aegis-host-secrets

REDACTION RULE — applies to every phase of this module and to the final report. When any sweep surfaces a real secret value, the report prints exactly the first four characters followed by …REDACTED (shape: sk-l…REDACTED). Never transcribe full values into reports, tickets, chat, shell transcripts, or evidence archives. All examples in this document use deliberate fakes such as EXAMPLE_NOT_A_REAL_TOKEN. If a command would echo a secret (e.g., systemctl show -p Environment), capture only hit counts or redacted previews.

Scope & Objectives

Audit secrets and sensitive material stored on one Linux host (or rendered onto it from its config-as-code repo). Seven objectives, in execution order:

1. Inventory sweep (read-only) — locate every place credentials actually live in practice: .env files in app directories, config files (application.yml/.properties, settings.py, config.json, PHP .env), systemd Environment=/EnvironmentFile=, /etc/<app-name>/*, docker-compose.yml environment blocks plus sibling .env, crontab inline creds, shell rc exports, ops history files, backup scripts with embedded DB passwords.
2. Permission audit per location — verify owner/mode against the expected-state table; hunt group/world-readable secret files; flag group/world-writable configs; enforce 750-not-755 home dirs for service accounts.
3. Private keys & certs on disk — SSH host + client keys, the sshd StrictModes permission chain, TLS key pairs, application signing/JWT secrets in configs, GPG material.
4. Database credential exposure chains — DSN strings with inline passwords, .my.cnf client sections, .pgpass, replication configs, backup scripts, and where dumps land.
5. Environment-variable reality check — establish honestly what /proc/<pid>/environ does and does not expose, enumerate real leak channels, and issue a scoped verdict.
6. Rotation posture — detect "unchanged since forever" credential files as Needs-Review culture flags (not auto-findings).
7. Backup & snapshot hygiene — unencrypted copies of secret-bearing dirs, dump placement, encryption presence.

Out of scope (cross-references): token storage design inside applications and token-rotation mechanics → TOK module (skills/server/api-token-security/SKILL.md, which owns the zero-downtime rotation runbook); secrets baked into container images or build layers → supply-chain module; network exposure of the services holding these secrets → FW/TLS modules; SELinux/AppArmor label analysis beyond noting its existence → SANDBOX module.

Operating rules: