aartool 3.5.3

aartool 3.5.3

Reverts the filesystem-walk change from 3.5.2.

3.5.2 merged the three separate find / -xdev traversals behind FS-05, FS-07 and FS-10 into a single pass. It benchmarked about a third faster on the machine it was written on. In real use it was worse, so it is out.

Behaviour is identical to 3.5.1. The three checks each run their own traversal again, and the audit reports exactly what it did before.

If you installed 3.5.2, upgrade. Nothing it produced was wrong, but there is no reason to keep it.

Upgrading

sudo apt update && sudo apt install --only-upgrade aartool   # or: sudo dnf upgrade aartool

For anyone tempted to try the same optimisation

Two things cost real time and are worth knowing before you start.

-o short-circuits. In find / \( A -printf … \) -o \( B … \) -o \( C … \), a file matching A is never tested against C. A SUID file that is also unowned printed once and vanished from the unowned count: 90 reported where the truth was 92. Each group has to end in -o -true, and the groups must not be joined by -o.

A fixture with no input matching two predicates cannot catch that. The bug is in the operator joining the clauses, so the test needs a file that reaches more than one of them.

And measure on the machine that matters. One host with a warm cache is not evidence about anyone else's disk.

1378 assertions and 31 Molecule scenarios, all green.

aartool 3.5.2

aartool 3.5.2

One change: the audit walks your filesystem once instead of three times.

Why it was slow

Three checks each ran their own full traversal of the disk:

• FS-05 SUID binary count
• FS-07 world-writable directories with no sticky bit
• FS-10 files with no owner

Three passes over the same tree. On the machine this was measured on they were 7.1 seconds of a 32 second audit, and they are the only part of the run that scales with the size of your disk rather than with the number of checks. On a fileserver they are most of the runtime.

The two checks that appear next to them, FS-06 and FS-08, are a mount lookup and a stat. They were never slow; they simply print after the walk in front of them finishes, which makes the whole block look stuck.

What changed

The three conditions are collected in a single traversal.

A full audit on the same host, both runs warm: 31.8s before, 13.7s after. The saving grows with the filesystem, so a machine with more inodes than this one should see more.

Counts are unchanged, and that is asserted against the three original walks rather than assumed: a rewritten find expression is exactly the kind of change that can look right and quietly count differently.

Nothing else changed. No new checks, no output format changes, no flags added or removed.

Upgrading

sudo apt update && sudo apt install --only-upgrade aartool   # or: sudo dnf upgrade aartool

Reports from earlier versions still load in the dashboard, in aartool diff and in aartool report.

cyberaar-baseline.sh remains attached, byte-identical to aartool-baseline.sh, for install notes predating the 3.4.0 rename.

1386 assertions and 31 Molecule scenarios, all green.

aartool 3.5.1

aartool 3.5.1

A patch release for four things a reader found in 3.5.0's output, three of them visible on the first run.

The score banner is back

rule() built the horizontal lines around the score with tr ' ' '━', and tr translates bytes rather than characters. ━ is three bytes, so every space became a lone 0xe2 and the summary printed a run of invalid UTF-8 where the banner belongs. Introduced in 3.5.0 when the rules were made width-adaptive.

The band is back, and now spans the terminal rather than a fixed 61 columns, which is what adaptive was for.

The remediation plan told you to run a command that fails

It read "Ajoutez --check --diff pour simuler". Two problems: French in an English document, and --check / --diff are ansible-playbook flags, while every command in that table is aartool apply, which rejects them outright. It now points at aartool plan, same arguments, changes nothing.

The Tags column advertised --tags next to a command using --only. Both say --only.

Remaining French removed

A Commande aartool column header and a bilingual Tout corriger en une commande / Fix everything in one run label, left from when the report was meant to be both languages. The report is English throughout.

Colours that escaped the palette

3.5.0 moved the report onto the shared palette, but only the hex literals. The same colours written as rgba() stayed behind: rgba(0,194,168,…) is the old teal, rgba(126,211,72,…) the old lime. Sixteen of them, in borders, glows and table hovers, none of which followed the print theme. All tokens now.

Upgrading

sudo apt update && sudo apt install --only-upgrade aartool   # or: sudo dnf upgrade aartool

No format changes. Reports written by 3.4.x and 3.5.0 still load in the dashboard, in aartool diff and in aartool report.

cyberaar-baseline.sh is still attached, byte-identical to aartool-baseline.sh, for install notes predating the 3.4.0 rename.

1378 assertions and 31 Molecule scenarios, all green.

aartool 3.5.0

aartool 3.5.0

A design pass over everything the tool prints. Two of the fixes are worth upgrading for on their own.

The HTML report no longer reaches the network

Every report this tool wrote carried <link href="https://fonts.googleapis.com/...">. An audit report is a list of a machine's weaknesses, so opening one told a third party the IP and referrer of whoever read it, including reports scrubbed with --anonymise precisely so they could leave the estate. It also made "opens offline" untrue.

Webfonts are gone. A report now fetches nothing at all, and a test fails the build if that changes.

Printing produced a near-blank page

The report is a dark ground with near-white text, and its entire print stylesheet was four lines that reset no colours. Browsers do not print backgrounds by default, so the text landed on white paper. If you have ever printed an aartool report and wondered what happened, that was this.

There is now a real A4 stylesheet that switches to the light palette, keeps the status colours, and stops a finding splitting across pages.

One look

The report had its own palette, unrelated to the dashboard that loads it. Both now use the same tokens as cyberaar.io, and the report is English throughout: it declared lang="fr" and printed CRITIQUE / MOYEN as the score label while everything around it was English. Labels are now CRITICAL / WEAK / FAIR / GOOD / STRONG.

The terminal output fits your terminal

Section rules were drawn at a fixed 86 columns while rows ran to 156, because the detail column had no bound, so the rules ended 70 columns short of the content and every row wrapped at 80 columns. Width now comes from the terminal, and long values are truncated with an ellipsis; the full text is in the JSON, the HTML and aartool explain.

Colour is now emitted only when stdout is a terminal. Redirecting an audit to a file used to write raw ANSI escapes into it, and aartool diff ... || mail mailed them. NO_COLOR and FORCE_COLOR are both honoured.

JSON

Two additions, nothing removed:

• wave on every result: the reachability ordering aartool advise uses. Consumers had to reimplement it to reproduce the ordering; now they do not.
• date_iso, UTC and RFC 3339. The existing date has no timezone, so hosts in different zones produced timestamps that could not be ordered. date is unchanged.

Upgrading

sudo apt update && sudo apt install --only-upgrade aartool   # or: sudo dnf upgrade aartool

Reports written by earlier versions still load in the dashboard, in aartool diff and in aartool report.

cyberaar-baseline.sh is still attached, byte-identical to aartool-baseline.sh, for install notes written before the 3.4.0 rename. Move to the new name; it will be dropped in a later release.

1139 assertions and 31 Molecule scenarios on Rocky 9 and Ubuntu 22.04, all green.

aartool 3.4.0

aartool 3.4.0

The tool used to call itself four different things. A tester said the output was confusing; they were right, and it was broader than the one string they had spotted. This release makes every surface say aartool, and fixes a score that treated "could not be verified" as "wrong".

One name

The terminal said CyberAar Security Score, --help said CyberAar Security Baseline Checker, the HTML footer said CyberAar Baseline Checker while the body of the same page said plain Security Score, and only the dashboard said aartool. Meanwhile aartool --version reported 3.3.7 and the report it had just written reported 4.6.7.

CyberAar is the company. aartool is the product. Output names the product.

Renamed, with the old names still readable

• cyberaar-baseline.sh is now aartool-baseline.sh
• reports are written as aartool-<host>-<date>.{html,json}
• the JSON root key is aartool, was cyberaar_baseline

All three are backward compatible on the read side. Report discovery matches both filename patterns, and diff, advise, report and the dashboard accept either root key, so audits already on disk keep working.

cyberaar-baseline.sh is still attached to this release, byte-identical to aartool-baseline.sh, so existing install notes and bookmarks keep working. It will be dropped in a later release; move to the new name.

The score no longer counts "unverified" as "wrong"

It was PASS / TOTAL, so a warning cost exactly as much as a failure. A machine with 8 real failures and 57 warnings scored 40% in red. Many warnings mean "could not be checked here" rather than "this is wrong": no /boot, no mokutil, no systemd inside a container.

score = (PASS + WARN/2) / TOTAL

The same machine now scores 67%. Failures lead the summary line and the weighting is printed under the score. Scores are not comparable across this change, so aartool diff now says so when the two reports it is given came from different engine versions.

Fixed

• Kernel checks printed above the first section header with no header of their own. checks/kernel.sh was the only check family with no wrapping function, so its twelve KRN-* results ran at load time, before anything else. Twelve unlabelled rows were the first thing every user saw. They now appear as "1b. KERNEL ATTACK SURFACE".
• Reports were unreadable by the person who ran them. The standalone script must run as root, so it wrote root:root mode 600 and left you unable to open the file it had just printed a path to. It now hands reports back to SUDO_UID, as aartool inspect already did.
• --help printed a version from the build machine. The banner interpolated a command inside an unquoted heredoc and advertised whatever aartool was installed where the release was built. Guarded now, in both directions.
• The HTML report subtitle repeated its own heading verbatim.
• INT-07 restated INT-01 verbatim when AIDE is absent, so one missing package read as two problems.

Verifying the download

Release assets do not carry the executable bit.

curl -fsSLO https://github.com/cyberaar/aartool/releases/latest/download/aartool-baseline.sh
curl -fsSLO https://github.com/cyberaar/aartool/releases/latest/download/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
chmod +x aartool-baseline.sh && sudo ./aartool-baseline.sh

914 assertions and 31 Molecule scenarios on Rocky 9 and Ubuntu 22.04, all green.

v3.3.7

aartool report with no arguments wrote an empty dashboard.

advise with no argument reads the most recent report. report did the opposite, so the obvious command after an audit produced a 190K file with nothing in it:

$ sudo aartool inspect
$ aartool report --out audit.html
[OK]  Written: audit.html (empty dashboard, drag reports onto it)

Two commands, the same absent argument, opposite meanings, and the only warning was a parenthetical in the success line.

Now:

[INFO] Using the most recent report found: ./reports/cyberaar-...json
[OK]   Written: audit.html
[INFO] 1 report(s) embedded. Self-contained: no server, no internet, no other files.

It searches the same three locations advise does, and says which report it picked. --empty still gives the dashboard with nothing in it, because dragging reports onto it is a real workflow, just not the one you get by typing nothing.

Found while recording the demo now embedded at cyberaar.io/en/open-source.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool

v3.3.6

aartool plan now runs to completion on a fresh host.

localhost : ok=128  changed=74  unreachable=0  failed=0  skipped=339
TASK [CyberAar | Hardening complete notification]

Everything since 3.3.3 has been working toward this. Before it, the preview stopped at whichever blocker came first.

What was stopping it

AIDE initialisation used async, which Ansible refuses under --check: "check mode and async cannot be used on same task". It is a validation error, raised before the task would have been skipped for being a command, so the run died rather than previewing. It is the only async task in the codebase.

The GRUB bootloader role failed the whole run when LINUX_BOOTLOADER_PASSWORD was unset, three lines after run-hardening.sh printed "bootloader_password role will be skipped". The wrapper's promise and the role's behaviour contradicted each other and the role won, so a first preview on an ordinary server died on a variable the user had just been told was optional. Only WSL escaped it, because the role skips itself there for unrelated reasons.

Behaviour change: asking for a GRUB password without providing one no longer aborts the run. Both bootloader roles now skip with an explanation.

The arc

release	what a preview hit
3.3.4	ufw not installed
3.3.5	40 service tasks whose unit did not exist
3.3.6	async, then a role failing on an optional variable

Every one reported by someone running the tool, none found by reading it. Thank you to everyone who ran plan on a machine that was not ready for it: that is exactly the machine the first run happens on.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool

v3.3.5

40 of the 48 service tasks in the roles could not survive a preview.

aartool plan runs the hardening playbook with --check, which installs nothing. A role that installs a package and then starts its service therefore met a unit that was not there:

TASK [linux_ssh_hardening_ubuntu : Enable and start ssh service]
fatal: [localhost]: FAILED! => "Could not find the requested service ssh"

That task was already guarded, on _skip_service_mgmt, which covers WSL without systemd. Modern WSL has systemd, so the guard passed and the unit was still absent. A when: on a service task does not mean it is guarded against the unit not existing, which is why fixing the same shape on ufw in 3.3.4 did not prevent this one.

The playbook now inventories the systemd units once, in a pre_task with check_mode: false, and every service task with a literal name is guarded on it in check mode only. Behaviour outside a preview is unchanged.

Of the 48 service tasks, the 8 left alone were already safe: six name no service (daemon-reload cannot fail this way), two use templated names guarded on ansible_facts.services, and one tolerates failure.

test_service_guards.sh enforces this for every future service task and runs in CI, so the class cannot come back one role at a time.

Thanks

Reported by a user running aartool plan on WSL, as was the 3.3.4 firewall bug. WSL is not the target platform, and that is exactly why those reports were valuable: a real server already has ufw, ssh and systemd present, so the whole class was invisible there.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool

v3.3.4

aartool plan failed on any host without a firewall package installed, which is the host that most needs the firewall role.

TASK [linux_firewall_ubuntu : Set UFW default incoming policy to deny]
fatal: [localhost]: FAILED! => {"msg": "Failed to find required executable \"ufw\""}

A preview installs nothing. So the package task reported "would install" and changed nothing, the binary verification was skipped because command modules do not run under --check, and the ufw module then ran against a binary that was not there.

Both firewall roles now probe with check_mode: false and gate their configuration on the result, so a preview reports what apply would do:

TASK [linux_firewall_ubuntu : Preview: ufw is not installed yet]
  "ufw is not installed. A preview installs nothing, so the rules below cannot be
   evaluated. 'aartool apply' installs ufw first, then applies them."

The reload handler needed the same guard, since handlers run at the end of the play, after every gated task has correctly skipped.

Also fixed

Five firewalld tasks already carried a when: before the module key, so the new guard was appended as a duplicate. In YAML the later key wins, so conditions including _firewalld_active | bool would have been discarded and services removed regardless of them. Found by ansible-lint while fixing the reported bug.

Reported by a user running aartool plan --target localhost on a fresh machine. Thank you.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool

v3.3.3

An inspect you can read, in one language.

The output is a table, and the score is at the end

109 checks used to print as 327 lines with the score in the middle of them. Each result is now one aligned row under a column header per section, and the default run is 145 lines.

── 1. SYSTEM & OS ──────────────────────────────────────────────────
  STATUS ID        CHECK                                      DETAIL
  PASS   SYS-01    Distribution supported                     Debian GNU/Linux 12 (bookworm)
  WARN   SYS-02    Kernel version                             6.18.33.2-microsoft-standard-WSL2
  FAIL   SYS-04    No MAC framework                           SELinux/AppArmor absent

The check ID is printed. aartool explain SYS-04 needs it, and until now the only place it appeared was the JSON report.

The 117-line remediation block is gone. aartool advise does that job ordered by what an attacker reaches first, with the cost of each fix, and inspect points at it. Per-check fixes move behind --hints.

The tool speaks English only

All 119 remediation hints were French while every check name was English, so a single run mixed the two. The bilingual halves of the section titles went with them, along with the per-check French line in the HTML report and its French labels. Every embedded command, path and variable was preserved verbatim.

A real audit run now contains zero accented characters, and French text in a renderer fails the test suite.

Upgrade

sudo apt update && sudo apt upgrade aartool
sudo dnf upgrade aartool