Whats new in v1.5

secfetch improve command: shows all failed checks with fix suggestions
secfetch improve --auto command: interactive auto-fix selection with toggle UI
Risky fix warnings (e.g. modules_disabled flagged as irreversible)
Manual-only fix section in auto-fix view
Persistent sysctl fixes: Auto-fixes now write to /etc/sysctl.d/99-secfetch.conf for reboot persistence
Service auto-fix: Suspicious services (telnetd, rshd, ftpd, etc.) can be auto-disabled
Firewall availability check: Only offers firewall fix if ufw/firewalld/iptables is installed

Services check: replaced whitelist approach with blacklist of suspicious/unnecessary services
Services now flags known-risky services (e.g. telnetd, rshd) and unnecessary ones (e.g. cups, bluetooth)
Reduced false positives for services check significantly
Firewall check: improved detection for ufw, firewalld, nftables, and iptables
Firewall help text: now includes installation instructions for ufw
improve output: shows install instructions when firewall tool is not available

improve.py: AUTO_FIXES key mismatch - keys now use underscores instead of spaces
improve.py: Fixed fixable_count calculation (was not normalizing keys)
improve.py: Fixed risky fix warning for modules_disabled
improve.py: Removed unused imports (shlex, sys)
help.py: Added missing CHECK_DESCRIPTIONS entries for firewall_rules, tcp_syn_cookies, reverse_path_filter
Services check no longer flags nearly all running services as unexpected
Services help description updated to match blacklist logic
secfetch improve and secfetch improve --auto added to help output
--auto flag was passing auto=False to apply_fixes; removed unused parameter
ipv6.py: Added @handle_check_errors decorator for consistent error handling
tcp_syncookies.py: Added @handle_check_errors decorator
rp_filter.py: Added @handle_check_errors decorator
lockdown.py: Added @handle_check_errors decorator

Navigation Menu