op-harden

Storage Policy: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

OS Hardening Assessment

Target and options: $ARGUMENTS

1. Parse $ARGUMENTS for target host, --scope (default full), and --apply flag. Store parsed values for use throughout the command.

2. Load tools via ToolSearch: system administration, network configuration tools. Identify available Hexstrike MCP tools for remote system assessment.

3. For each scope category enabled by the --scope flag, run assessment checks via Hexstrike MCP tools. Collect all findings before generating the report.

4. Log each finding to the ops tracker:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> hardening-check <category> "<action>" <result> <severity>
   

5. Kernel (--scope kernel or full): Check sysctl parameters for secure defaults:

   • net.ipv4.ip_forward — should be 0 unless routing is required
   • kernel.randomize_va_space — should be 2 (full ASLR)
   • kernel.dmesg_restrict — should be 1 (restrict dmesg to root)
   • kernel.kptr_restrict — should be 2 (hide kernel pointers)
   • net.ipv4.conf.all.rp_filter — should be 1 (reverse path filtering)
   • net.ipv4.icmp_echo_ignore_broadcasts — should be 1 (prevent smurf attacks)

6. SSH (--scope ssh or full): Parse sshd_config and verify:

   • PermitRootLogin — should be no
   • PasswordAuthentication — should be no (key-only)
   • Port — should be non-default (not 22)
   • MaxAuthTries — should be 3 or fewer
   • AllowUsers — should be explicitly set
   • PubkeyAuthentication — should be yes

7. Firewall (--scope firewall or full): Check iptables/nftables configuration:

   • Verify default INPUT/FORWARD policy is DROP
   • List all ACCEPT rules and flag overly permissive ones
   • Cross-reference open ports with running services
   • Check for rate limiting on SSH and other exposed services

8. Services (--scope services or full): List all running services via systemctl list-units --type=service --state=running. Flag unnecessary or risky services (telnet, rpcbind, avahi-daemon, cups, nfs, rsh, rlogin).

9. MAC (--scope mac or full): Check if macchanger is installed and configured for interface randomization on boot. Verify NetworkManager dispatcher scripts or systemd unit for automatic MAC rotation.

10. If --apply flag is set: Generate remediation commands for each failed check. Present the full remediation plan to the user and execute only after explicit confirmation. Apply changes incrementally and verify each one.

11. Write the hardening report to the project directory. Include a summary table of all checks with PASS/FAIL/WARN status, severity ratings, and remediation commands for failed checks.

12. Update session metrics:

    node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric checks_passed
    node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric checks_failed