sudosecurity/hardline
2
0
Fork 0
Code Issues Pull requests Releases 9 Activity
9 releases 9 tags
  • v0.6.0 7f62900dc0

    Hardline 0.6.0 Stable

    Traven released this 2026-10-29 02:57:07 +00:00 | 17 commits to main since this release

    Automatic security updates, file-permission and mount checks, a local dashboard, hardline fleet for auditing many servers over SSH, review dates for accepted risks, and Prometheus metrics from watch.

    Released 2026-10-29.

    Added

    • Automatic updates (phase 3): updates-unattended-installed and updates-unattended-enabled on Ubuntu/Debian (writes /etc/apt/apt.conf.d/52hardline-auto-upgrades, verified through apt-config dump); updates-dnf-automatic-installed and updates-dnf-automatic-timer on RHEL family.
    • time-synced (phase 3): timedatectl reports NTPSynchronized=yes. Report-only.
    • kernel-suid-dumpable (phase 7): sets fs.suid_dumpable = 0.
    • mounts-tmp and mounts-dev-shm (phase 7): nodev,nosuid,noexec, read from /proc/self/mounts. Report-only.
    • files-no-world-writable, files-no-stray-suid, files-no-unowned (phase 8): one bounded walk of local disk filesystems (no symlinks, no container storage or pseudo filesystems, stops at 3,000,000 entries). Report-only. files-no-unowned is a warning when users also come from LDAP/SSSD.
    • apt-config and timedatectl added to the fixed command list.
    • hardline dashboard [--out FILE]: a local, script-free status page with the report, score over time and recent watch runs.
    • hardline fleet <host>...: run on your own computer; audits each server over SSH (ssh added to the fixed command list) and writes one local page with every grade, open findings per host and failures shared across servers.
    • Dashboard: "How to fix" on every open finding (why it matters, what Hardline changes, the exact preview/commit/confirm commands, how to undo), a change timeline from history.log, and an accepted-risk register with review dates.
    • hardline accept --expires 90d|12w|YYYY-MM-DD: a review date for an accepted finding. Once it passes the finding counts again and watch reports it once. Existing entries keep working without one. An entry with expires is refused by 0.5.x, so after downgrading remove that line (or the entry) from /etc/hardline/accepted.toml.
    • watch run keeps the last 720 runs in watch-history.jsonl, rewrites dashboard.html, and writes Prometheus metrics (hardline.prom) for node_exporter's textfile collector.

    Fixed

    • watch-history.jsonl with one corrupt byte no longer wipes the whole history; only the bad line is dropped.
    • A full disk while saving history no longer stops the regression alert from watch run.
    • File-permission scan: a bind mount of a subdirectory no longer hides the rest of that filesystem; at most 1,000 sample paths per finding are kept (counts stay exact).
    • Temp files from atomic writes are per-process, so hardline dashboard and watch run can't publish each other's half-written file.
    • self-update takes the hardline lock, so no apply, rollback or watch run starts while the binary is replaced.
    • confirm commits the snapshots before it stops the revert timer, so a failure there still reverts on its own instead of leaving the change unguarded.
    • A failure recording files created by a package install, or (for unguarded phases) sealing the snapshot, now rolls the phase back instead of leaving it half-applied.
    • hardline dashboard --out FILE prints the right file name to open.
    • Webhook URLs with an IPv6 literal host and no port are accepted; malformed bracketed hosts are refused.
    • The dashboard's time formatting no longer assumes ASCII input.
    • rollback --pending and an early manual revert are recorded as "rolled back by hand", not "not confirmed in time"; the last-revert line no longer repeats its timestamp.
    • Writing a file by bare name (e.g. --out page.html) in the current directory.

    Install

    Download the archive for your CPU (x86_64 or aarch64), check it against the signed sums, and install it somewhere only root can write:

    curl -LO https://sudosecurity.org/hardline/releases/latest/hardline-x86_64-unknown-linux-gnu.tar.gz
curl -LO https://sudosecurity.org/hardline/releases/latest/SHA256SUMS
curl -LO https://sudosecurity.org/hardline/releases/latest/SHA256SUMS.sig
curl -LO https://git.sudosecurity.org/sudosecurity/hardline/raw/tag/v0.6.0/release.pub
openssl pkeyutl -verify -pubin -inkey release.pub -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum --ignore-missing -c SHA256SUMS
tar -xzf hardline-x86_64-unknown-linux-gnu.tar.gz
sudo install -o root -g root -m 755 hardline-*/hardline /usr/local/bin/hardline

    Already on 0.5.0 or later? sudo hardline self-update does the same checks for you.

    SHA256SUMS is signed with the Ed25519 release key in release.pub; the same key is compiled into Hardline for self-update.

    Full changelog: https://git.sudosecurity.org/sudosecurity/hardline/compare/v0.5.1...v0.6.0

    Downloads