luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host posture checks (roadmap v0.8: posture check)

Browse source 
Add `enodia-sentinel posture check` — a config-hygiene audit that finds
the conditions making a host easy to attack, complementing the live
detectors. Checks: SSH root/password/empty-password login (Include-aware,
first-wins sshd resolution), passwordless and group/world-writable
sudoers, world-writable or non-root PATH directories, loose permissions
on sensitive files (/etc/shadow, /etc/passwd, ...), and downgraded
package-signature policy (reusing pkgdb.siglevel_alert).

Findings reuse the Alert type, so they serialize through the existing
JSON/triage pipeline (`posture check --json`). Each check is a pure
evaluator over injected content/stat facts plus a thin system reader, so
the 18 new tests need no root or live /etc. Posture is command-driven and
never runs in the daemon loop, per the v0.8 exit criterion.

SIDs 100040-100047 (classtype host-posture). Sample config and docs
(COMMAND_REFERENCE, OPERATIONS, ROADMAP, SPECIFICATION) updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Luna 2026-06-10 05:15:06 -07:00
parent 6ff2087329
commit 9ebc355936
9 changed files with 520 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
config/enodia-sentinel.toml
View file

@ -92,6 +92,16 @@ rootcheck_enabled = true
rootcheck_interval = 300 # seconds between cross-view sweeps
rootcheck_pid_cap = 65536 # upper PID to brute-force via kill(0)
# --- host posture --------------------------------------------------------
# Config-hygiene audit run on demand (`enodia-sentinel posture check`), not in
# the daemon loop: root SSH login, password auth, passwordless sudo, world-
# writable PATH dirs, loose perms on sensitive files, and package-signature
# policy. Paths are overridable mostly for testing on non-standard hosts.
posture_sshd_config = "/etc/ssh/sshd_config"
posture_sudoers = "/etc/sudoers"
posture_sudoers_dir = "/etc/sudoers.d"
# posture_path = [] # PATH dirs to audit; empty = safe default set
# --- eBPF event layer ----------------------------------------------------
# Event-driven execve monitor: catches short-lived processes the poll loop
# misses, matched against the Snort-style rule engine. Requires python-bpfcc