cirven systems / modules / harden

cirven harden

Turns audit findings into fixes. Without --apply it only prints the plan. Every applied run is snapshotted first and can be rolled back byte for byte.

usage

$ cirven harden
cirven harden · plan for laptop

 1  user    chmod 700 ~/.ssh
 2  system  set kernel.kptr_restrict=1 in /etc/sysctl.d/99-zz-cirven.conf and live
 3  system  sshd: PasswordAuthentication no in /etc/ssh/sshd_config.d/10-cirven.conf
            + PasswordAuthentication no
 4  manual  ssh key has no passphrase (~/.ssh/id_ed25519)
            -> ssh-keygen -p -f ~/.ssh/id_ed25519, then load it into ssh-agent

nothing has been changed.
$ cirven harden --apply 1
$ sudo cirven harden --apply 2,3
snapshot 20261017T143000Z saved in /var/lib/cirven/harden
undo with: cirven harden --rollback 20261017T143000Z
$ cirven harden --list

how

• small declared changes only: a mode bit, a sysctl, a drop-in file cirven owns
• drop-ins over edits: upstream configs stay untouched. the sysctl file sorts last so it survives boot
• the snapshot is written before the first change; a failing step rolls back the whole run
• nothing restarts a service: sshd changes wait for your reload, the firewall is only suggested, so a fix cannot cut off a remote session
• passphrases, secure boot and secret rotation need judgement: printed as manual steps, never run
• chmod snapshots store the old mode only. private keys are never copied
• chmod refuses to follow symlinks. user steps run as you, system steps only under sudo

threat model

Stops: the attack paths audit reports and harden can close. Does not stop: what you re-enable later; run audit again. A leaked secret is reported, but it must be rotated at its issuer.