|
# Refresh metadata only if approved for network use; else report last cache age
|
|
apt-get -s upgrade 2>/dev/null | tail -20
|
|
# or
|
|
apt list --upgradable 2>/dev/null | head -40
|
|
```
|
|
|
|
Record:
|
|
- Count of upgradable packages (if known)
|
|
- Security-related package names if identifiable
|
|
- Whether reboot is likely required (`needrestart -b` or kernel package pending)
|
|
|
|
### Step 3 — Listening services
|
|
|
|
```bash
|
|
ss -tulpn 2>/dev/null || ss -tuln
|
|
```
|
|
|
|
Flag unexpected public listeners; compare to prior baseline.
|
|
|
|
### Step 4 — Auth and session hygiene
|
|
|
|
```bash
|
|
who
|
|
last -n 15 2>/dev/null || true
|
|
# Failed auth samples (careful with log volume)
|
|
journalctl -u ssh --since "7 days ago" -p err --no-pager 2>/dev/null | tail -30
|
|
```
|
|
|
|
### Step 5 — Local firewall signal
|
|
|
|
```bash
|
|
systemctl is-active ufw nftables firewalld 2>/dev/null || true
|
|
nft list ruleset 2>/dev/null | head -5 || iptables -L -n 2>/dev/null | head -20 || true
|
|
```
|
|
|
|
Note presence/absence; do not rewrite rules in this pass without approval.
|
|
|
|
### Step 6 — Cluster-adjacent security (if k3s)
|
|
|
|
```bash
|
|
# Node conditions only; no secret dumps
|
|
kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null || true
|
|
```
|
|
|
|
### Step 7 — Report
|
|
|
|
Update vault:
|
|
|
|
- `## OS & Patch State`
|
|
- `## Security Posture`
|
|
- Findings with severity
|
|
- Explicit list of **proposed** privileged actions (upgrades, reboots) awaiting approval
|
|
|
|
## Output template
|
|
|
|
```markdown
|
|
# OS & Security Pass — <hostname> — <date>
|
|
|
|
## Summary
|
|
## OS currency
|
|
## Security findings
|
|
## Proposed privileged actions (awaiting approval)
|
|
## Deferred / accepted risk
|
|
```
|