/op-harden

description: Assess and apply OS hardening measures — firewall, SSH, kernel params, services, MAC
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, Task
argument-hint: <target-host> [--scope kernel|ssh|firewall|services|mac|full] [--apply]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

OS Hardening Assessment

Target and options: `$ARGUMENTS`

1. Parse `$ARGUMENTS` for target host, `--scope` (default `full`), and `--apply` flag. Store parsed values for use throughout the command.

2. Load tools via `ToolSearch`: system administration, network configuration tools. Identify available Hexstrike MCP tools for remote system assessment.

3. For each scope category enabled by the `--scope` flag, run assessment checks via Hexstrike MCP tools. Collect all findings before generating the report.

4. Log each finding to the ops tracker:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> hardening-check <category> "<action>" <result> <severity>

5. **Kernel** (`--scope kernel` or `full`): Check sysctl parameters for secure defaults:

• `net.ipv4.ip_forward` — should be `0` unless routing is required
• `kernel.randomize_va_space` — should be `2` (full ASLR)
• `kernel.dmesg_restrict` — should be `1` (restrict dmesg to root)
• `kernel.kptr_restrict` — should be `2` (hide kernel pointers)
• `net.ipv4.conf.all.rp_filter` — should be `1` (reverse path filtering)
• `net.ipv4.icmp_echo_ignore_broadcasts` — should be `1` (prevent smurf attacks)

6. **SSH** (`--scope ssh` or `full`): Parse `sshd_config` and verify:

• `PermitRootLogin` — should be `no`
• `PasswordAuthentication` — should be `no` (key-only)
• `Port` — should be non-default (not 22)
• `MaxAuthTries` — should be `3` or fewer
• `AllowUsers` — should be explicitly set
• `PubkeyAuthentication` — should be `yes`

7. **Firewall** (`--scope firewall` or `full`): Check iptables/nftables configuration:

• Verify default INPUT/FORWARD policy is DROP
• List all ACCEPT rules and flag overly permissive ones
• Cross-reference open ports with running services
• Check for rate limiting on SSH and other exposed services

8. **Services** (`--scope services` or `full`): List all running services via `systemctl list-units --type=service --state=running`. Flag unnecessary or risky services (telnet, rpcbind, avahi-daemon, cups, nfs, rsh, rlogin).

9. **MAC** (`--scope mac` or `full`): Check if macchanger is installed and configured for interface randomization on boot. Verify NetworkManager dispatcher scripts or systemd unit for automatic MAC rotation.

10. If `--apply` flag is set: Generate remediation commands for each failed check. Present the full remediation plan to the user and execute only after explicit confirmation. Apply changes incrementally and verify each one.

11. Write the hardening report to the project directory. Include a summary table of all checks with PASS/FAIL/WARN status, severity ratings, and remediation commands for failed checks.

12. Update session metrics:

    node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric checks_passed
    node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric checks_failed