vamp-host-audit

Live multi-platform host auditor — no permanent agent VampSecure Labs · VampSecure Studios

🇬🇧 English · 🇪🇸 Español

---

🇬🇧 English

Live multi-platform host auditor — no permanent agent required.

Audits the real (runtime) state of a Linux, macOS, or Windows host via SSH, WinRM, or locally. No agent installed on the target. A single Python file with no external dependencies beyond rich.

Unlike static repository scanners (vamp-compliance-check), this tool interrogates the running operating system: active sysctl parameters, real file permissions, running services, applied firewall rules.

---

Features v1.16

• 272 total checks: 184 Linux · 37 macOS · 51 Windows
• Agentless SSH via subprocess (OpenSSH) — paramiko as optional dep
• WinRM via pywinrm (optional dep) — NTLM · Kerberos · Basic · Certificate
• Local execution with optional sudo support
• Automatic detection of distro/version for Linux and macOS; Windows detected via WinRM
• Multi-framework mapping per check: CIS · ENS RD 311/2022 · NIS2 Art. 21(2) · ISO 27001:2022 · DORA
• Compliance table in console: Applicable / Pass / Fail+Warn / Skip / % per framework
• 12 built-in profiles + custom YAML profile support + multi-profile (--profile A B)
• ENS RD 311/2022 full traceability — each check carries its primary measure (ens_ctrl, one of the 73 in Annex II), secondary measures (ens_extra), and reinforcements evidenced (ens_refuerzos, e.g. op.acc.6.r9), cross-referenced with CCN-STIC 808 (Apr-2026). ENS profiles include only checks the ENS requires for that category. All guaranteed by tests/test_ens.py; criteria in docs/ens-rd311-2022.md
• Profile all — audits all 272 checks regardless of platform and framework
• Triple reporter: color rich console · structured JSON · standalone dark-theme HTML
• Unified VSL professional report (--report-html / --report-pdf) via vampsec_report.py
• Engagement parameters (--auditor-name, --auditor-company, --client, --engagement) on cover page
• VampSecure Studios logo in HTML reports
• Normative column in technical HTML with NIS2 / ISO 27001 / DORA references per check
• Standard exit codes for CI/CD: 2=CRITICAL · 1=HIGH · 0=clean
• No daemon, no database, no persistent state

Platforms

Version	Platform	Status
v1.0	Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch)	✅ Available
v1.1	macOS (Sonoma/Sequoia, Apple Silicon + Intel)	✅ Available
v1.2	Windows Server 2019/2022 (WinRM + PowerShell)	✅ Available
v1.3	Cross-framework NIS2/ISO27001/DORA — all checks	✅ Available
v1.4	Engagement params · VS Logo · Unified VSL report	✅ Available
v1.5	+20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS complete in 99 checks	✅ Available
v1.14	ENS mapping aligned with Annex II of RD 311/2022 (144 checks reassigned; removed RD 3/2010 measures) · no SyntaxWarning in Python 3.12+ · real version in --help	✅ Available
v1.15	ENS cross-referenced with CCN-STIC 808: secondary measures and reinforcements per check · ENS profiles filtered by category requirement · +13 checks for measures without coverage (SSH limited/last access/inactivity, TMOUT, log permissions, backups, compilers, Postfix, SmartScreen, Safari) → 272 checks	✅ Available
v1.16	Bilingual README (EN/ES)	✅ Available

---

Installation

pip install vamp-host-audit

With optional dependencies:

pip install "vamp-host-audit[yaml]"           # external YAML profiles (PyYAML)
pip install "vamp-host-audit[ssh]"            # paramiko for advanced SSH
pip install "vamp-host-audit[winrm]"          # pywinrm for Windows hosts
pip install "vamp-host-audit[report]"         # fpdf2 for --report-pdf
pip install "vamp-host-audit[yaml,ssh,winrm,report]"

From the repo (development):

git clone http://localhost:3030/vampsecure/vamp-host-audit.git
cd vamp-host-audit
pip install -e ".[yaml,ssh,report]"

---

Quick Start

# Audit this host locally
vamp-host-audit --local

# Audit a remote host via SSH
vamp-host-audit --host 192.168.1.10 --user ubuntu

# With specific key and ENS Medium profile
vamp-host-audit --host vps --user ubuntu --key ~/.ssh/id_ed25519 --profile ens-medio

# Generate JSON + dark-theme technical HTML report
vamp-host-audit --local --profile linux-cis --json report.json --html

# Critical checks only (quick scan, < 30s)
vamp-host-audit --host server --user root --profile quick

# Audit with ALL frameworks (NIS2 + ISO27001 + DORA + CIS) at once
vamp-host-audit --local --profile all

# Two profiles at once (deduplicated union)
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Audit a Windows Server via WinRM (NTLM, port 5985)
vamp-host-audit --winrm 192.168.1.20 --user Administrator --password S3cr3t0

# Windows Server with HTTPS (WinRM 5986) and quick profile
vamp-host-audit --winrm 192.168.1.20 --user Administrator --password S3cr3t0 \
                --winrm-ssl --profile windows-quick

# Professional report with engagement data (client cover page)
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "Antonio Hernández" \
    --auditor-company "VampSecure Studios" \
    --client "Audited Company Ltd." \
    --engagement "AUD-2026-001" \
    --report-html client_report.html \
    --report-pdf  client_report.pdf

# Specific checks
vamp-host-audit --local --checks AUTH-001,AUTH-002,SERV-006

# Verbose: show passing checks too
vamp-host-audit --local --verbose

---

Available Profiles

Profile	Platform	Framework	Checks	Description
linux-cis	Linux	CIS	42	CIS Linux Benchmark Level 1 (all Linux checks)
ens-basico	Linux+macOS+Win	ENS	37	ENS Basic Category — RD 311/2022 (only checks required by ENS in Basic)
ens-medio	Linux+macOS+Win	ENS	91	ENS Medium Category (only checks required in Medium)
ens-alto	Linux+macOS+Win	ENS	272	ENS High Category (all checks with an ENS measure)
nis2-art21	all (79)	NIS2	79	NIS2 Art. 21(2) — mandatory technical domains
iso27001-a8	all (79)	ISO 27001	79	ISO 27001:2022 Annex A.8 — technical controls
dora-art9	all (79)	DORA	79	DORA Art. 9/10/13 — ICT resilience for financial sector
all	all (79)	multi	79	All checks from all frameworks and platforms
quick	Linux	multi	14	Quick scan Linux — critical controls, < 30s
macos-cis	macOS	CIS	17	CIS macOS Benchmark v3.0 (Sonoma/Sequoia)
macos-quick	macOS	CIS	8	Quick scan macOS — critical controls
windows-cis	Windows	CIS	20	CIS Windows Server Benchmark v2.0
windows-quick	Windows	CIS	8	Quick scan Windows — critical controls

Multi-profile

--profile accepts one or multiple names: checks are automatically deduplicated.

# NIS2 + ISO 27001 compliance in a single pass
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Full financial regulation + complete CIS Linux
vamp-host-audit --local --profile dora-art9 linux-cis

Custom YAML Profiles

# my-profile.yaml
title: "Custom profile"
framework: "custom"
checks:
  - AUTH-001
  - AUTH-002
  - SERV-006
  - NET-001

vamp-host-audit --local --profile-file my-profile.yaml

---

Sample Output

  vamp-host-audit v1.17 · Linux · profile: nis2-art21,cis-l1
  ─────────────────────────────────────────────────────────────────
  [PASS] AUTH-001 SSH root login disabled
  [PASS] AUTH-003 PAM password complexity: minlen=14, ucredit, dcredit
  [FAIL] AUTH-005 SSH protocol version: SSHv1 still enabled            ← HIGH
  [FAIL] KERN-002 kernel.randomize_va_space = 0 (ASLR disabled)        ← CRITICAL
  [WARN] FILE-007 /etc/crontab world-readable
  [PASS] SERV-001 Telnet disabled
  [FAIL] NET-004  IPv6 enabled without firewall rules                   ← MEDIUM
  [PASS] DOCK-003 Docker daemon socket not world-accessible
  [SKIP] WIN-001  Windows-only check (running Linux)

  ┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
  │ Framework   │ Applic. │ Pass │ Fail+Warn │ Skip │ Compliance   │
  ├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
  │ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
  │ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
  └─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

  272 checks · 3 CRITICAL · 5 HIGH · 4 MEDIUM · 6 WARN

Compliance Table (console)

When using --profile nis2-art21, iso27001-a8, dora-art9 or all, the tool automatically shows the compliance table by framework at the end:

┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
│ Framework   │ Applic. │ Pass │ Fail+Warn │ Skip │ Compliance   │
├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
│ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ISO 27001   │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ DORA        │ 46      │ 36   │ 7         │ 3    │ 83.7%        │
│ CIS         │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
└─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

---

Engagement Reports

Technical dark-theme HTML (--html)

Generates a self-contained report with:

• Header with VampSecure Studios logo and engagement metadata
• Table of all checks with Normative column (NIS2/ISO/DORA refs per check)
• Compliance table by framework at the end
• No external dependencies — a single .html file

Unified VSL professional report (--report-html / --report-pdf)

Generates a report in the VampSecure Labs unified format shared by all toolkit tools (vampsec_report.py). Includes only FAIL/WARN findings with:

• Cover page with engagement data (auditor, company, client, reference)
• Summary table of findings by severity
• Detailed cards with evidence, remediation, and normative references
• Professional light HTML or executive PDF format

# Technical dark-theme report only
vamp-host-audit --local --profile all --html technical.html

# Client unified report only
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "A. Hernández" --auditor-company "VampSecure Studios" \
    --client "ACME Corp" --engagement "AUD-2026-042" \
    --report-html client.html --report-pdf client.pdf

# All three at once
vamp-host-audit --local --profile all \
    --json raw.json --html technical.html \
    --auditor-name "A. Hernández" --client "ACME Corp" \
    --report-html client.html

---

Available Checks — macOS (v1.1)

macOS — CIS macOS Benchmark

ID	Control	Severity	CIS macOS
MACOS-001	SIP (System Integrity Protection) active	CRITICAL	5.1.2
MACOS-002	FileVault 2 active on system volume	HIGH	2.5.1
MACOS-003	Gatekeeper active	HIGH	5.1.1
MACOS-004	macOS Firewall active	HIGH	2.2.1
MACOS-005	Automatic updates enabled	MEDIUM	1.1
MACOS-006	Remote SSH access restricted or disabled	MEDIUM	2.3.3.5
MACOS-007	Automatic screen lock (≤ 5 min)	MEDIUM	2.5.2
MACOS-008	Screen Sharing disabled	HIGH	2.3.2.1
MACOS-009	Remote Management (ARD) disabled	HIGH	2.3.2.2
MACOS-010	Guest account disabled	HIGH	5.6
MACOS-011	Bluetooth disabled if not needed	LOW	2.1.1
MACOS-012	AirDrop restricted to Contacts or disabled	MEDIUM	2.3.3.2
MACOS-013	XProtect / MRT active and updated	MEDIUM	5.1.3
MACOS-014	Login window without user list	LOW	5.9
MACOS-015	SSH: PermitRootLogin disabled (macOS)	CRITICAL	5.2.10
MACOS-016	sudo timestamp_timeout ≤ 5 min	MEDIUM	5.4
MACOS-017	Secure Boot active (T2 / Apple Silicon)	CRITICAL	—

---

Available Checks — Windows (v1.2)

Windows — CIS Windows Server Benchmark

ID	Control	Severity	CIS Ref
WIN-001	Account Lockout: threshold ≤ 10 failed attempts	HIGH	1.2.2
WIN-002	Password Policy: min 14 chars, history ≥ 24	HIGH	1.1.x
WIN-003	Guest account disabled	HIGH	2.3.1.2
WIN-004	Administrator SID-500 disabled or renamed	MEDIUM	2.3.1.1
WIN-005	UAC active (EnableLUA=1, admin prompt)	HIGH	2.3.17.x
WIN-006	BitLocker active on system volume	HIGH	18.9.44
WIN-007	NTLM v1 disabled (LMCompatibilityLevel ≥ 3)	CRITICAL	2.3.11.1
WIN-008	WDigest disabled (UseLogonCredential=0)	CRITICAL	2.3.11.9
WIN-009	Windows Firewall active on all profiles	HIGH	9.1.1/9.2.1/9.3.1
WIN-010	SMBv1 disabled	CRITICAL	18.3.3
WIN-011	RDP with mandatory NLA (UserAuthentication=1)	HIGH	18.10.56.3.9
WIN-012	Remote Registry service disabled	MEDIUM	2.2.40
WIN-013	Audit policy configured	MEDIUM	17.x
WIN-014	Windows Defender active and updated	HIGH	18.9.47
WIN-015	Automatic updates active	HIGH	18.9.108.2
WIN-016	PowerShell Script Block Logging active	MEDIUM	18.10.41.1
WIN-017	LSA RunAsPPL active (credential protection)	HIGH	2.3.11.8
WIN-018	Credential Guard active (Windows 10/Server 2016+)	HIGH	18.9.29
WIN-019	AutoRun / AutoPlay disabled	MEDIUM	18.9.8.1
WIN-020	No pending security updates	HIGH	—

---

Available Checks — Linux (v1.0)

AUTH — Authentication and access control

ID	Control	Severity	CIS	ENS	NIS2	ISO 27001
AUTH-001	SSH PermitRootLogin no	CRITICAL	5.2.10	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-002	SSH PasswordAuthentication no	HIGH	5.2.14	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-003	SSH MaxAuthTries ≤ 4	MEDIUM	5.2.7	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-004	SSH PermitEmptyPasswords no	CRITICAL	5.2.11	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-005	SSH X11Forwarding no	LOW	5.2.6	—	—	A.8.9
AUTH-006	SSH LogLevel INFO/VERBOSE	MEDIUM	5.2.5	op.exp.8	Art.21(2)(a)	A.8.15
AUTH-007	sudo without global NOPASSWD	HIGH	5.3.5	op.acc.4	Art.21(2)(i)	A.8.5
AUTH-008	PAM password policy	MEDIUM	5.4.1	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-009	Root account locked	HIGH	5.4.3	op.acc.4	Art.21(2)(i)	A.8.5
AUTH-010	No additional UID 0 accounts	CRITICAL	5.4.3	op.acc.4	Art.21(2)(i)	A.8.5

KERN — Kernel parameters (sysctl)

ID	Control	Severity	CIS	NIS2	ISO 27001
KERN-001	ASLR active (randomize_va_space=2)	HIGH	1.6.2	Art.21(2)(e)	A.8.8
KERN-002	Core dumps disabled (suid_dumpable=0)	MEDIUM	1.6.1	Art.21(2)(e)	A.8.3
KERN-003	dmesg restricted (dmesg_restrict=1)	LOW	1.6.3	Art.21(2)(e)	A.8.3
KERN-004	IP forwarding disabled	MEDIUM	3.1.1	Art.21(2)(e)	A.8.20
KERN-005	ICMP redirects disabled	MEDIUM	3.2.2	Art.21(2)(e)	A.8.20
KERN-006	Send redirects disabled	MEDIUM	3.1.2	Art.21(2)(e)	A.8.20
KERN-007	SYN cookies active	MEDIUM	3.2.8	Art.21(2)(e)	A.8.20
KERN-008	IPv6 RA disabled	LOW	3.1.3	Art.21(2)(e)	A.8.20

FILE — Permissions and critical files

ID	Control	Severity	CIS	NIS2	ISO 27001
FILE-001	/etc/passwd permissions 644	HIGH	6.1.2	Art.21(2)(e)	A.8.3
FILE-002	/etc/shadow permissions 640	CRITICAL	6.1.3	Art.21(2)(e)	A.8.3
FILE-003	/etc/group permissions 644	MEDIUM	6.1.4	Art.21(2)(e)	A.8.3
FILE-004	SUID/SGID inventory	MEDIUM	6.1.11	Art.21(2)(e)	A.8.3
FILE-005	No world-writable in critical paths	HIGH	6.1.9	Art.21(2)(e)	A.8.3
FILE-006	Sticky bit on world-writable dirs	MEDIUM	6.1.10	Art.21(2)(e)	A.8.3
FILE-007	No files without owner	LOW	6.1.13	Art.21(2)(e)	A.8.3

SERV — System services

ID	Control	Severity	CIS	NIS2	ISO 27001
SERV-001	auditd active and enabled	HIGH	4.1.1.1	Art.21(2)(a)	A.8.15
SERV-002	Centralized logging (rsyslog/journald)	HIGH	4.2.1	Art.21(2)(a)	A.8.15
SERV-003	cron access restricted	LOW	5.1.8	Art.21(2)(i)	A.8.9
SERV-004	Telnet/rsh/rlogin disabled	CRITICAL	2.2.18	Art.21(2)(e)	A.8.9
SERV-005	NTP/chrony active	MEDIUM	2.2.1.1	Art.21(2)(a)	A.8.16
SERV-006	Host firewall active	CRITICAL	3.5.1	Art.21(2)(e)	A.8.20
SERV-007	AppArmor/SELinux MAC active	MEDIUM	1.7	Art.21(2)(e)	A.8.7

NET — Network

ID	Control	Severity	NIS2	ISO 27001
NET-001	Firewall with restrictive INPUT policy	CRITICAL	Art.21(2)(e)	A.8.20
NET-002	Inventory of listening ports	INFO	Art.21(2)(a)	A.8.9
NET-003	Unused protocols disabled (dccp/sctp/rds)	LOW	Art.21(2)(e)	A.8.20
NET-004	SSH only on necessary interfaces	LOW	Art.21(2)(i)	A.8.5
NET-005	No FTP/Telnet/rsync on standard ports	HIGH	Art.21(2)(e)	A.8.9

UPDT — Updates

ID	Control	Severity	NIS2	ISO 27001
UPDT-001	Pending security updates	HIGH	Art.21(2)(e)	A.8.8
UPDT-002	Automatic updates configured	MEDIUM	Art.21(2)(e)	A.8.8
UPDT-003	System updated < 90 days	MEDIUM	Art.21(2)(e)	A.8.8

DOCK — Docker host

ID	Control	Severity	NIS2	ISO 27001
DOCK-001	docker.sock without universal access	CRITICAL	Art.21(2)(i)	A.8.5
DOCK-002	No privileged containers running	CRITICAL	Art.21(2)(e)	A.8.7

---

Full CLI Options

Target (required, one of three):
  --local                  Audit the local host (no SSH or WinRM)
  --host HOST              Hostname or IP of remote host (SSH — Linux/macOS)
  --winrm HOST             Hostname or IP of Windows host (WinRM)

SSH connection (only with --host):
  --user USER, -u USER     SSH user (default: $USER)
  --port PORT, -p PORT     SSH port (default: 22)
  --key KEY, -i KEY        SSH private key file
  --password PASS          SSH password (always prefer key)
  --use-paramiko           Use paramiko instead of subprocess SSH
  --sudo                   Use sudo for commands that require it (--local)

WinRM connection (only with --winrm):
  --winrm-port PORT        WinRM port (default: 5985; HTTPS uses 5986)
  --winrm-ssl              Use HTTPS for WinRM connection
  --winrm-transport TRANS  Transport: ntlm (default), kerberos, basic, certificate
  --user USER, -u USER     Windows user (domain\user or .\local_user)
  --password PASS          Windows password

Profile:
  --profile NAME [...]     Built-in profile(s) — accepts one or more; auto-deduplicated
                           (default: linux-cis / windows-cis depending on target)
                           Special: 'all' runs the 79 checks from all frameworks
  --profile-file YAML      Custom YAML profile file
  --checks IDS             Comma-separated list of check IDs

Output:
  --json FILE              Save structured JSON report
  --html                   Generate dark-theme technical HTML report (all checks)
  --output FILE            HTML output file (implies --html)
  --no-color               No console colors
  --verbose, -v            Show PASS and SKIP checks too

Engagement (report cover page):
  --auditor-name NAME      Auditor name (shown on cover page)
  --auditor-company COMPANY Auditing company (shown on cover page)
  --client COMPANY         Audited company / client (shown on cover page)
  --engagement REF         Engagement reference (e.g. AUD-2026-001)
  --report-html FILE       Generate professional HTML report (unified VSL format)
  --report-pdf  FILE       Generate professional PDF report (requires fpdf2)

General:
  --version                Show version

---

Exit Codes

Code	Meaning
0	No CRITICAL or HIGH findings
1	HIGH severity findings (no critical)
2	CRITICAL severity findings

Designed for CI/CD: a pipeline can block on code ≥ 1 or ≥ 2 depending on the acceptable threshold.

---

JSON Output Format

{
  "tool": "vamp-host-audit",
  "version": "1.16",
  "target": "prod-server",
  "platform": {"os": "linux", "distro": "ubuntu", "version": "22.04", "kernel": "5.15.0"},
  "profile": "NIS2 Art. 21(2) — Technical domains",
  "timestamp": "2026-09-30T10:00:00Z",
  "duration_s": 14.2,
  "summary": {"critical": 1, "high": 3, "medium": 2, "pass": 61, "skip": 6, "total": 79},
  "findings": [
    {
      "check_id": "AUTH-001",
      "titulo": "SSH: PermitRootLogin disabled",
      "categoria": "AUTH",
      "severidad": "critical",
      "estado": "fail",
      "evidencia": "PermitRootLogin = yes",
      "correccion": "Add 'PermitRootLogin no' to /etc/ssh/sshd_config and restart sshd.",
      "marcos": ["CIS", "ENS", "NIS2", "ISO27001"],
      "refs": {
        "NIS2":     "Art.21(2)(i)",
        "ISO27001": "A.8.5",
        "CIS":      "5.2.10",
        "ENS":      "op.acc.6"
      },
      "cis_ref": "5.2.10",
      "ens_ctrl": "op.acc.6"
    }
  ]
}

---

VSL Ecosystem Integration

vampsec_report.py

The vampsec_report.py module is VampSecure Labs' unified report generator, shared by all toolkit tools. When using --report-html or --report-pdf, vamp-host-audit converts FAIL/WARN findings into Finding objects and delegates report layout to VampSecReport.

If vampsec_report.py is not available (minimal installation), --html still works with the standalone dark-theme report.

vamp-orchestrator

JSON reports generated with --json are directly consumable by vamp-orchestrator for multi-tool audit pipelines.

VampSuite Sec

Integrated in VampSuite Sec as a host audit module via vamp-orchestrator.

---

Why vamp-host-audit vs. Lynis · CIS-CAT Pro · OpenSCAP

Feature	vamp-host-audit	Lynis	CIS-CAT Pro	OpenSCAP
No permanent agent	✅ SSH/WinRM/local	✅ local only	❌ dedicated agent or runner	⚠️ local or manual SSH
Windows Server (WinRM)	✅ native	❌	✅	⚠️ limited
ENS RD 311/2022 + CCN-STIC 808	✅ 272 mapped checks	❌	❌	❌
NIS2 Art. 21 / ISO 27001 / DORA	✅ multi-framework per check	❌	⚠️ CIS only	⚠️ SCAP/XCCDF
Multi-profile in one pass	✅ --profile A B	❌	❌	❌
Professional client report (HTML+PDF)	✅ unified VSL	❌ plain text	✅ HTML	⚠️ basic HTML
CI/CD exit codes 0/1/2	✅	❌	❌	❌
External dependencies	only rich	none	JRE + license	libxml2 + OVAL

• ENS exclusive on the market: the only auditor that implements the full Annex II of RD 311/2022 — primary, secondary measures, and CCN-STIC 808 reinforcements — per check, with automated test_ens.py guaranteeing traceability.
• No agent or database: Lynis only audits locally; CIS-CAT Pro needs a dedicated runner; vamp-host-audit audits any Linux/macOS/Windows host from your machine with a single SSH or WinRM line.
• Real multi-framework: the same check simultaneously evidences CIS, ENS, NIS2, ISO 27001, and DORA — without running four different tools or manually reconciling outputs.
• Engagement reports: client cover page, compliance table by framework, and detailed finding cards — ready to deliver to an external auditor or a CISO.

---

Check Coverage

Check ID	Description	Standard	Severity
AUTH-001	SSH PermitRootLogin disabled	CIS L1 §5.2.10 / ENS op.acc.6 / NIS2 Art.21(2)(i)	CRITICAL
AUTH-002	SSH PasswordAuthentication disabled	CIS L1 §5.2.14 / ENS op.acc.6	HIGH
AUTH-004	SSH PermitEmptyPasswords disabled	CIS L1 §5.2.11 / ENS op.acc.6	CRITICAL
AUTH-007	sudo without global NOPASSWD	CIS L1 §5.3.5 / ENS op.acc.4 / ISO 27001 A.8.5	HIGH
AUTH-010	No additional UID 0 accounts	CIS L1 §5.4.3 / ENS op.acc.4	CRITICAL
KERN-001	ASLR active (randomize_va_space=2)	CIS L1 §1.6.2 / NIS2 Art.21(2)(e)	HIGH
FILE-002	/etc/shadow permissions 640 or stricter	CIS L1 §6.1.3 / ENS mp.si.2	CRITICAL
FILE-005	No world-writable files in critical paths	CIS L1 §6.1.9 / ISO 27001 A.8.3	HIGH
SERV-001	auditd active and enabled	CIS L1 §4.1.1 / ENS op.exp.8 / NIS2 Art.21(2)(a)	HIGH
SERV-004	Telnet/rsh/rlogin disabled	CIS L1 §2.2.18 / ENS mp.com.1	CRITICAL
SERV-006	Host firewall active	CIS L1 §3.5.1 / ENS mp.com.2 / DORA Art.9	CRITICAL
NET-001	Firewall INPUT policy is DROP or REJECT	CIS L1 §3.6 / NIS2 Art.21(2)(e)	CRITICAL
WIN-007	NTLM v1 disabled (LMCompatibilityLevel >= 3)	CIS WS Benchmark v2.0 §2.3.11.1 / ENS	CRITICAL
WIN-010	SMBv1 disabled	CIS WS Benchmark v2.0 §18.3.3 / ENS mp.com.1	CRITICAL
MACOS-001	SIP (System Integrity Protection) active	CIS macOS Benchmark v3.0 §5.1.2	CRITICAL
UPDT-001	No pending security updates	CIS L1 / NIS2 Art.21(2)(e) / ISO 27001 A.8.8	HIGH

---

Version History

Version	Main changes
v1.16	Bilingual README (EN/ES)
v1.15	ENS cross-referenced with CCN-STIC 808: secondary measures and reinforcements per check · ENS profiles filtered by category requirement · +13 checks → 272 checks
v1.14	ENS mapping aligned with Annex II of RD 311/2022 (144 checks reassigned) · no SyntaxWarning in Python 3.12+ · real version in --help
v1.5	+20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS complete in 99 checks
v1.4	Engagement params · VS Logo · Unified VSL report
v1.3	Cross-framework NIS2/ISO27001/DORA
v1.2	Windows Server (WinRM + PowerShell)
v1.1	macOS (Sonoma/Sequoia)
v1.0	Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch)

---

License

AGPL-3.0-only · © VampSecure Studios — VampSecure Labs Security Research Division

For authorized penetration testing use only. Use only against systems for which you have explicit written authorization.

---

---

🇪🇸 Español

Auditor live multiplataforma de hosts — sin agente permanente VampSecure Labs · VampSecure Studios

Audita el estado real (runtime) de un host Linux, macOS o Windows mediante SSH, WinRM o en local. Sin agente instalado en el objetivo. Un único fichero Python, sin dependencias externas más allá de rich.

A diferencia de los scanners estáticos de repositorio (vamp-compliance-check), este tool interroga el sistema operativo en ejecución: parámetros sysctl activos, permisos reales de ficheros, servicios corriendo, reglas de firewall aplicadas.

---

Características v1.16

• 272 checks totales: 184 Linux · 37 macOS · 51 Windows
• SSH sin agente vía subprocess (OpenSSH) — paramiko como dep opcional
• WinRM vía pywinrm (dep opcional) — NTLM · Kerberos · Basic · Certificate
• Ejecución local con soporte de sudo opcional
• Detección automática de distro/versión para Linux y macOS; Windows se detecta por WinRM
• Mapeo multi-framework por cada check: CIS · ENS RD 311/2022 · NIS2 Art. 21(2) · ISO 27001:2022 · DORA
• Tabla de cumplimiento en consola: Aplican / Pass / Fail+Warn / Skip / % por normativa
• 12 perfiles integrados + soporte de perfiles YAML personalizados + multi-perfil (--profile A B)
• ENS RD 311/2022 trazabilidad completa — cada check lleva su medida principal (ens_ctrl, una de las 73 del Anexo II), sus medidas secundarias (ens_extra) y los refuerzos que evidencia (ens_refuerzos, p.ej. op.acc.6.r9), cotejados con la tabla de verificación CCN-STIC 808 (abr-2026). Los perfiles ENS solo incluyen checks que el ENS exige en su categoría. Todo lo garantiza tests/test_ens.py; criterios en docs/ens-rd311-2022.md
• Perfil all — audita todos los 272 checks independientemente de plataforma y framework
• Reporter triple: consola rich en color · JSON estructurado · HTML dark-theme autónomo
• Informe profesional unificado VSL (--report-html / --report-pdf) via vampsec_report.py
• Parámetros de engagement (--auditor-name, --auditor-company, --client, --engagement) en portada
• Logo VampSecure Studios en informes HTML
• Columna Normativa en HTML técnico con referencias NIS2 / ISO 27001 / DORA por check
• Códigos de salida estándar para CI/CD: 2=CRÍTICO · 1=ALTO · 0=limpio
• Sin daemon, sin base de datos, sin estado persistente

Plataformas

Versión	Plataforma	Estado
v1.0	Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch)	✅ Disponible
v1.1	macOS (Sonoma/Sequoia, Apple Silicon + Intel)	✅ Disponible
v1.2	Windows Server 2019/2022 (WinRM + PowerShell)	✅ Disponible
v1.3	Marcos cruzados NIS2/ISO27001/DORA — todos los checks	✅ Disponible
v1.4	Engagement params · Logo VS · Informe unificado VSL	✅ Disponible
v1.5	+20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS completo en 99 checks	✅ Disponible
v1.14	Mapeo ENS alineado con el Anexo II del RD 311/2022 (144 checks reasignados; fuera las medidas del RD 3/2010) · sin SyntaxWarning en Python 3.12+ · versión real en --help	✅ Disponible
v1.15	ENS cotejado con CCN-STIC 808: medidas secundarias y refuerzos por check · perfiles ENS filtrados por exigencia de la categoría · +13 checks para medidas sin cobertura (SSH limitado/último acceso/inactividad, TMOUT, permisos de logs, copias, compiladores, Postfix, SmartScreen, Safari) → 272 checks	✅ Disponible
v1.16	README bilingüe (EN/ES)	✅ Disponible

---

Instalación

pip install vamp-host-audit

Con dependencias opcionales:

pip install "vamp-host-audit[yaml]"           # perfiles YAML externos (PyYAML)
pip install "vamp-host-audit[ssh]"            # paramiko para SSH avanzado
pip install "vamp-host-audit[winrm]"          # pywinrm para hosts Windows
pip install "vamp-host-audit[report]"         # fpdf2 para --report-pdf
pip install "vamp-host-audit[yaml,ssh,winrm,report]"

Desde el repo (desarrollo):

git clone http://localhost:3030/vampsecure/vamp-host-audit.git
cd vamp-host-audit
pip install -e ".[yaml,ssh,report]"

---

Uso rápido

# Audita este host en local
vamp-host-audit --local

# Audita un host remoto por SSH
vamp-host-audit --host 192.168.1.10 --user ubuntu

# Con clave específica y perfil ENS Medio
vamp-host-audit --host vps --user ubuntu --key ~/.ssh/id_ed25519 --profile ens-medio

# Genera informe JSON + HTML técnico dark-theme
vamp-host-audit --local --profile linux-cis --json informe.json --html

# Solo checks críticos (quick scan, < 30s)
vamp-host-audit --host servidor --user root --profile quick

# Audita con TODOS los marcos (NIS2 + ISO27001 + DORA + CIS) a la vez
vamp-host-audit --local --profile all

# Dos perfiles a la vez (unión deduplicada)
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Audita un Windows Server por WinRM (NTLM, puerto 5985)
vamp-host-audit --winrm 192.168.1.20 --user Administrador --password S3cr3t0

# Windows Server con HTTPS (WinRM 5986) y perfil rápido
vamp-host-audit --winrm 192.168.1.20 --user Administrador --password S3cr3t0 \
                --winrm-ssl --profile windows-quick

# Informe profesional con datos del engagement (portada cliente)
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "Antonio Hernández" \
    --auditor-company "VampSecure Studios" \
    --client "Empresa Auditada S.A." \
    --engagement "AUD-2026-001" \
    --report-html informe_cliente.html \
    --report-pdf  informe_cliente.pdf

# Checks específicos
vamp-host-audit --local --checks AUTH-001,AUTH-002,SERV-006

# Verbose: muestra también los checks que pasan
vamp-host-audit --local --verbose

---

Perfiles disponibles

Perfil	Plataforma	Framework	Checks	Descripción
linux-cis	Linux	CIS	42	CIS Linux Benchmark Level 1 (todos los checks Linux)
ens-basico	Linux+macOS+Win	ENS	37	ENS Categoría Básica — RD 311/2022 (solo checks que el ENS exige en Básica)
ens-medio	Linux+macOS+Win	ENS	91	ENS Categoría Media (solo checks exigibles en Media)
ens-alto	Linux+macOS+Win	ENS	272	ENS Categoría Alta (todos los checks con medida ENS)
nis2-art21	todas (79)	NIS2	79	NIS2 Art. 21(2) — dominios técnicos obligatorios
iso27001-a8	todas (79)	ISO 27001	79	ISO 27001:2022 Annex A.8 — controles técnicos
dora-art9	todas (79)	DORA	79	DORA Art. 9/10/13 — resiliencia TIC sector financiero
all	todas (79)	multi	79	Todos los checks de todos los marcos y plataformas
quick	Linux	multi	14	Quick scan Linux — controles críticos, < 30s
macos-cis	macOS	CIS	17	CIS macOS Benchmark v3.0 (Sonoma/Sequoia)
macos-quick	macOS	CIS	8	Quick scan macOS — controles críticos
windows-cis	Windows	CIS	20	CIS Windows Server Benchmark v2.0
windows-quick	Windows	CIS	8	Quick scan Windows — controles críticos

Multi-perfil

--profile acepta uno o varios nombres: los checks se deduplicarán automáticamente.

# Cumplimiento NIS2 + ISO 27001 en una sola pasada
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Toda la normativa financiera + CIS completo Linux
vamp-host-audit --local --profile dora-art9 linux-cis

Perfiles YAML personalizados

# mi-perfil.yaml
title: "Perfil personalizado"
framework: "custom"
checks:
  - AUTH-001
  - AUTH-002
  - SERV-006
  - NET-001

vamp-host-audit --local --profile-file mi-perfil.yaml

---

Sample Output

  vamp-host-audit v1.17 · Linux · profile: nis2-art21,cis-l1
  ─────────────────────────────────────────────────────────────────
  [PASS] AUTH-001 SSH root login disabled
  [PASS] AUTH-003 PAM password complexity: minlen=14, ucredit, dcredit
  [FAIL] AUTH-005 SSH protocol version: SSHv1 still enabled            ← HIGH
  [FAIL] KERN-002 kernel.randomize_va_space = 0 (ASLR disabled)        ← CRITICAL
  [WARN] FILE-007 /etc/crontab world-readable
  [PASS] SERV-001 Telnet disabled
  [FAIL] NET-004  IPv6 enabled without firewall rules                   ← MEDIUM
  [PASS] DOCK-003 Docker daemon socket not world-accessible
  [SKIP] WIN-001  Windows-only check (running Linux)

  ┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
  │ Normativa   │ Aplican │ Pass │ Fail+Warn │ Skip │ Cumplimiento │
  ├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
  │ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
  │ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
  └─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

  272 checks · 3 CRITICAL · 5 HIGH · 4 MEDIUM · 6 WARN

Tabla de cumplimiento (consola)

Al usar --profile nis2-art21, iso27001-a8, dora-art9 o all, el tool muestra automáticamente la tabla de cumplimiento por normativa al final de la ejecución:

┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
│ Normativa   │ Aplican │ Pass │ Fail+Warn │ Skip │ Cumplimiento │
├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
│ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ISO 27001   │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ DORA        │ 46      │ 36   │ 7         │ 3    │ 83.7%        │
│ CIS         │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
└─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

---

Informes del engagement

HTML técnico dark-theme (--html)

Genera un informe autocontenido con:

• Cabecera con logo VampSecure Studios y metadatos del engagement
• Tabla de todos los checks con columna Normativa (refs NIS2/ISO/DORA por check)
• Tabla de cumplimiento por marco al final
• Sin dependencias externas — un único fichero .html

Informe profesional unificado VSL (--report-html / --report-pdf)

Genera un informe en el formato unificado VampSecure Labs compartido por todas las herramientas del toolkit (vampsec_report.py). Incluye solo los hallazgos FAIL/WARN con:

• Portada con datos del engagement (auditor, empresa, cliente, referencia)
• Tabla resumen de hallazgos por severidad
• Fichas detalladas con evidencia, corrección y referencias normativas
• Formato HTML light profesional o PDF ejecutivo

# Solo informe técnico dark-theme
vamp-host-audit --local --profile all --html tecnico.html

# Solo informe cliente unificado
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "A. Hernández" --auditor-company "VampSecure Studios" \
    --client "ACME Corp" --engagement "AUD-2026-042" \
    --report-html cliente.html --report-pdf cliente.pdf

# Los tres a la vez
vamp-host-audit --local --profile all \
    --json raw.json --html tecnico.html \
    --auditor-name "A. Hernández" --client "ACME Corp" \
    --report-html cliente.html

---

Checks disponibles — macOS (v1.1)

macOS — CIS macOS Benchmark

ID	Control	Severidad	CIS macOS
MACOS-001	SIP (System Integrity Protection) activo	CRÍTICO	5.1.2
MACOS-002	FileVault 2 activo en el volumen del sistema	ALTO	2.5.1
MACOS-003	Gatekeeper activo	ALTO	5.1.1
MACOS-004	Firewall macOS activo	ALTO	2.2.1
MACOS-005	Actualizaciones automáticas activadas	MEDIO	1.1
MACOS-006	Acceso remoto SSH restringido o desactivado	MEDIO	2.3.3.5
MACOS-007	Bloqueo automático de pantalla (≤ 5 min)	MEDIO	2.5.2
MACOS-008	Screen Sharing desactivado	ALTO	2.3.2.1
MACOS-009	Remote Management (ARD) desactivado	ALTO	2.3.2.2
MACOS-010	Cuenta de invitado desactivada	ALTO	5.6
MACOS-011	Bluetooth desactivado si no se necesita	BAJO	2.1.1
MACOS-012	AirDrop restringido a Contactos o desactivado	MEDIO	2.3.3.2
MACOS-013	XProtect / MRT activo y actualizado	MEDIO	5.1.3
MACOS-014	Login window sin lista de usuarios	BAJO	5.9
MACOS-015	SSH: PermitRootLogin desactivado (macOS)	CRÍTICO	5.2.10
MACOS-016	sudo timestamp_timeout ≤ 5 min	MEDIO	5.4
MACOS-017	Secure Boot activo (T2 / Apple Silicon)	CRÍTICO	—

---

Checks disponibles — Windows (v1.2)

Windows — CIS Windows Server Benchmark

ID	Control	Severidad	CIS Ref
WIN-001	Account Lockout: umbral ≤ 10 intentos fallidos	ALTO	1.2.2
WIN-002	Password Policy: min 14 chars, historia ≥ 24	ALTO	1.1.x
WIN-003	Cuenta de invitado desactivada	ALTO	2.3.1.2
WIN-004	Administrador SID-500 desactivado o renombrado	MEDIO	2.3.1.1
WIN-005	UAC activo (EnableLUA=1, prompt admin)	ALTO	2.3.17.x
WIN-006	BitLocker activo en volumen del sistema	ALTO	18.9.44
WIN-007	NTLM v1 desactivado (LMCompatibilityLevel ≥ 3)	CRÍTICO	2.3.11.1
WIN-008	WDigest desactivado (UseLogonCredential=0)	CRÍTICO	2.3.11.9
WIN-009	Windows Firewall activo en todos los perfiles	ALTO	9.1.1/9.2.1/9.3.1
WIN-010	SMBv1 desactivado	CRÍTICO	18.3.3
WIN-011	RDP con NLA obligatoria (UserAuthentication=1)	ALTO	18.10.56.3.9
WIN-012	Remote Registry service desactivado	MEDIO	2.2.40
WIN-013	Política de auditoría configurada	MEDIO	17.x
WIN-014	Windows Defender activo y actualizado	ALTO	18.9.47
WIN-015	Actualizaciones automáticas activas	ALTO	18.9.108.2
WIN-016	PowerShell Script Block Logging activo	MEDIO	18.10.41.1
WIN-017	LSA RunAsPPL activo (protección de credenciales)	ALTO	2.3.11.8
WIN-018	Credential Guard activo (Windows 10/Server 2016+)	ALTO	18.9.29
WIN-019	AutoRun / AutoPlay desactivado	MEDIO	18.9.8.1
WIN-020	Sin actualizaciones de seguridad pendientes	ALTO	—

---

Checks disponibles — Linux (v1.0)

AUTH — Autenticación y control de acceso

ID	Control	Severidad	CIS	ENS	NIS2	ISO 27001
AUTH-001	SSH PermitRootLogin no	CRÍTICO	5.2.10	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-002	SSH PasswordAuthentication no	ALTO	5.2.14	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-003	SSH MaxAuthTries ≤ 4	MEDIO	5.2.7	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-004	SSH PermitEmptyPasswords no	CRÍTICO	5.2.11	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-005	SSH X11Forwarding no	BAJO	5.2.6	—	—	A.8.9
AUTH-006	SSH LogLevel INFO/VERBOSE	MEDIO	5.2.5	op.exp.8	Art.21(2)(a)	A.8.15
AUTH-007	sudo sin NOPASSWD global	ALTO	5.3.5	op.acc.4	Art.21(2)(i)	A.8.5
AUTH-008	PAM política de contraseñas	MEDIO	5.4.1	op.acc.6	Art.21(2)(i)	A.8.5
AUTH-009	Cuenta root bloqueada	ALTO	5.4.3	op.acc.4	Art.21(2)(i)	A.8.5
AUTH-010	Sin UIDs 0 adicionales	CRÍTICO	5.4.3	op.acc.4	Art.21(2)(i)	A.8.5

KERN — Parámetros del kernel (sysctl)

ID	Control	Severidad	CIS	NIS2	ISO 27001
KERN-001	ASLR activo (randomize_va_space=2)	ALTO	1.6.2	Art.21(2)(e)	A.8.8
KERN-002	Core dumps desactivados (suid_dumpable=0)	MEDIO	1.6.1	Art.21(2)(e)	A.8.3
KERN-003	dmesg restringido (dmesg_restrict=1)	BAJO	1.6.3	Art.21(2)(e)	A.8.3
KERN-004	IP forwarding desactivado	MEDIO	3.1.1	Art.21(2)(e)	A.8.20
KERN-005	ICMP redirects desactivados	MEDIO	3.2.2	Art.21(2)(e)	A.8.20
KERN-006	Send redirects desactivados	MEDIO	3.1.2	Art.21(2)(e)	A.8.20
KERN-007	SYN cookies activos	MEDIO	3.2.8	Art.21(2)(e)	A.8.20
KERN-008	IPv6 RA desactivados	BAJO	3.1.3	Art.21(2)(e)	A.8.20

FILE — Permisos y ficheros críticos

ID	Control	Severidad	CIS	NIS2	ISO 27001
FILE-001	/etc/passwd permisos 644	ALTO	6.1.2	Art.21(2)(e)	A.8.3
FILE-002	/etc/shadow permisos 640	CRÍTICO	6.1.3	Art.21(2)(e)	A.8.3
FILE-003	/etc/group permisos 644	MEDIO	6.1.4	Art.21(2)(e)	A.8.3
FILE-004	SUID/SGID inventario	MEDIO	6.1.11	Art.21(2)(e)	A.8.3
FILE-005	Sin world-writable en paths críticos	ALTO	6.1.9	Art.21(2)(e)	A.8.3
FILE-006	Sticky bit en dirs world-writable	MEDIO	6.1.10	Art.21(2)(e)	A.8.3
FILE-007	Sin ficheros sin propietario	BAJO	6.1.13	Art.21(2)(e)	A.8.3

SERV — Servicios del sistema

ID	Control	Severidad	CIS	NIS2	ISO 27001
SERV-001	auditd activo y habilitado	ALTO	4.1.1.1	Art.21(2)(a)	A.8.15
SERV-002	Logging centralizado (rsyslog/journald)	ALTO	4.2.1	Art.21(2)(a)	A.8.15
SERV-003	cron acceso restringido	BAJO	5.1.8	Art.21(2)(i)	A.8.9
SERV-004	Telnet/rsh/rlogin desactivados	CRÍTICO	2.2.18	Art.21(2)(e)	A.8.9
SERV-005	NTP/chrony activo	MEDIO	2.2.1.1	Art.21(2)(a)	A.8.16
SERV-006	Firewall del host activo	CRÍTICO	3.5.1	Art.21(2)(e)	A.8.20
SERV-007	AppArmor/SELinux MAC activo	MEDIO	1.7	Art.21(2)(e)	A.8.7

NET — Red

ID	Control	Severidad	NIS2	ISO 27001
NET-001	Firewall con política INPUT restrictiva	CRÍTICO	Art.21(2)(e)	A.8.20
NET-002	Inventario de puertos en escucha	INFO	Art.21(2)(a)	A.8.9
NET-003	Protocolos no usados desactivados (dccp/sctp/rds)	BAJO	Art.21(2)(e)	A.8.20
NET-004	SSH solo en interfaces necesarias	BAJO	Art.21(2)(i)	A.8.5
NET-005	Sin FTP/Telnet/rsync en puertos estándar	ALTO	Art.21(2)(e)	A.8.9

UPDT — Actualizaciones

ID	Control	Severidad	NIS2	ISO 27001
UPDT-001	Actualizaciones de seguridad pendientes	ALTO	Art.21(2)(e)	A.8.8
UPDT-002	Actualizaciones automáticas configuradas	MEDIO	Art.21(2)(e)	A.8.8
UPDT-003	Sistema actualizado < 90 días	MEDIO	Art.21(2)(e)	A.8.8

DOCK — Docker host

ID	Control	Severidad	NIS2	ISO 27001
DOCK-001	docker.sock sin acceso universal	CRÍTICO	Art.21(2)(i)	A.8.5
DOCK-002	Sin contenedores privilegiados en ejecución	CRÍTICO	Art.21(2)(e)	A.8.7

---

Opciones CLI completas

Destino (obligatorio, uno de los tres):
  --local                  Audita el host local (sin SSH ni WinRM)
  --host HOST              Hostname o IP del host remoto (SSH — Linux/macOS)
  --winrm HOST             Hostname o IP del host Windows (WinRM)

Conexión SSH (solo con --host):
  --user USER, -u USER     Usuario SSH (default: $USER)
  --port PORT, -p PORT     Puerto SSH (default: 22)
  --key KEY, -i KEY        Fichero de clave privada SSH
  --password PASS          Contraseña SSH (preferir siempre clave)
  --use-paramiko           Usa paramiko en lugar de subprocess SSH
  --sudo                   Usa sudo para comandos que lo requieren (--local)

Conexión WinRM (solo con --winrm):
  --winrm-port PORT        Puerto WinRM (default: 5985; HTTPS usa 5986)
  --winrm-ssl              Usa HTTPS en la conexión WinRM
  --winrm-transport TRANS  Transporte: ntlm (default), kerberos, basic, certificate
  --user USER, -u USER     Usuario Windows (dominio\usuario o .\usuario local)
  --password PASS          Contraseña Windows

Perfil:
  --profile NOMBRE [...]   Perfil(es) integrado(s) — acepta uno o varios; se deduplicarán
                           (default: linux-cis / windows-cis según destino)
                           Especial: 'all' ejecuta los 79 checks de todos los marcos
  --profile-file YAML      Fichero YAML de perfil personalizado
  --checks IDS             Lista de check IDs separados por coma

Salida:
  --json FICHERO           Guarda informe en JSON estructurado
  --html                   Genera informe HTML técnico dark-theme (todos los checks)
  --output FICHERO         Fichero HTML de salida (implica --html)
  --no-color               Sin colores en consola
  --verbose, -v            Muestra también checks PASS y SKIP

Engagement (portada del informe):
  --auditor-name NOMBRE    Nombre del auditor (aparece en portada)
  --auditor-company EMPRESA Empresa auditora (aparece en portada)
  --client EMPRESA         Empresa auditada / cliente (aparece en portada)
  --engagement REF         Referencia del engagement (p.ej. AUD-2026-001)
  --report-html FICHERO    Genera informe profesional HTML (formato unificado VSL)
  --report-pdf  FICHERO    Genera informe profesional PDF (requiere fpdf2)

General:
  --version                Muestra la versión

---

Códigos de salida

Código	Significado
0	Sin hallazgos CRÍTICOS ni ALTOS
1	Hallazgos de severidad ALTA (sin críticos)
2	Hallazgos de severidad CRÍTICA

Diseñados para CI/CD: un pipeline puede bloquear en código ≥ 1 o ≥ 2 según el umbral aceptable.

---

Formato de salida JSON

{
  "tool": "vamp-host-audit",
  "version": "1.16",
  "target": "servidor-prod",
  "platform": {"os": "linux", "distro": "ubuntu", "version": "22.04", "kernel": "5.15.0"},
  "profile": "NIS2 Art. 21(2) — Dominios técnicos",
  "timestamp": "2026-09-30T10:00:00Z",
  "duration_s": 14.2,
  "summary": {"critical": 1, "high": 3, "medium": 2, "pass": 61, "skip": 6, "total": 79},
  "findings": [
    {
      "check_id": "AUTH-001",
      "titulo": "SSH: PermitRootLogin desactivado",
      "categoria": "AUTH",
      "severidad": "critical",
      "estado": "fail",
      "evidencia": "PermitRootLogin = yes",
      "correccion": "Añade 'PermitRootLogin no' a /etc/ssh/sshd_config y reinicia sshd.",
      "marcos": ["CIS", "ENS", "NIS2", "ISO27001"],
      "refs": {
        "NIS2":     "Art.21(2)(i)",
        "ISO27001": "A.8.5",
        "CIS":      "5.2.10",
        "ENS":      "op.acc.6"
      },
      "cis_ref": "5.2.10",
      "ens_ctrl": "op.acc.6"
    }
  ]
}

---

Integración con el ecosistema VSL

vampsec_report.py

El módulo vampsec_report.py es el generador de informes unificado de VampSecure Labs, compartido por todas las herramientas del toolkit. Al usar --report-html o --report-pdf, vamp-host-audit convierte los hallazgos FAIL/WARN en objetos Finding y delega en VampSecReport la maquetación del informe profesional.

Si vampsec_report.py no está disponible (instalación mínima), --html sigue funcionando con el informe dark-theme autónomo.

vamp-orchestrator

Los informes JSON generados con --json son consumibles directamente por vamp-orchestrator para pipelines de auditoría multi-herramienta.

VampSuite Sec

Integrado en VampSuite Sec como módulo de auditoría de host via vamp-orchestrator.

---

Why vamp-host-audit vs. Lynis · CIS-CAT Pro · OpenSCAP

Característica	vamp-host-audit	Lynis	CIS-CAT Pro	OpenSCAP
Sin agente permanente	✅ SSH/WinRM/local	✅ local only	❌ agente o runner dedicado	⚠️ local o SSH manual
Windows Server (WinRM)	✅ nativo	❌	✅	⚠️ limitado
ENS RD 311/2022 + CCN-STIC 808	✅ 272 checks mapeados	❌	❌	❌
NIS2 Art. 21 / ISO 27001 / DORA	✅ multi-framework por check	❌	⚠️ solo CIS	⚠️ SCAP/XCCDF
Multi-perfil en una pasada	✅ --profile A B	❌	❌	❌
Informe profesional cliente (HTML+PDF)	✅ unificado VSL	❌ texto plano	✅ HTML	⚠️ HTML básico
Exit codes CI/CD 0/1/2	✅	❌	❌	❌
Dependencias externas	solo rich	ninguna	JRE + licencia	libxml2 + OVAL

• ENS exclusivo en el mercado: único auditor que implementa el Anexo II del RD 311/2022 completo — medidas principales, secundarias y refuerzos CCN-STIC 808 — por check, con test automatizado test_ens.py que garantiza la trazabilidad.
• Sin agente ni base de datos: Lynis solo audita en local; CIS-CAT Pro necesita un runner dedicado; vamp-host-audit audita cualquier host Linux/macOS/Windows desde tu máquina con una sola línea SSH o WinRM.
• Multi-framework real: el mismo check evidencia simultáneamente CIS, ENS, NIS2, ISO 27001 y DORA — sin ejecutar cuatro herramientas distintas ni reconciliar outputs manualmente.
• Informes de engagement: portada con datos del cliente, tabla de cumplimiento por normativa y fichas detalladas de hallazgos — listos para entregar a un auditor externo o a un CISO.

---

Check Coverage

Check ID	Description	Standard	Severity
AUTH-001	SSH PermitRootLogin disabled	CIS L1 §5.2.10 / ENS op.acc.6 / NIS2 Art.21(2)(i)	CRITICAL
AUTH-002	SSH PasswordAuthentication disabled	CIS L1 §5.2.14 / ENS op.acc.6	HIGH
AUTH-004	SSH PermitEmptyPasswords disabled	CIS L1 §5.2.11 / ENS op.acc.6	CRITICAL
AUTH-007	sudo without global NOPASSWD	CIS L1 §5.3.5 / ENS op.acc.4 / ISO 27001 A.8.5	HIGH
AUTH-010	No additional UID 0 accounts	CIS L1 §5.4.3 / ENS op.acc.4	CRITICAL
KERN-001	ASLR active (randomize_va_space=2)	CIS L1 §1.6.2 / NIS2 Art.21(2)(e)	HIGH
FILE-002	/etc/shadow permissions 640 or stricter	CIS L1 §6.1.3 / ENS mp.si.2	CRITICAL
FILE-005	No world-writable files in critical paths	CIS L1 §6.1.9 / ISO 27001 A.8.3	HIGH
SERV-001	auditd active and enabled	CIS L1 §4.1.1 / ENS op.exp.8 / NIS2 Art.21(2)(a)	HIGH
SERV-004	Telnet/rsh/rlogin disabled	CIS L1 §2.2.18 / ENS mp.com.1	CRITICAL
SERV-006	Host firewall active	CIS L1 §3.5.1 / ENS mp.com.2 / DORA Art.9	CRITICAL
NET-001	Firewall INPUT policy is DROP or REJECT	CIS L1 §3.6 / NIS2 Art.21(2)(e)	CRITICAL
WIN-007	NTLM v1 disabled (LMCompatibilityLevel >= 3)	CIS WS Benchmark v2.0 §2.3.11.1 / ENS	CRITICAL
WIN-010	SMBv1 disabled	CIS WS Benchmark v2.0 §18.3.3 / ENS mp.com.1	CRITICAL
MACOS-001	SIP (System Integrity Protection) active	CIS macOS Benchmark v3.0 §5.1.2	CRITICAL
UPDT-001	No pending security updates	CIS L1 / NIS2 Art.21(2)(e) / ISO 27001 A.8.8	HIGH

---

Historial de versiones

Versión	Cambios principales
v1.16	README bilingüe (EN/ES)
v1.15	ENS cotejado con CCN-STIC 808: medidas secundarias y refuerzos por check · perfiles ENS filtrados por exigencia de la categoría · +13 checks para medidas sin cobertura (SSH limitado/último acceso/inactividad, TMOUT, permisos de logs, copias, compiladores, Postfix, SmartScreen, Safari) → 272 checks
v1.14	Mapeo ENS alineado con el Anexo II del RD 311/2022 (144 checks reasignados; fuera las medidas del RD 3/2010) · sin SyntaxWarning en Python 3.12+ · versión real en --help
v1.5	+20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS completo en 99 checks
v1.4	Engagement params · Logo VS · Informe unificado VSL
v1.3	Marcos cruzados NIS2/ISO27001/DORA — todos los checks
v1.2	Windows Server 2019/2022 (WinRM + PowerShell)
v1.1	macOS (Sonoma/Sequoia, Apple Silicon + Intel)
v1.0	Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch)

---

Licencia

AGPL-3.0-only · © VampSecure Studios — VampSecure Labs Security Research Division

Para uso exclusivo en pruebas de penetración autorizadas. Úsalo solo contra sistemas en los que tengas autorización explícita por escrito.