aegis-linux-baseline

Scope & Objectives

Audit the operating-system identity and kernel baseline of one running Linux host (or its config-as-code). Seven domains, in priority order:

1. Accounts & sudo — UID-0 duplication, stale/unused accounts, empty passwords, sudo grant breadth, sudo brute-force throttling.
2. SSH daemon — effective sshd_config state, authentication methods, forwarding surface, key hygiene.
3. PAM & password policy — lockout, password quality, expiry, password hashing.
4. Kernel & network sysctl — anti-MITM, anti-DoS, information-disclosure and local-privesc-surface controls.
5. Filesystem & permissions — SUID/SGID inventory, world-writable artifacts, mount flags, cron/at gating, umask, core dumps.
6. Boot & disk — bootloader protection (contextual), encryption-at-rest presence, protected data mounts.
7. Time sync — NTP health; forensic prerequisite for every other module's evidence.

Out of scope (cross-references): firewall/exposure map → FW; TLS/proxy edge → TLS; systemd sandboxing, SELinux/AppArmor policy authoring, container runtime → SANDBOX; secret contents/env files → HSECRET; patch level/EOL → PATCH; audit rules/log shipping → LOGMON.

Operating rules:

• All inspection is read-only; mutating commands appear only under Remediation (Phase 6 approval). Prefer effective-state evidence (sshd -T, sysctl -n KEY) over config files — drop-in dirs (sshd_config.d/, sysctl.d/) make file text misleading.
• Commands needing root are tagged [ROOT]; without root, audit world-readable state plus the config repo. Repo-only access: judge the rendered config (Ansible templates, cloud-init user-data) using Patterns & Signatures. Distro variance is called out inline — never assume Ubuntu values on RHEL or Alpine; detect first (cat /etc/os-release).