sudosecurity/hardline
2
0
Fork 0
Code Issues Pull requests Releases 9 Activity
9 releases 9 tags
  • v0.4.0 2303414c2e

    Hardline 0.4.0 Stable

    Traven released this 2026-10-19 04:12:06 +00:00 | 49 commits to main since this release

    A–F security grade, a self-contained HTML report, scheduled watch re-audits, hardline explain, and RHEL 9 / Rocky Linux 9 / AlmaLinux 9 support with guarded firewalld.

    Released 2026-10-19.

    Added

    • An A–F security grade, weighted by severity, in audit output and the JSON report (grade.letter, grade.percent). A failing high-severity control caps an A at B.
    • hardline report [--out FILE]: the audit as a self-contained HTML page with the grade, a "fix first" list and a link for every finding. No scripts or external requests (strict CSP), light and dark themes, works on phones and prints cleanly. --out creates a new 0600 file and never overwrites or follows an existing path.
    • hardline watch enable|disable|run|status: a systemd timer (hourly, daily or weekly, with jitter and catch-up after downtime) that re-audits and compares with the previous run. A grade drop, a newly failing control or an outside edit to a file Hardline wrote exits 1, so hardline-watch.service shows in systemctl --failed and OnFailure= hooks fire. Skips a run while a change awaits confirm or another hardline command holds the lock. Results go to /var/lib/hardline/watch.json (0600).
    • hardline explain <id> [--json]: why a control matters, exactly what it checks, what apply writes, the preflight checks, and how to undo it. Works offline and without root; an unknown id suggests close matches. The text comes from controls/guides.toml, which also builds the website, so the CLI and https://sudosecurity.org/hardline/ never disagree.
    • RHEL 9, Rocky Linux 9 and AlmaLinux 9 support for the baseline profile: dnf/rpm package handling, sshd.service, a new selinux-enforcing check in phase 3, and SELinux labels restored on every file Hardline writes. Tested on Rocky 9.8 and AlmaLinux 9.8 VMs with SELinux enforcing.
    • Guarded firewalld support on RHEL 9, Rocky Linux 9 and AlmaLinux 9: when firewalld isn't running, apply --phase 2 installs it if needed, opens SSH and every listening port in the default zone while keeping existing zone rules, validates with firewall-offline-cmd --check-config, and starts it under the confirm/revert/boot guard. Rollback restores the zone file exactly and stops firewalld again. Tested on Rocky 9 with SELinux enforcing.
    • Controls can be limited to one distro family with os = ["debian"] or os = ["rhel"].

    Fixed

    • Boot-guard reverts now also stop units the reverted change enabled; disabling alone didn't cancel a start job already queued for that boot.
    • Rollback disables units before restoring files. Before, reverting an nftables change failed with "Unit file hardline-firewall.service does not exist" because the unit file was already removed, so the boot guard reported a failed revert.
    • audit, diff, status, controls and dry-run apply exit 3 when stdout fails for a reason other than a closed pipe (for example a full disk), instead of exiting 0 with a truncated report.
    • The dpkg lock wait is one 5-minute budget for the whole package install, not 5 minutes per apt-get call.

    Install

    Prebuilt binaries are published for the latest release only. Use the latest release, or build this tag from source:

    git clone --branch v0.4.0 https://git.sudosecurity.org/sudosecurity/hardline.git && cd hardline
cargo build --release --locked

    Full changelog: https://git.sudosecurity.org/sudosecurity/hardline/compare/v0.3.1...v0.4.0

    Downloads