Anzen v0.15.0

Added

• drift module: what changed since the last run. New accounts, UID 0
  accounts, SSH keys (root's are a FAIL), cron files, sudoers files, systemd
  units, SUID binaries (a FAIL in temp dirs), listening ports and
  /etc/ld.so.preload. The state lives in DRIFT_STATE_DIR (root, mode
  600); partial runs compare without updating it
• compromise module: indicators of compromise. /etc/ld.so.preload,
  processes running from /tmp, /var/tmp, /dev/shm or from memory,
  cryptominer processes and mining-pool connections, kernel modules without a
  file on disk; processes still running a binary an update replaced (INFO)
• Containers: added capabilities (SYS_ADMIN and similar are a FAIL), host
  PID/IPC namespaces, seccomp/AppArmor disabled, secrets in environment
  variables (names only, never values), and ports published past ufw or
  firewalld: Docker's iptables rules bypass them unless DOCKER-USER filters
• --offline: no network connections at all. Every connection anzen makes
  is now listed in docs/installation.md
• Signed releases: a Sigstore build provenance attestation for every
  release tarball (gh attestation verify)

Anzen v0.14.0

Added

• "Exploited CVEs — fix first": the KEV findings as an action list. A
  reboot hint when an installed kernel is newer than the running one and fixes
  its exploited CVEs; targets ranked by exploited CVEs (ransomware-linked
  first); CVEs that affect several targets, with how many have a fix

Fixed

• A --check run was saved to history. The next full run then reported
  every other FAIL as new (a burst of regression alerts) and the dashboard
  showed a partial host. Partial runs now skip history, notifications and the
  heartbeat, locally and in fleet mode, unless --history= is given

Anzen v0.13.0

Added

• Actively exploited CVEs (CISA KEV). The cve module downloads the CISA
  Known Exploited Vulnerabilities catalog (cached for a day, kept when a refresh
  fails) and matches it against every trivy result. A match is a FAIL at any
  severity, with or without a fix, named first with CISA's due date and
  whether ransomware uses it. Settings: KEV_CHECK, KEV_URL, KEV_CACHE_DIR
• New CVEs at a glance: CVEs published in the last CVE_NEW_DAYS (7) days
  are listed in one INFO line per host or image

Fixed

• Container images no longer report kernel packages (linux-libc-dev,
  linux-headers, …): containers run on the host kernel, so those CVEs do not
  apply there

Anzen v0.12.0

Added

• --debug: traces every command with file and line to
  reports/anzen_debug_<timestamp>.log (mode 600; /tmp when reports/ is
  not writable). Checks hide expected errors, which also hid real ones such as
  the Alpine find bug fixed in 0.11.5; the trace shows them
• Run time per module: the summary lists the slowest modules, and the JSON
  report has a durations object (seconds per module), so a slow run points
  at what to exclude

Fixed

• pentest_external: TLS 1.0/1.1 reported as accepted on every server.
  The check looked for CONNECTED, which openssl s_client prints as soon as
  TCP connects. It now requires a completed handshake, and offers TLS 1.0/1.1
  with SECLEVEL=0 so a modern OpenSSL can test them at all
• pentest_external: strong TLS 1.3 suites reported as weak ciphers.
  -cipher does not apply to TLS 1.3; the test now runs without it. OpenSSL 3
  cannot offer RC4/DES/3DES/EXPORT, so those are reported as not tested
  instead of passing
• pentest_external: TLS checks ignored the port in the target URL
  (https://host:8443 tested 443)
• pentest_external: certificate expiry used date -d, which BusyBox cannot
  parse, so every certificate was reported EXPIRED there; it now uses
  openssl x509 -checkend and the TLS_FAIL_DAYS/TLS_WARN_DAYS settings
• pentest_external: port probes without nmap had no timeout (a filtered port
  waited ~2 minutes); --wan did nothing when the target resolved to a public
  IP, and an HTML error page from the IP lookup could become the scan target
• pentest_external: HTTP TRACE was reported enabled when a 405 page named
  the method; DMARC sp= was read as the policy
• SSH: the cipher remedy broke remediate.sh. Its literal \n heredoc
  never ended, so every later command was appended to sshd_config. All
  remedies are now one line, and a test enforces it
• TUI: the run log cleanup trap outlived its function (tmp: unbound variable after the first audit); "View Reports" showed nothing unless
  formats had been selected in the same session
• Baseline diff output ignored --no-color

Anzen v0.11.5

Security

• remediate.sh command injection through file names. Remedies quoted
  file names with '…', so a local user could create a world-writable file
  named x'; cmd # and have cmd run as root when the admin ran the generated
  script. Every name taken from the system now goes through printf %q
• World-writable cron entries were joined into one remedy; in remediate.sh
  the second path ran as a command. Each entry is now its own finding

Fixed

• Alpine: world-writable and SUID/SGID scans always reported nothing.
  BusyBox find rejects -false, and the error was hidden. The distro matrix
  now plants a world-writable canary file and fails when a distro does not
  report it
• SSH: the AllowUsers remedy suggested AllowUsers root under sudo.
  Together with PermitRootLogin no that locks everyone out. The sudo rules,
  docker group and AllowUsers checks now look at the user who ran sudo
  (SUDO_USER); for a plain root run the remedy is a commented placeholder
• HISTORY_KEEP=0 deleted all history, including the run just saved; it now
  keeps every run
• --remote-pentest: arguments were not quoted for the remote shell (a URL
  with & broke the command) and the exit code was that of the cleanup step
• JSON reports stay valid when a message contains control characters (ANSI
  escapes from service banners); same fix in the macOS edition
• --no-color / NO_COLOR were ignored by the banner, report paths and fleet
  output; any non-empty NO_COLOR now disables colour, as the standard says,
  and so does output that is not a terminal (cron, | logger)

Changed

• File permission scan walks the filesystem once instead of twice
  (world-writable and SUID/SGID together). On a host with large app-data
  trees this halves the longest part of a run. Collected world-writable paths
  are capped at WW_FILE_CAP

Anzen v0.11.4

Fixed

• macOS: false FAIL for the emSign root in SystemRootCertificates.keychain.
  On macOS 26.6.2 a TLS connection through the compromised chain fails
  (nscurl: error -1202, certificate invalid), so Apple's block works, but
  security verify-cert still reports the root as trusted. That check is
  removed: a match in the System Roots keychain is now INFO. A listed
  certificate added to the System or login keychain is a FAIL, with the
  security delete-certificate -Z <SHA-1> command to remove it

Anzen v0.11.3

Fixed

• macOS trust stores: "No certificate stores found to check" was printed after
  scanning, because the certificate counter was updated in a subshell
• Shorter name for the AAA Certificate Services entry in the distrusted list;
  the explanation lives in docs/modules.md

Notes

• Confirmed on a real Mac (macOS 26.6.2): security verify-cert -p basic -l
  and Apple's own TLS stack (nscurl) agree, so the keychain check reflects
  whether Apple's block has reached the machine

Anzen v0.11.2

Fixed

• macOS tests were not hermetic on a real Mac: the trust-store check also read
  the machine's Homebrew bundles, Python certifi and Java. Tests now switch these
  off (ANZEN_HOMEBREW_BUNDLES, ANZEN_CHECK_RUNTIMES); the full run on a Mac
  in CI still checks them

Anzen v0.11.1

Fixes from the first run on a real Mac (macOS 26.6).

Fixed

• macOS trust stores: false FAIL for certificates Apple already blocks. Apple
  distrusts CAs through automatic certificate configuration data updates while
  the certificate stays in SystemRootCertificates.keychain. Keychain matches
  are now checked with macOS's own trust evaluation (security verify-cert):
  blocked is OK, still trusted is FAIL. AAA Certificate Services in a keychain
  is INFO (Apple blocks the cross-signed intermediates instead)
• macOS uptime showed ~20,000 days: kern.boottime was parsed from the
  usec field instead of sec
• macOS disk check no longer reports the sealed, read-only system volume /
  next to the Data volume that actually fills up

Added

• macOS: /etc/ssl/cert.pem and Homebrew CA bundles are checked. curl,
  git and openssl use them without Apple's block, which made this the real
  remaining exposure on up-to-date Macs. A listed root there is a FAIL, with
  Apple's interim remedy

Anzen v0.11.0

Added

• macOS edition — macos/anzen-macos.sh, runs with the Bash 3.2 that ships
  with macOS. 10 modules: system, updates, FileVault, SIP, Gatekeeper,
  application firewall and stealth mode, sharing services, accounts
  (auto-login, guest, admins), SSH and trust stores (keychains, certifi, Java;
  the shared distrusted-certificate list). Same finding IDs, scores, accept
  file, JSON and history layout as the other editions
• CI: macOS tests under a real Bash 3.2 with stub macOS commands, plus a
  macos-latest job that checks finding-ID parity with the Linux edition
  (BSD sed) on a 141-message corpus and does a full run as root