os-forge 0.1.0

Multi-Platform System Hardening Tool for Windows, Ubuntu, and CentOS

OS Forge

Multi-Platform System Hardening Tool - Hackathon MVP

Quick Start

Option 1: Development Mode (Both CLI + GUI)

# Install dependencies
pip install -r requirements.txt
cd frontend && npm install && cd ..

# Access:
# - Frontend GUI: http://localhost:3000
# - Backend API: http://localhost:8000  
# - API Docs: http://localhost:8000/docs

Option 2: CLI Only

# Install dependencies
pip install -r requirements.txt

# Check system (dry run)
python main.py check

# Check with moderate level
python main.py check --level moderate

# Apply changes (remove dry-run)
python main.py check --no-dry-run

# Show system info
python main.py info

# Start web server only
python main.py server

Option 3: Docker (Production Stack)

# 1. Set up environment variables (IMPORTANT: Change default passwords!)
cp env.example .env
# Edit .env with your secure passwords

# 2. Build and run the complete production stack
docker-compose up --build

# Access:
# - Frontend GUI: http://localhost:3000
# - Backend API: http://localhost:8000
# - API Docs: http://localhost:8000/docs
# - Nginx Proxy: http://localhost:80
# - Prometheus: http://localhost:9091
# - Grafana: http://localhost:3001

🔒 Security Note: Always change default passwords in production! Use the .env file to set secure passwords.

API Endpoints

• GET / - System info and OS detection
• GET /rules - List applicable rules by level/OS
• POST /run - Execute hardening rules
• GET /history - View execution history
• GET /report - HTML compliance report
• GET /report/pdf - Download PDF compliance report
• POST /rollback/{rule_id} - Rollback specific rule
• GET /rollback/available - List rollback options

CLI Commands

python main.py check [--level basic|moderate|strict] [--dry-run/--no-dry-run]
python main.py report                    # Text compliance report
python main.py pdf-report [--output file.pdf]  # Generate PDF report
python main.py rollback <rule_id>        # Rollback specific rule
python main.py list-rollbacks           # Show available rollbacks
python main.py info                     # System information
python main.py server [--port 8000]    # Start web server

Enhanced Security Features Usage

Vulnerability Scanning

# Run comprehensive vulnerability scan (from project root)
python3 security_scan.py vulnerability --directory ./ --format html

# Scan with verbose output and save results
python3 security_scan.py vulnerability -d /path/to/code -v -f json -o scan_results.json

# Or run directly from enhanced directory
python3 security/enhanced/vulnerability_scanner.py --directory ./ --format html

Secrets Management

# Store a secret securely (from project root)
python3 security_scan.py secrets store "db_password" "my_secure_password" --description "Database password"

# Retrieve a secret
python3 security_scan.py secrets retrieve "db_password"

# List all secrets
python3 security_scan.py secrets list

# Rotate a secret
python3 security_scan.py secrets rotate "api_key"

# Or run directly from enhanced directory
python3 security/enhanced/secrets_manager.py store "db_password" "my_secure_password"

Security Monitoring

# Start real-time security monitoring (from project root)
python3 security_scan.py monitor start

# Check monitoring status
python3 security_scan.py monitor status

# View recent security events
python3 security_scan.py monitor events --limit 20

# View security alerts
python3 security_scan.py monitor alerts --severity HIGH

# Or run directly from enhanced directory
python3 security/enhanced/security_monitor.py start

Security Configuration & Compliance

# List security policies (from project root)
python3 security_scan.py config policy list

# Show policy details
python3 security_scan.py config policy show password_policy

# List security baselines
python3 security_scan.py config baseline list

# Run compliance validation
python3 security_scan.py config compliance linux_server_strict

# Or run directly from enhanced directory
python3 security/enhanced/security_config.py policy list

Integrated Security Operations

# Run comprehensive security assessment (from project root)
python3 security_scan.py integration scan --directory ./ --format html

# Start integrated monitoring
python3 security_scan.py integration monitor-start

# Generate comprehensive security report
python3 security_scan.py integration report security_report.html --format html

# Or run directly from enhanced directory
python3 security/enhanced/security_integration.py scan --directory ./ --format html

Features

• Modern Web GUI - React/Next.js dashboard with real-time updates
• OS Detection - Auto-detects Windows/Ubuntu/CentOS
• Multi-Level Hardening - Basic/Moderate/Strict (58 total rules: 32 Linux + 26 Windows)
• Dual Interface - Web GUI + CLI + REST API
• Dry Run Mode - Test before applying changes
• SQLite Database - Complete audit logs and history
• Rollback Support - One-click undo any configuration changes
• PDF Reports - Professional compliance reports with charts
• HTML Reports - Web-based compliance dashboard
• Docker Ready - Full-stack containerized deployment

🔒 Enhanced Security Features

• Vulnerability Scanner - Comprehensive code analysis for security vulnerabilities
• Secrets Management - Secure storage and management of sensitive data
• Security Monitoring - Real-time threat detection and alerting
• Security Configuration - Centralized policy and baseline management
• Compliance Validation - Automated compliance checking against security frameworks
• Threat Intelligence - Integration with threat indicators and security feeds
• Security Reporting - Detailed security assessment and remediation reports

Hardening Rules

Linux (32 Rules)

SSH Security (4 rules):

• LIN-SSH-001: Disable SSH root login (High)
• LIN-SSH-002: Set SSH protocol version to 2 (High)
• LIN-SSH-003: Disable SSH password authentication (Medium)
• LIN-SSH-004: Set SSH idle timeout (Medium)

Firewall (2 rules):

• LIN-FW-001: Enable UFW firewall (High)
• LIN-FW-002: Enable firewalld (RHEL/CentOS) (High)

User Management (2 rules):

• LIN-USER-001: Set password minimum length (Medium)
• LIN-USER-002: Set password complexity requirements (Medium)

Kernel Security (5 rules):

• LIN-KERNEL-001: Enable ASLR (Address Space Layout Randomization) (High)
• LIN-KERNEL-002: Disable core dumps (Medium)
• LIN-KERNEL-003: Enable kernel module loading restrictions (High)
• LIN-KERNEL-004: Disable IPv6 (Moderate)
• LIN-KERNEL-005: Enable kernel parameter hardening (High)

Service Management (3 rules):

• LIN-SERVICE-001: Disable unnecessary services (Medium)
• LIN-SERVICE-002: Secure systemd services (Medium)
• LIN-SERVICE-003: Enable auditd service (High)

File Permissions (2 rules):

• LIN-FILE-001: Set secure permissions on /etc/passwd (High)
• LIN-FILE-002: Set secure permissions on /etc/shadow (Critical)

Network Security (4 rules):

• LIN-NET-001: Disable IP forwarding (Medium)
• LIN-NET-002: Enable SYN flood protection (High)
• LIN-NET-003: Disable ICMP redirects (Medium)
• LIN-NET-004: Enable TCP SYN cookies (High)

Logging (1 rule):

• LIN-LOG-001: Configure secure logging (Medium)

Package Management (2 rules):

• LIN-PKG-001: Enable automatic security updates (Medium)
• LIN-PKG-002: Remove unnecessary packages (Low)

RHEL Specific (3 rules):

• LIN-RHEL-001: Enable automatic security updates (RHEL/CentOS) (Medium)
• LIN-RHEL-002: Enable SELinux (High)
• LIN-RHEL-003: Configure SELinux policies (High)

AppArmor/SELinux (2 rules):

• LIN-APPARMOR-001: Enable AppArmor (High)
• LIN-SELINUX-001: Configure SELinux enforcement (High)

Systemd Security (1 rule):

• LIN-SYSTEMD-001: Secure systemd configuration (Medium)

Container Security (2 rules):

• LIN-CONTAINER-001: Secure Docker daemon (High)
• LIN-CONTAINER-002: Configure container runtime security (High)

Windows (26 Rules)

User Account Control (2 rules):

• WIN-UAC-001: Enable User Account Control (UAC) (High)
• WIN-UAC-002: Set UAC to always notify (High)

Windows Firewall (2 rules):

• WIN-FW-001: Enable Windows Firewall (Critical)
• WIN-FW-002: Configure firewall profiles (High)

Windows Defender (3 rules):

• WIN-DEFENDER-001: Enable Windows Defender real-time protection (Critical)
• WIN-DEFENDER-002: Enable Windows Defender cloud protection (High)
• WIN-DEFENDER-003: Configure Windows Defender exclusions (Medium)

Group Policy (3 rules):

• WIN-GPO-001: Disable guest account (High)
• WIN-GPO-002: Configure password policy (High)
• WIN-GPO-003: Enable account lockout policy (Medium)

Registry Security (2 rules):

• WIN-REG-001: Disable SMBv1 protocol (High)
• WIN-REG-002: Enable secure logon (Medium)

Service Management (2 rules):

• WIN-SERVICE-001: Disable unnecessary services (Medium)
• WIN-SERVICE-002: Secure Windows services (High)

Network Security (2 rules):

• WIN-NET-001: Disable NetBIOS over TCP/IP (Medium)
• WIN-NET-002: Configure network discovery (Medium)

BitLocker (2 rules):

• WIN-BITLOCKER-001: Enable BitLocker drive encryption (High)
• WIN-BITLOCKER-002: Configure BitLocker policies (High)

Audit Logging (2 rules):

• WIN-AUDIT-001: Enable security event logging (High)
• WIN-AUDIT-002: Configure audit policies (Medium)

Windows Update (2 rules):

• WIN-UPDATE-001: Enable automatic updates (Medium)
• WIN-UPDATE-002: Configure update policies (Medium)

Remote Access (2 rules):

• WIN-RDP-001: Secure Remote Desktop (High)
• WIN-RDP-002: Configure RDP security (High)

System Configuration (2 rules):

• WIN-SYS-001: Disable autorun (Medium)
• WIN-SYS-002: Configure system restore (Low)

Architecture

Single-file modular monolith:

• FastAPI - REST API & web interface
• Typer - CLI interface
• SQLAlchemy - Database ORM
• YAML - Rule definitions
• Subprocess - OS command execution

Web GUI Interface

The modern React/Next.js frontend provides:

📊 Dashboard Tab

• System information and OS detection
• Real-time compliance metrics
• Quick overview of available rules and rollback options
• Latest execution results summary

🔒 Security Check Tab

• Interactive hardening level selection (Basic/Moderate/Strict)
• Dry run vs. apply modes
• Real-time execution with color-coded results
• Detailed rule information with severity ratings

📋 Reports Tab

• One-click PDF report downloads
• Interactive HTML report viewing
• Executive summary with compliance scoring

⏪ Rollback Tab

• Visual list of all applied configurations
• One-click rollback for any rule
• Historical tracking of changes

---

🚀 Team Development Roadmap

Person C — Database Developer

High Priority Tasks:

📊 Enhanced Database Schema

• Multi-Host Support: Extend schema to support multiple target machines

  -- Add hosts table for managing multiple systems
  CREATE TABLE hosts (
      id INTEGER PRIMARY KEY,
      hostname VARCHAR(255),
      ip_address VARCHAR(45),
      os_type VARCHAR(50),
      os_version VARCHAR(100),
      last_scan DATETIME,
      status VARCHAR(20) -- active, inactive, error
  );
  
  -- Link results to specific hosts
  ALTER TABLE hardening_results ADD COLUMN host_id INTEGER;
  

• Rule Templates System: Create configurable rule templates

  CREATE TABLE rule_templates (
      id INTEGER PRIMARY KEY,
      template_name VARCHAR(255),
      description TEXT,
      severity VARCHAR(20),
      os_compatibility JSON,
      check_command_template TEXT,
      remediate_command_template TEXT,
      rollback_command_template TEXT,
      variables JSON -- for template substitution
  );
  

• Compliance Frameworks: Add support for multiple frameworks

  CREATE TABLE compliance_frameworks (
      id INTEGER PRIMARY KEY,
      name VARCHAR(255), -- CIS, NIST, PCI-DSS, SOX
      version VARCHAR(50),
      description TEXT
  );
  
  CREATE TABLE framework_rules (
      framework_id INTEGER,
      rule_id VARCHAR(50),
      requirement_text TEXT,
      FOREIGN KEY (framework_id) REFERENCES compliance_frameworks(id)
  );
  

🔍 Advanced Querying & Analytics

• Create Database Views for Analytics:

  -- Compliance trend view
  CREATE VIEW compliance_trends AS 
  SELECT 
      DATE(timestamp) as scan_date,
      host,
      COUNT(*) as total_checks,
      SUM(CASE WHEN status = 'pass' THEN 1 ELSE 0 END) as passed,
      ROUND(AVG(CASE WHEN status = 'pass' THEN 100.0 ELSE 0.0 END), 2) as compliance_score
  FROM hardening_results 
  GROUP BY DATE(timestamp), host
  ORDER BY scan_date DESC;
  
  -- Risk assessment view
  CREATE VIEW risk_summary AS
  SELECT 
      rule_id,
      description,
      severity,
      COUNT(*) as total_scans,
      SUM(CASE WHEN status = 'fail' THEN 1 ELSE 0 END) as failures,
      ROUND(100.0 * SUM(CASE WHEN status = 'fail' THEN 1 ELSE 0 END) / COUNT(*), 2) as failure_rate
  FROM hardening_results 
  GROUP BY rule_id, description, severity
  HAVING failure_rate > 10
  ORDER BY failure_rate DESC;
  

• Performance Optimization:

  -- Add strategic indexes
  CREATE INDEX idx_results_timestamp ON hardening_results(timestamp);
  CREATE INDEX idx_results_host_status ON hardening_results(host, status);
  CREATE INDEX idx_results_rule_severity ON hardening_results(rule_id, severity);
  CREATE INDEX idx_results_composite ON hardening_results(host, rule_id, timestamp);
  

📈 Data Migration & Seeding

• Database Migration System: Create versioned migration scripts
• Seed Data Generator: Populate with realistic test data
• Backup/Restore Utilities: Automated database backup system
• Data Export Tools: Export to CSV, JSON, XML for external analysis

Medium Priority Tasks:

• Audit Trail Enhancement: Detailed change tracking with user attribution
• Data Retention Policies: Automatic cleanup of old data
• Database Clustering: Prepare for horizontal scaling
• Encryption at Rest: Implement database encryption

---

Aayushman

High Priority Tasks:

🔧 Advanced Policy Engine

• Custom Rule Builder: Web interface for creating custom rules
• Rule Dependency System: Handle rule execution order and dependencies
• Bulk Operations: Execute rules across multiple hosts simultaneously
• Scheduling System: Automated recurring scans with cron-like scheduling

🌐 Multi-Host Management

• Host Discovery: Network scanning for automatic host detection
• Agent Deployment: Remote agent installation and management
• Centralized Configuration: Global policy management across hosts
• Real-time Monitoring: Live status updates from managed hosts

🔌 Integration & Extensibility

• Plugin Architecture: Support for custom hardening modules
• REST API Extensions: Advanced endpoints for enterprise features
• Webhook Support: Integration with external monitoring systems
• Configuration Management: Integration with Ansible, Puppet, Chef

Medium Priority Tasks:

• Performance Optimization: Async execution, connection pooling
• Error Recovery: Automatic retry mechanisms and failure handling
• Multi-tenancy: Support for multiple organizations/teams

---

Abdul — DevOps/Infrastructure

High Priority Tasks:

🚀 Production Deployment

• Kubernetes Manifests: Complete K8s deployment configuration

  # Example structure needed:
  # k8s/
  # ├── namespace.yaml
  # ├── configmap.yaml
  # ├── secret.yaml
  # ├── backend-deployment.yaml
  # ├── frontend-deployment.yaml
  # ├── service.yaml
  # ├── ingress.yaml
  # └── persistent-volume.yaml
  

• CI/CD Pipeline: Complete GitHub Actions workflow

  # .github/workflows/deploy.yml
  # - Automated testing
  # - Security scanning
  # - Multi-stage builds
  # - Automated deployment to staging/prod
  # - Database migrations
  

• Infrastructure as Code: Terraform/CloudFormation for cloud deployment

• TLS/SSL Configuration: Proper certificate management and HTTPS

📊 Monitoring & Observability

• Metrics Collection: Prometheus + Grafana setup
• Log Aggregation: ELK stack or Loki for centralized logging
• Health Checks: Comprehensive health monitoring endpoints
• Alerting System: Critical event notifications (PagerDuty, Slack)

🔒 Security & Compliance

• Security Scanning: Container vulnerability scanning in CI
• Secrets Management: HashiCorp Vault or cloud secret managers
• Network Security: Network policies, firewalls, VPN setup
• Backup Strategy: Automated database and configuration backups

Medium Priority Tasks:

• Auto-scaling: Horizontal pod autoscaling for K8s
• Disaster Recovery: Multi-region deployment strategy
• Performance Testing: Load testing and optimization

---

Aditya — Backend/Policy Engine Developer

High Priority Tasks:

🛡️ Enhanced Security Rules

• CIS Benchmark Compliance: Implement complete CIS controls

  # Add 50+ additional rules covering:
  # - Network security settings
  # - File system permissions
  # - Service configurations
  # - User account policies
  # - Logging and auditing
  

• NIST Framework Support: Implement NIST Cybersecurity Framework controls

• PCI-DSS Rules: Payment card industry compliance rules

• Custom Framework Builder: Tool for defining custom compliance frameworks

🔍 Advanced Validation

• Rule Testing Framework: Automated testing for all hardening rules
• Simulation Mode: Safe testing environment for rule validation
• Dependency Resolution: Handle complex rule interdependencies
• Configuration Drift Detection: Monitor and alert on configuration changes

📊 Enhanced Reporting

• Executive Dashboards: C-level compliance reporting
• Trend Analysis: Historical compliance trend analysis
• Risk Scoring: Advanced risk calculation algorithms
• Automated Remediation: Self-healing configuration management

Medium Priority Tasks:

• Rule Marketplace: Community-driven rule sharing platform
• Machine Learning: Anomaly detection and predictive analytics
• API Rate Limiting: Advanced API security and throttling

---

Abdul — Linux Agent Developer/Windows Agent Developer

High Priority Tasks:

🐧 Linux Distribution Support

• RHEL/CentOS Rules: Red Hat specific hardening rules
• SUSE/openSUSE Support: SUSE-specific configurations
• Debian/Ubuntu LTS: Long-term support version compatibility
• Container Security: Docker/Podman security hardening

🔧 Advanced Linux Hardening

• AppArmor/SELinux: Mandatory access control configuration
• Systemd Security: Service hardening with systemd
• Kernel Parameters: Advanced kernel security settings
• Network Security: iptables, nftables, and firewall management

📦 Package Management

• Vulnerability Scanning: Integration with package vulnerability databases
• Update Management: Automated security update deployment
• Package Compliance: Ensure only approved packages are installed
• Software Inventory: Complete installed software tracking

🖥️ Windows Security Enhancement

• Group Policy Integration: Import/export Windows Group Policy settings
• Registry Deep Scan: Comprehensive Windows registry security audit
• Windows Defender: Advanced threat protection configuration
• BitLocker Management: Disk encryption compliance monitoring

🔒 Windows Enterprise Features

• Active Directory Integration: Domain-joined machine management
• PowerShell DSC: Desired State Configuration integration
• Windows Update Management: WSUS/Windows Update integration
• Event Log Analysis: Security event correlation and analysis

Medium Priority Tasks:

• Performance Monitoring: System performance impact analysis
• Hardware Security: TPM, secure boot, and firmware security
• Compliance Automation: Integration with configuration management tools

---

Arpit and Ritika — Frontend and UX/UI

High Priority Tasks:

🎨 Frontend Enhancements

• Real-time Dashboard: WebSocket-based live updates
• Advanced Visualizations: Charts and graphs for compliance trends
• Mobile Responsive: Tablet and mobile optimization
• User Management: Authentication, authorization, and user roles

📊 Reporting & Analytics

• Interactive Reports: Clickable, filterable compliance reports
• Custom Dashboards: User-configurable dashboard widgets
• Export Capabilities: Excel, CSV, and API data export
• Scheduled Reports: Automated report generation and distribution

Medium Priority Tasks:

• Multi-language Support: Internationalization (i18n)
• Accessibility: WCAG 2.1 compliance for web interface
• Progressive Web App: Offline capability and mobile app experience

---

🎯 Immediate Next Steps for Each Team Member:

Week 1 Focus:

• Database (Person C): ✅ Implement multi-host schema and create analytics views
• Core (Aayushman): ✅ Build multi-host management and scheduling system
• DevOps (Abdul): ✅ Set up production-ready CI/CD pipeline
• Backend (Abdul): ✅ Add 58 CIS benchmark rules (32 Linux + 26 Windows)
• Linux/Windows(Abdul): ✅ Implement RHEL/CentOS specific rules and Group Policy integration
• Frontend (Arpit): ✅ Add real-time dashboard updates

Success Metrics:

• Technical: ✅ 58 hardening rules (32 Linux + 26 Windows), ✅ production deployment ready
• Business: ✅ Executive-ready compliance reporting, ✅ enterprise-grade security
• User Experience: ✅ Real-time monitoring, ✅ mobile-responsive interface
• Operations: ✅ Automated CI/CD, ✅ monitoring, and alerting systems