Versions in this module Expand all Collapse all v0 v0.2.3 Sep 8, 2026 Changes in this version + const BinNFT + const BinSS + const BinSSHD + const BinSystemctl + const BinSystemdRun + const DefaultConfirmWindowSec + const DropInPath + const FindingAssumedSSHPort + const FindingFallbackUnavailable + const FindingHardeningOnly + const FindingNoReality + const FindingOverriddenByGuard + const FindingPortInUse + const FindingSingleWayIn + const FirewallUnit + const KeyEvidenceAuthorizedKeys + const KeyEvidencePubkeyAuth + const KnockAllowedSet + const KnockHookPriority + const KnockNFTPath + const KnockPreviousSet + const KnockSequenceLen + const KnockTable + const KnockdConf + const KnockdPreviousSection + const KnockdSection + const LegacyBootUnit + const LegacyDropInPath + const MaxConfirmWindowSec + const MinConfirmWindowSec + const RevertUnit + const StateDir + const TimerArmedAfterAllLine + func ApplyScriptFromPlan(plan string) (string, error) + func Blocking(findings []Finding) bool + func KnockSequenceDigest(ports []int) string + func NewKnockSequence() ([]int, error) + func RenderArmPlan(p Profile, nodeName string) (string, error) + func RenderConfirmPlan(nodeID, nodeName string) (string, error) + func SanitizeDisplayText(value string) string + type Artifacts struct + ConfirmWindowSec int + Durable bool + GatedPorts []int + KeepLegacyPort bool + KnockNFT string + KnockdConf string + NodeID string + SSHDDropIn string + SSHPort int + Stage Stage + func ParseApprovalPlan(plan string) (Artifacts, error) + type Finding struct + Code string + Message string + Severity Severity + func LintProfile(p Profile, r NodeReality) []Finding + type Hardening struct + AllowAgentForwarding bool + KbdInteractiveAuth bool + LoginGraceTimeSec int + MaxAuthTries int + MaxStartups string + PasswordAuth bool + PermitRootLogin string + X11Forwarding bool + func DefaultHardening() Hardening + type KnockPolicy struct + OpenFor string + Ports []int + PreviousPorts []int + SeqTimeoutSec int + type KnockSequence struct + OpenFor string + Ports []int + PreviousPorts []int + SeqTimeoutSec int + func ParseKnockdConf(conf string) (KnockSequence, error) + func (k KnockSequence) KnockCommand(address string, sshPort int) string + type NodeReality struct + GuardAcceptedTCPPorts []int + GuardAcceptsAllTCP bool + GuardPolicyDrop bool + ListeningTCPPorts []int + ManagedByNetGuard bool + Reported bool + SSHPorts []int + TerminalAvailable bool + type Posture string + const PosturePartial + const PosturePasswordOpen + const PostureSecured + const PostureUnknown + type Profile struct + Address string + ConfirmWindowSec int + ExistingSSHPorts []int + GatePorts []int + Hardening Hardening + KeepLegacyPort bool + KeyAccessObserved bool + Knock *KnockPolicy + MgmtSources []string + Name string + NodeID string + OutOfBandFallback bool + SSHPort int + func (p Profile) Durable() bool + func (p Profile) GatedPorts() []int + func (p Profile) GatesFirewall() bool + func (p Profile) RenderKnockRuleset() (string, error) + func (p Profile) RenderKnockdConf() (string, error) + func (p Profile) RenderSSHDDropIn() (string, error) + func (p Profile) Validate() error + type SSHDFacts struct + AuthorizedKeys *int + PasswordAuthentication bool + PermitRootLogin string + PubkeyAuthentication bool + type SSHPosture struct + KeyAccess bool + KeyEvidence string + Reason string + State Posture + func DerivePosture(facts *SSHDFacts) SSHPosture + type Severity string + const SeverityBlock + const SeverityWarn + type Stage string + const StageArm + const StageConfirm
Go to main page