Metadata-Version: 2.4
Name: vamp-host-audit
Version: 1.17
Summary: Auditor live multiplataforma de hosts: Linux · macOS · Windows — CIS · ENS · NIS2 · ISO 27001 · DORA
Author-email: VampSecure Studios <contact@vampsecurestudios.com>
License: AGPL-3.0-only
Project-URL: Homepage, https://vampsecurestudios.com
Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-host-audit
Keywords: security,pentest,audit,cybersecurity,vampsecure,cis-benchmark,ens,nis2,iso27001,dora,host-audit,hardening,compliance,ssh
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: GNU Affero General Public License v3
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: rich>=13.7.0
Provides-Extra: yaml
Requires-Dist: PyYAML>=6.0; extra == "yaml"
Provides-Extra: ssh
Requires-Dist: paramiko>=3.0; extra == "ssh"

# vamp-host-audit

  <img src="https://github.com/Vampsecure-Labs/vamp-host-audit/actions/workflows/ci.yml/badge.svg" alt="CI"/>

> **Live multi-platform host auditor — no permanent agent**
> VampSecure Labs · VampSecure Studios

> 🇬🇧 [English](#english) · 🇪🇸 [Español](#español)

---

<a name="english"></a>
## 🇬🇧 English

Live multi-platform host auditor — no permanent agent required.

Audits the real (runtime) state of a Linux, macOS, or Windows host via SSH, WinRM, or locally. No agent installed on the target. A single Python file with no external dependencies beyond `rich`.

Unlike static repository scanners (vamp-compliance-check), this tool interrogates the running operating system: active sysctl parameters, real file permissions, running services, applied firewall rules.

---

### Features v1.16

- **272 total checks**: 184 Linux · 37 macOS · 51 Windows
- **Agentless SSH** via subprocess (OpenSSH) — `paramiko` as optional dep
- **WinRM** via `pywinrm` (optional dep) — NTLM · Kerberos · Basic · Certificate
- **Local execution** with optional `sudo` support
- **Automatic detection** of distro/version for Linux and macOS; Windows detected via WinRM
- **Multi-framework mapping** per check: CIS · ENS RD 311/2022 · NIS2 Art. 21(2) · ISO 27001:2022 · DORA
- **Compliance table** in console: Applicable / Pass / Fail+Warn / Skip / % per framework
- **12 built-in profiles** + custom YAML profile support + multi-profile (`--profile A B`)
- **ENS RD 311/2022 full traceability** — each check carries its primary measure (`ens_ctrl`, one of the 73 in Annex II), secondary measures (`ens_extra`), and reinforcements evidenced (`ens_refuerzos`, e.g. `op.acc.6.r9`), cross-referenced with **CCN-STIC 808 (Apr-2026)**. ENS profiles include only checks the ENS requires for that category. All guaranteed by `tests/test_ens.py`; criteria in [docs/ens-rd311-2022.md](docs/ens-rd311-2022.md)
- **Profile `all`** — audits all 272 checks regardless of platform and framework
- **Triple reporter**: color rich console · structured JSON · standalone dark-theme HTML
- **Unified VSL professional report** (`--report-html` / `--report-pdf`) via `vampsec_report.py`
- **Engagement parameters** (`--auditor-name`, `--auditor-company`, `--client`, `--engagement`) on cover page
- **VampSecure Studios logo** in HTML reports
- **Normative column** in technical HTML with NIS2 / ISO 27001 / DORA references per check
- **Standard exit codes** for CI/CD: 2=CRITICAL · 1=HIGH · 0=clean
- No daemon, no database, no persistent state

### Platforms

| Version | Platform | Status |
|---------|----------|--------|
| v1.0 | Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch) | ✅ Available |
| v1.1 | macOS (Sonoma/Sequoia, Apple Silicon + Intel) | ✅ Available |
| v1.2 | Windows Server 2019/2022 (WinRM + PowerShell) | ✅ Available |
| v1.3 | Cross-framework NIS2/ISO27001/DORA — all checks | ✅ Available |
| v1.4 | Engagement params · VS Logo · Unified VSL report | ✅ Available |
| v1.5 | +20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS complete in 99 checks | ✅ Available |
| v1.14 | ENS mapping aligned with Annex II of RD 311/2022 (144 checks reassigned; removed RD 3/2010 measures) · no `SyntaxWarning` in Python 3.12+ · real version in `--help` | ✅ Available |
| v1.15 | ENS cross-referenced with CCN-STIC 808: secondary measures and reinforcements per check · ENS profiles filtered by category requirement · +13 checks for measures without coverage (SSH limited/last access/inactivity, TMOUT, log permissions, backups, compilers, Postfix, SmartScreen, Safari) → 272 checks | ✅ Available |
| v1.16 | Bilingual README (EN/ES) | ✅ Available |

---

### Installation

```bash
pip install vamp-host-audit
```

With optional dependencies:

```bash
pip install "vamp-host-audit[yaml]"           # external YAML profiles (PyYAML)
pip install "vamp-host-audit[ssh]"            # paramiko for advanced SSH
pip install "vamp-host-audit[winrm]"          # pywinrm for Windows hosts
pip install "vamp-host-audit[report]"         # fpdf2 for --report-pdf
pip install "vamp-host-audit[yaml,ssh,winrm,report]"
```

From the repo (development):

```bash
git clone http://localhost:3030/vampsecure/vamp-host-audit.git
cd vamp-host-audit
pip install -e ".[yaml,ssh,report]"
```

---

### Quick Start

```bash
# Audit this host locally
vamp-host-audit --local

# Audit a remote host via SSH
vamp-host-audit --host 192.168.1.10 --user ubuntu

# With specific key and ENS Medium profile
vamp-host-audit --host vps --user ubuntu --key ~/.ssh/id_ed25519 --profile ens-medio

# Generate JSON + dark-theme technical HTML report
vamp-host-audit --local --profile linux-cis --json report.json --html

# Critical checks only (quick scan, < 30s)
vamp-host-audit --host server --user root --profile quick

# Audit with ALL frameworks (NIS2 + ISO27001 + DORA + CIS) at once
vamp-host-audit --local --profile all

# Two profiles at once (deduplicated union)
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Audit a Windows Server via WinRM (NTLM, port 5985)
vamp-host-audit --winrm 192.168.1.20 --user Administrator --password S3cr3t0

# Windows Server with HTTPS (WinRM 5986) and quick profile
vamp-host-audit --winrm 192.168.1.20 --user Administrator --password S3cr3t0 \
                --winrm-ssl --profile windows-quick

# Professional report with engagement data (client cover page)
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "Antonio Hernández" \
    --auditor-company "VampSecure Studios" \
    --client "Audited Company Ltd." \
    --engagement "AUD-2026-001" \
    --report-html client_report.html \
    --report-pdf  client_report.pdf

# Specific checks
vamp-host-audit --local --checks AUTH-001,AUTH-002,SERV-006

# Verbose: show passing checks too
vamp-host-audit --local --verbose
```

---

### Available Profiles

| Profile | Platform | Framework | Checks | Description |
|---------|----------|-----------|--------|-------------|
| `linux-cis` | Linux | CIS | 42 | CIS Linux Benchmark Level 1 (all Linux checks) |
| `ens-basico` | Linux+macOS+Win | ENS | 37 | ENS Basic Category — RD 311/2022 (only checks required by ENS in Basic) |
| `ens-medio` | Linux+macOS+Win | ENS | 91 | ENS Medium Category (only checks required in Medium) |
| `ens-alto` | Linux+macOS+Win | ENS | 272 | ENS High Category (all checks with an ENS measure) |
| `nis2-art21` | **all (79)** | NIS2 | 79 | NIS2 Art. 21(2) — mandatory technical domains |
| `iso27001-a8` | **all (79)** | ISO 27001 | 79 | ISO 27001:2022 Annex A.8 — technical controls |
| `dora-art9` | **all (79)** | DORA | 79 | DORA Art. 9/10/13 — ICT resilience for financial sector |
| `all` | **all (79)** | multi | 79 | All checks from all frameworks and platforms |
| `quick` | Linux | multi | 14 | Quick scan Linux — critical controls, < 30s |
| `macos-cis` | macOS | CIS | 17 | CIS macOS Benchmark v3.0 (Sonoma/Sequoia) |
| `macos-quick` | macOS | CIS | 8 | Quick scan macOS — critical controls |
| `windows-cis` | Windows | CIS | 20 | CIS Windows Server Benchmark v2.0 |
| `windows-quick` | Windows | CIS | 8 | Quick scan Windows — critical controls |

### Multi-profile

`--profile` accepts one or multiple names: checks are automatically deduplicated.

```bash
# NIS2 + ISO 27001 compliance in a single pass
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Full financial regulation + complete CIS Linux
vamp-host-audit --local --profile dora-art9 linux-cis
```

### Custom YAML Profiles

```yaml
# my-profile.yaml
title: "Custom profile"
framework: "custom"
checks:
  - AUTH-001
  - AUTH-002
  - SERV-006
  - NET-001
```

```bash
vamp-host-audit --local --profile-file my-profile.yaml
```

---

### Sample Output

```
  vamp-host-audit v1.17 · Linux · profile: nis2-art21,cis-l1
  ─────────────────────────────────────────────────────────────────
  [PASS] AUTH-001 SSH root login disabled
  [PASS] AUTH-003 PAM password complexity: minlen=14, ucredit, dcredit
  [FAIL] AUTH-005 SSH protocol version: SSHv1 still enabled            ← HIGH
  [FAIL] KERN-002 kernel.randomize_va_space = 0 (ASLR disabled)        ← CRITICAL
  [WARN] FILE-007 /etc/crontab world-readable
  [PASS] SERV-001 Telnet disabled
  [FAIL] NET-004  IPv6 enabled without firewall rules                   ← MEDIUM
  [PASS] DOCK-003 Docker daemon socket not world-accessible
  [SKIP] WIN-001  Windows-only check (running Linux)

  ┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
  │ Framework   │ Applic. │ Pass │ Fail+Warn │ Skip │ Compliance   │
  ├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
  │ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
  │ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
  └─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

  272 checks · 3 CRITICAL · 5 HIGH · 4 MEDIUM · 6 WARN
```

### Compliance Table (console)

When using `--profile nis2-art21`, `iso27001-a8`, `dora-art9` or `all`, the tool automatically shows the compliance table by framework at the end:

```
┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
│ Framework   │ Applic. │ Pass │ Fail+Warn │ Skip │ Compliance   │
├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
│ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ISO 27001   │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ DORA        │ 46      │ 36   │ 7         │ 3    │ 83.7%        │
│ CIS         │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
└─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘
```

---

### Engagement Reports

#### Technical dark-theme HTML (`--html`)

Generates a self-contained report with:
- Header with VampSecure Studios logo and engagement metadata
- Table of all checks with **Normative** column (NIS2/ISO/DORA refs per check)
- Compliance table by framework at the end
- No external dependencies — a single `.html` file

#### Unified VSL professional report (`--report-html` / `--report-pdf`)

Generates a report in the **VampSecure Labs unified format** shared by all toolkit tools (`vampsec_report.py`). Includes only FAIL/WARN findings with:
- Cover page with engagement data (auditor, company, client, reference)
- Summary table of findings by severity
- Detailed cards with evidence, remediation, and normative references
- Professional light HTML or executive PDF format

```bash
# Technical dark-theme report only
vamp-host-audit --local --profile all --html technical.html

# Client unified report only
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "A. Hernández" --auditor-company "VampSecure Studios" \
    --client "ACME Corp" --engagement "AUD-2026-042" \
    --report-html client.html --report-pdf client.pdf

# All three at once
vamp-host-audit --local --profile all \
    --json raw.json --html technical.html \
    --auditor-name "A. Hernández" --client "ACME Corp" \
    --report-html client.html
```

---

### Available Checks — macOS (v1.1)

#### macOS — CIS macOS Benchmark

| ID | Control | Severity | CIS macOS |
|----|---------|----------|-----------|
| MACOS-001 | SIP (System Integrity Protection) active | CRITICAL | 5.1.2 |
| MACOS-002 | FileVault 2 active on system volume | HIGH | 2.5.1 |
| MACOS-003 | Gatekeeper active | HIGH | 5.1.1 |
| MACOS-004 | macOS Firewall active | HIGH | 2.2.1 |
| MACOS-005 | Automatic updates enabled | MEDIUM | 1.1 |
| MACOS-006 | Remote SSH access restricted or disabled | MEDIUM | 2.3.3.5 |
| MACOS-007 | Automatic screen lock (≤ 5 min) | MEDIUM | 2.5.2 |
| MACOS-008 | Screen Sharing disabled | HIGH | 2.3.2.1 |
| MACOS-009 | Remote Management (ARD) disabled | HIGH | 2.3.2.2 |
| MACOS-010 | Guest account disabled | HIGH | 5.6 |
| MACOS-011 | Bluetooth disabled if not needed | LOW | 2.1.1 |
| MACOS-012 | AirDrop restricted to Contacts or disabled | MEDIUM | 2.3.3.2 |
| MACOS-013 | XProtect / MRT active and updated | MEDIUM | 5.1.3 |
| MACOS-014 | Login window without user list | LOW | 5.9 |
| MACOS-015 | SSH: PermitRootLogin disabled (macOS) | CRITICAL | 5.2.10 |
| MACOS-016 | sudo timestamp_timeout ≤ 5 min | MEDIUM | 5.4 |
| MACOS-017 | Secure Boot active (T2 / Apple Silicon) | CRITICAL | — |

---

### Available Checks — Windows (v1.2)

#### Windows — CIS Windows Server Benchmark

| ID | Control | Severity | CIS Ref |
|----|---------|----------|---------|
| WIN-001 | Account Lockout: threshold ≤ 10 failed attempts | HIGH | 1.2.2 |
| WIN-002 | Password Policy: min 14 chars, history ≥ 24 | HIGH | 1.1.x |
| WIN-003 | Guest account disabled | HIGH | 2.3.1.2 |
| WIN-004 | Administrator SID-500 disabled or renamed | MEDIUM | 2.3.1.1 |
| WIN-005 | UAC active (EnableLUA=1, admin prompt) | HIGH | 2.3.17.x |
| WIN-006 | BitLocker active on system volume | HIGH | 18.9.44 |
| WIN-007 | NTLM v1 disabled (LMCompatibilityLevel ≥ 3) | CRITICAL | 2.3.11.1 |
| WIN-008 | WDigest disabled (UseLogonCredential=0) | CRITICAL | 2.3.11.9 |
| WIN-009 | Windows Firewall active on all profiles | HIGH | 9.1.1/9.2.1/9.3.1 |
| WIN-010 | SMBv1 disabled | CRITICAL | 18.3.3 |
| WIN-011 | RDP with mandatory NLA (UserAuthentication=1) | HIGH | 18.10.56.3.9 |
| WIN-012 | Remote Registry service disabled | MEDIUM | 2.2.40 |
| WIN-013 | Audit policy configured | MEDIUM | 17.x |
| WIN-014 | Windows Defender active and updated | HIGH | 18.9.47 |
| WIN-015 | Automatic updates active | HIGH | 18.9.108.2 |
| WIN-016 | PowerShell Script Block Logging active | MEDIUM | 18.10.41.1 |
| WIN-017 | LSA RunAsPPL active (credential protection) | HIGH | 2.3.11.8 |
| WIN-018 | Credential Guard active (Windows 10/Server 2016+) | HIGH | 18.9.29 |
| WIN-019 | AutoRun / AutoPlay disabled | MEDIUM | 18.9.8.1 |
| WIN-020 | No pending security updates | HIGH | — |

---

### Available Checks — Linux (v1.0)

#### AUTH — Authentication and access control

| ID | Control | Severity | CIS | ENS | NIS2 | ISO 27001 |
|----|---------|----------|-----|-----|------|-----------|
| AUTH-001 | SSH PermitRootLogin no | CRITICAL | 5.2.10 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-002 | SSH PasswordAuthentication no | HIGH | 5.2.14 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-003 | SSH MaxAuthTries ≤ 4 | MEDIUM | 5.2.7 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-004 | SSH PermitEmptyPasswords no | CRITICAL | 5.2.11 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-005 | SSH X11Forwarding no | LOW | 5.2.6 | — | — | A.8.9 |
| AUTH-006 | SSH LogLevel INFO/VERBOSE | MEDIUM | 5.2.5 | op.exp.8 | Art.21(2)(a) | A.8.15 |
| AUTH-007 | sudo without global NOPASSWD | HIGH | 5.3.5 | op.acc.4 | Art.21(2)(i) | A.8.5 |
| AUTH-008 | PAM password policy | MEDIUM | 5.4.1 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-009 | Root account locked | HIGH | 5.4.3 | op.acc.4 | Art.21(2)(i) | A.8.5 |
| AUTH-010 | No additional UID 0 accounts | CRITICAL | 5.4.3 | op.acc.4 | Art.21(2)(i) | A.8.5 |

#### KERN — Kernel parameters (sysctl)

| ID | Control | Severity | CIS | NIS2 | ISO 27001 |
|----|---------|----------|-----|------|-----------|
| KERN-001 | ASLR active (randomize_va_space=2) | HIGH | 1.6.2 | Art.21(2)(e) | A.8.8 |
| KERN-002 | Core dumps disabled (suid_dumpable=0) | MEDIUM | 1.6.1 | Art.21(2)(e) | A.8.3 |
| KERN-003 | dmesg restricted (dmesg_restrict=1) | LOW | 1.6.3 | Art.21(2)(e) | A.8.3 |
| KERN-004 | IP forwarding disabled | MEDIUM | 3.1.1 | Art.21(2)(e) | A.8.20 |
| KERN-005 | ICMP redirects disabled | MEDIUM | 3.2.2 | Art.21(2)(e) | A.8.20 |
| KERN-006 | Send redirects disabled | MEDIUM | 3.1.2 | Art.21(2)(e) | A.8.20 |
| KERN-007 | SYN cookies active | MEDIUM | 3.2.8 | Art.21(2)(e) | A.8.20 |
| KERN-008 | IPv6 RA disabled | LOW | 3.1.3 | Art.21(2)(e) | A.8.20 |

#### FILE — Permissions and critical files

| ID | Control | Severity | CIS | NIS2 | ISO 27001 |
|----|---------|----------|-----|------|-----------|
| FILE-001 | /etc/passwd permissions 644 | HIGH | 6.1.2 | Art.21(2)(e) | A.8.3 |
| FILE-002 | /etc/shadow permissions 640 | CRITICAL | 6.1.3 | Art.21(2)(e) | A.8.3 |
| FILE-003 | /etc/group permissions 644 | MEDIUM | 6.1.4 | Art.21(2)(e) | A.8.3 |
| FILE-004 | SUID/SGID inventory | MEDIUM | 6.1.11 | Art.21(2)(e) | A.8.3 |
| FILE-005 | No world-writable in critical paths | HIGH | 6.1.9 | Art.21(2)(e) | A.8.3 |
| FILE-006 | Sticky bit on world-writable dirs | MEDIUM | 6.1.10 | Art.21(2)(e) | A.8.3 |
| FILE-007 | No files without owner | LOW | 6.1.13 | Art.21(2)(e) | A.8.3 |

#### SERV — System services

| ID | Control | Severity | CIS | NIS2 | ISO 27001 |
|----|---------|----------|-----|------|-----------|
| SERV-001 | auditd active and enabled | HIGH | 4.1.1.1 | Art.21(2)(a) | A.8.15 |
| SERV-002 | Centralized logging (rsyslog/journald) | HIGH | 4.2.1 | Art.21(2)(a) | A.8.15 |
| SERV-003 | cron access restricted | LOW | 5.1.8 | Art.21(2)(i) | A.8.9 |
| SERV-004 | Telnet/rsh/rlogin disabled | CRITICAL | 2.2.18 | Art.21(2)(e) | A.8.9 |
| SERV-005 | NTP/chrony active | MEDIUM | 2.2.1.1 | Art.21(2)(a) | A.8.16 |
| SERV-006 | Host firewall active | CRITICAL | 3.5.1 | Art.21(2)(e) | A.8.20 |
| SERV-007 | AppArmor/SELinux MAC active | MEDIUM | 1.7 | Art.21(2)(e) | A.8.7 |

#### NET — Network

| ID | Control | Severity | NIS2 | ISO 27001 |
|----|---------|----------|------|-----------|
| NET-001 | Firewall with restrictive INPUT policy | CRITICAL | Art.21(2)(e) | A.8.20 |
| NET-002 | Inventory of listening ports | INFO | Art.21(2)(a) | A.8.9 |
| NET-003 | Unused protocols disabled (dccp/sctp/rds) | LOW | Art.21(2)(e) | A.8.20 |
| NET-004 | SSH only on necessary interfaces | LOW | Art.21(2)(i) | A.8.5 |
| NET-005 | No FTP/Telnet/rsync on standard ports | HIGH | Art.21(2)(e) | A.8.9 |

#### UPDT — Updates

| ID | Control | Severity | NIS2 | ISO 27001 |
|----|---------|----------|------|-----------|
| UPDT-001 | Pending security updates | HIGH | Art.21(2)(e) | A.8.8 |
| UPDT-002 | Automatic updates configured | MEDIUM | Art.21(2)(e) | A.8.8 |
| UPDT-003 | System updated < 90 days | MEDIUM | Art.21(2)(e) | A.8.8 |

#### DOCK — Docker host

| ID | Control | Severity | NIS2 | ISO 27001 |
|----|---------|----------|------|-----------|
| DOCK-001 | docker.sock without universal access | CRITICAL | Art.21(2)(i) | A.8.5 |
| DOCK-002 | No privileged containers running | CRITICAL | Art.21(2)(e) | A.8.7 |

---

### Full CLI Options

```
Target (required, one of three):
  --local                  Audit the local host (no SSH or WinRM)
  --host HOST              Hostname or IP of remote host (SSH — Linux/macOS)
  --winrm HOST             Hostname or IP of Windows host (WinRM)

SSH connection (only with --host):
  --user USER, -u USER     SSH user (default: $USER)
  --port PORT, -p PORT     SSH port (default: 22)
  --key KEY, -i KEY        SSH private key file
  --password PASS          SSH password (always prefer key)
  --use-paramiko           Use paramiko instead of subprocess SSH
  --sudo                   Use sudo for commands that require it (--local)

WinRM connection (only with --winrm):
  --winrm-port PORT        WinRM port (default: 5985; HTTPS uses 5986)
  --winrm-ssl              Use HTTPS for WinRM connection
  --winrm-transport TRANS  Transport: ntlm (default), kerberos, basic, certificate
  --user USER, -u USER     Windows user (domain\user or .\local_user)
  --password PASS          Windows password

Profile:
  --profile NAME [...]     Built-in profile(s) — accepts one or more; auto-deduplicated
                           (default: linux-cis / windows-cis depending on target)
                           Special: 'all' runs the 79 checks from all frameworks
  --profile-file YAML      Custom YAML profile file
  --checks IDS             Comma-separated list of check IDs

Output:
  --json FILE              Save structured JSON report
  --html                   Generate dark-theme technical HTML report (all checks)
  --output FILE            HTML output file (implies --html)
  --no-color               No console colors
  --verbose, -v            Show PASS and SKIP checks too

Engagement (report cover page):
  --auditor-name NAME      Auditor name (shown on cover page)
  --auditor-company COMPANY Auditing company (shown on cover page)
  --client COMPANY         Audited company / client (shown on cover page)
  --engagement REF         Engagement reference (e.g. AUD-2026-001)
  --report-html FILE       Generate professional HTML report (unified VSL format)
  --report-pdf  FILE       Generate professional PDF report (requires fpdf2)

General:
  --version                Show version
```

---

### Exit Codes

| Code | Meaning |
|------|---------|
| `0` | No CRITICAL or HIGH findings |
| `1` | HIGH severity findings (no critical) |
| `2` | CRITICAL severity findings |

Designed for CI/CD: a pipeline can block on code ≥ 1 or ≥ 2 depending on the acceptable threshold.

---

### JSON Output Format

```json
{
  "tool": "vamp-host-audit",
  "version": "1.16",
  "target": "prod-server",
  "platform": {"os": "linux", "distro": "ubuntu", "version": "22.04", "kernel": "5.15.0"},
  "profile": "NIS2 Art. 21(2) — Technical domains",
  "timestamp": "2026-09-30T10:00:00Z",
  "duration_s": 14.2,
  "summary": {"critical": 1, "high": 3, "medium": 2, "pass": 61, "skip": 6, "total": 79},
  "findings": [
    {
      "check_id": "AUTH-001",
      "titulo": "SSH: PermitRootLogin disabled",
      "categoria": "AUTH",
      "severidad": "critical",
      "estado": "fail",
      "evidencia": "PermitRootLogin = yes",
      "correccion": "Add 'PermitRootLogin no' to /etc/ssh/sshd_config and restart sshd.",
      "marcos": ["CIS", "ENS", "NIS2", "ISO27001"],
      "refs": {
        "NIS2":     "Art.21(2)(i)",
        "ISO27001": "A.8.5",
        "CIS":      "5.2.10",
        "ENS":      "op.acc.6"
      },
      "cis_ref": "5.2.10",
      "ens_ctrl": "op.acc.6"
    }
  ]
}
```

---

### VSL Ecosystem Integration

#### vampsec_report.py

The `vampsec_report.py` module is VampSecure Labs' unified report generator, shared by all toolkit tools. When using `--report-html` or `--report-pdf`, vamp-host-audit converts FAIL/WARN findings into `Finding` objects and delegates report layout to `VampSecReport`.

If `vampsec_report.py` is not available (minimal installation), `--html` still works with the standalone dark-theme report.

#### vamp-orchestrator

JSON reports generated with `--json` are directly consumable by `vamp-orchestrator` for multi-tool audit pipelines.

#### VampSuite Sec

Integrated in [VampSuite Sec](https://vampsuite-sec.vampsecurestudios.com) as a host audit module via `vamp-orchestrator`.

---

### Why vamp-host-audit vs. Lynis · CIS-CAT Pro · OpenSCAP

| Feature | vamp-host-audit | Lynis | CIS-CAT Pro | OpenSCAP |
|---------|-----------------|-------|-------------|----------|
| No permanent agent | ✅ SSH/WinRM/local | ✅ local only | ❌ dedicated agent or runner | ⚠️ local or manual SSH |
| Windows Server (WinRM) | ✅ native | ❌ | ✅ | ⚠️ limited |
| ENS RD 311/2022 + CCN-STIC 808 | ✅ 272 mapped checks | ❌ | ❌ | ❌ |
| NIS2 Art. 21 / ISO 27001 / DORA | ✅ multi-framework per check | ❌ | ⚠️ CIS only | ⚠️ SCAP/XCCDF |
| Multi-profile in one pass | ✅ `--profile A B` | ❌ | ❌ | ❌ |
| Professional client report (HTML+PDF) | ✅ unified VSL | ❌ plain text | ✅ HTML | ⚠️ basic HTML |
| CI/CD exit codes 0/1/2 | ✅ | ❌ | ❌ | ❌ |
| External dependencies | only `rich` | none | JRE + license | libxml2 + OVAL |

- **ENS exclusive on the market**: the only auditor that implements the full Annex II of RD 311/2022 — primary, secondary measures, and CCN-STIC 808 reinforcements — per check, with automated `test_ens.py` guaranteeing traceability.
- **No agent or database**: Lynis only audits locally; CIS-CAT Pro needs a dedicated runner; vamp-host-audit audits any Linux/macOS/Windows host from your machine with a single SSH or WinRM line.
- **Real multi-framework**: the same check simultaneously evidences CIS, ENS, NIS2, ISO 27001, and DORA — without running four different tools or manually reconciling outputs.
- **Engagement reports**: client cover page, compliance table by framework, and detailed finding cards — ready to deliver to an external auditor or a CISO.

---

### Check Coverage

| Check ID | Description | Standard | Severity |
|----------|-------------|----------|----------|
| AUTH-001 | SSH PermitRootLogin disabled | CIS L1 §5.2.10 / ENS op.acc.6 / NIS2 Art.21(2)(i) | CRITICAL |
| AUTH-002 | SSH PasswordAuthentication disabled | CIS L1 §5.2.14 / ENS op.acc.6 | HIGH |
| AUTH-004 | SSH PermitEmptyPasswords disabled | CIS L1 §5.2.11 / ENS op.acc.6 | CRITICAL |
| AUTH-007 | sudo without global NOPASSWD | CIS L1 §5.3.5 / ENS op.acc.4 / ISO 27001 A.8.5 | HIGH |
| AUTH-010 | No additional UID 0 accounts | CIS L1 §5.4.3 / ENS op.acc.4 | CRITICAL |
| KERN-001 | ASLR active (randomize_va_space=2) | CIS L1 §1.6.2 / NIS2 Art.21(2)(e) | HIGH |
| FILE-002 | /etc/shadow permissions 640 or stricter | CIS L1 §6.1.3 / ENS mp.si.2 | CRITICAL |
| FILE-005 | No world-writable files in critical paths | CIS L1 §6.1.9 / ISO 27001 A.8.3 | HIGH |
| SERV-001 | auditd active and enabled | CIS L1 §4.1.1 / ENS op.exp.8 / NIS2 Art.21(2)(a) | HIGH |
| SERV-004 | Telnet/rsh/rlogin disabled | CIS L1 §2.2.18 / ENS mp.com.1 | CRITICAL |
| SERV-006 | Host firewall active | CIS L1 §3.5.1 / ENS mp.com.2 / DORA Art.9 | CRITICAL |
| NET-001 | Firewall INPUT policy is DROP or REJECT | CIS L1 §3.6 / NIS2 Art.21(2)(e) | CRITICAL |
| WIN-007 | NTLM v1 disabled (LMCompatibilityLevel >= 3) | CIS WS Benchmark v2.0 §2.3.11.1 / ENS | CRITICAL |
| WIN-010 | SMBv1 disabled | CIS WS Benchmark v2.0 §18.3.3 / ENS mp.com.1 | CRITICAL |
| MACOS-001 | SIP (System Integrity Protection) active | CIS macOS Benchmark v3.0 §5.1.2 | CRITICAL |
| UPDT-001 | No pending security updates | CIS L1 / NIS2 Art.21(2)(e) / ISO 27001 A.8.8 | HIGH |

---

### Version History

| Version | Main changes |
|---------|-------------|
| v1.16 | Bilingual README (EN/ES) |
| v1.15 | ENS cross-referenced with CCN-STIC 808: secondary measures and reinforcements per check · ENS profiles filtered by category requirement · +13 checks → 272 checks |
| v1.14 | ENS mapping aligned with Annex II of RD 311/2022 (144 checks reassigned) · no SyntaxWarning in Python 3.12+ · real version in --help |
| v1.5 | +20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS complete in 99 checks |
| v1.4 | Engagement params · VS Logo · Unified VSL report |
| v1.3 | Cross-framework NIS2/ISO27001/DORA |
| v1.2 | Windows Server (WinRM + PowerShell) |
| v1.1 | macOS (Sonoma/Sequoia) |
| v1.0 | Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch) |

---

### License

AGPL-3.0-only · © VampSecure Studios — VampSecure Labs Security Research Division

For authorized penetration testing use only. Use only against systems for which you have explicit written authorization.

---
---

<a name="español"></a>
## 🇪🇸 Español

> **Auditor live multiplataforma de hosts — sin agente permanente**
> VampSecure Labs · VampSecure Studios

Audita el estado real (runtime) de un host Linux, macOS o Windows mediante SSH, WinRM o en local.
Sin agente instalado en el objetivo. Un único fichero Python, sin dependencias externas más allá de `rich`.

A diferencia de los scanners estáticos de repositorio (vamp-compliance-check), este tool interroga
el sistema operativo en ejecución: parámetros sysctl activos, permisos reales de ficheros, servicios
corriendo, reglas de firewall aplicadas.

---

## Características v1.16

- **272 checks totales**: 184 Linux · 37 macOS · 51 Windows
- **SSH sin agente** vía subprocess (OpenSSH) — `paramiko` como dep opcional
- **WinRM** vía `pywinrm` (dep opcional) — NTLM · Kerberos · Basic · Certificate
- **Ejecución local** con soporte de `sudo` opcional
- **Detección automática** de distro/versión para Linux y macOS; Windows se detecta por WinRM
- **Mapeo multi-framework** por cada check: CIS · ENS RD 311/2022 · NIS2 Art. 21(2) · ISO 27001:2022 · DORA
- **Tabla de cumplimiento** en consola: Aplican / Pass / Fail+Warn / Skip / % por normativa
- **12 perfiles integrados** + soporte de perfiles YAML personalizados + multi-perfil (`--profile A B`)
- **ENS RD 311/2022 trazabilidad completa** — cada check lleva su medida principal (`ens_ctrl`, una de las 73 del Anexo II), sus medidas secundarias (`ens_extra`) y los refuerzos que evidencia (`ens_refuerzos`, p.ej. `op.acc.6.r9`), cotejados con la tabla de verificación **CCN-STIC 808 (abr-2026)**. Los perfiles ENS solo incluyen checks que el ENS exige en su categoría. Todo lo garantiza `tests/test_ens.py`; criterios en [docs/ens-rd311-2022.md](docs/ens-rd311-2022.md)
- **Perfil `all`** — audita todos los 272 checks independientemente de plataforma y framework
- **Reporter triple**: consola rich en color · JSON estructurado · HTML dark-theme autónomo
- **Informe profesional unificado VSL** (`--report-html` / `--report-pdf`) via `vampsec_report.py`
- **Parámetros de engagement** (`--auditor-name`, `--auditor-company`, `--client`, `--engagement`) en portada
- **Logo VampSecure Studios** en informes HTML
- **Columna Normativa** en HTML técnico con referencias NIS2 / ISO 27001 / DORA por check
- **Códigos de salida** estándar para CI/CD: 2=CRÍTICO · 1=ALTO · 0=limpio
- Sin daemon, sin base de datos, sin estado persistente

### Plataformas

| Versión | Plataforma | Estado |
|---------|-----------|--------|
| v1.0 | Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch) | ✅ Disponible |
| v1.1 | macOS (Sonoma/Sequoia, Apple Silicon + Intel) | ✅ Disponible |
| v1.2 | Windows Server 2019/2022 (WinRM + PowerShell) | ✅ Disponible |
| v1.3 | Marcos cruzados NIS2/ISO27001/DORA — todos los checks | ✅ Disponible |
| v1.4 | Engagement params · Logo VS · Informe unificado VSL | ✅ Disponible |
| v1.5 | +20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS completo en 99 checks | ✅ Disponible |
| v1.14 | Mapeo ENS alineado con el Anexo II del RD 311/2022 (144 checks reasignados; fuera las medidas del RD 3/2010) · sin `SyntaxWarning` en Python 3.12+ · versión real en `--help` | ✅ Disponible |
| v1.15 | ENS cotejado con CCN-STIC 808: medidas secundarias y refuerzos por check · perfiles ENS filtrados por exigencia de la categoría · +13 checks para medidas sin cobertura (SSH limitado/último acceso/inactividad, TMOUT, permisos de logs, copias, compiladores, Postfix, SmartScreen, Safari) → 272 checks | ✅ Disponible |
| v1.16 | README bilingüe (EN/ES) | ✅ Disponible |

---

## Instalación

```bash
pip install vamp-host-audit
```

Con dependencias opcionales:

```bash
pip install "vamp-host-audit[yaml]"           # perfiles YAML externos (PyYAML)
pip install "vamp-host-audit[ssh]"            # paramiko para SSH avanzado
pip install "vamp-host-audit[winrm]"          # pywinrm para hosts Windows
pip install "vamp-host-audit[report]"         # fpdf2 para --report-pdf
pip install "vamp-host-audit[yaml,ssh,winrm,report]"
```

Desde el repo (desarrollo):

```bash
git clone http://localhost:3030/vampsecure/vamp-host-audit.git
cd vamp-host-audit
pip install -e ".[yaml,ssh,report]"
```

---

## Uso rápido

```bash
# Audita este host en local
vamp-host-audit --local

# Audita un host remoto por SSH
vamp-host-audit --host 192.168.1.10 --user ubuntu

# Con clave específica y perfil ENS Medio
vamp-host-audit --host vps --user ubuntu --key ~/.ssh/id_ed25519 --profile ens-medio

# Genera informe JSON + HTML técnico dark-theme
vamp-host-audit --local --profile linux-cis --json informe.json --html

# Solo checks críticos (quick scan, < 30s)
vamp-host-audit --host servidor --user root --profile quick

# Audita con TODOS los marcos (NIS2 + ISO27001 + DORA + CIS) a la vez
vamp-host-audit --local --profile all

# Dos perfiles a la vez (unión deduplicada)
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Audita un Windows Server por WinRM (NTLM, puerto 5985)
vamp-host-audit --winrm 192.168.1.20 --user Administrador --password S3cr3t0

# Windows Server con HTTPS (WinRM 5986) y perfil rápido
vamp-host-audit --winrm 192.168.1.20 --user Administrador --password S3cr3t0 \
                --winrm-ssl --profile windows-quick

# Informe profesional con datos del engagement (portada cliente)
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "Antonio Hernández" \
    --auditor-company "VampSecure Studios" \
    --client "Empresa Auditada S.A." \
    --engagement "AUD-2026-001" \
    --report-html informe_cliente.html \
    --report-pdf  informe_cliente.pdf

# Checks específicos
vamp-host-audit --local --checks AUTH-001,AUTH-002,SERV-006

# Verbose: muestra también los checks que pasan
vamp-host-audit --local --verbose
```

---

## Perfiles disponibles

| Perfil | Plataforma | Framework | Checks | Descripción |
|--------|-----------|-----------|--------|-------------|
| `linux-cis` | Linux | CIS | 42 | CIS Linux Benchmark Level 1 (todos los checks Linux) |
| `ens-basico` | Linux+macOS+Win | ENS | 37 | ENS Categoría Básica — RD 311/2022 (solo checks que el ENS exige en Básica) |
| `ens-medio` | Linux+macOS+Win | ENS | 91 | ENS Categoría Media (solo checks exigibles en Media) |
| `ens-alto` | Linux+macOS+Win | ENS | 272 | ENS Categoría Alta (todos los checks con medida ENS) |
| `nis2-art21` | **todas (79)** | NIS2 | 79 | NIS2 Art. 21(2) — dominios técnicos obligatorios |
| `iso27001-a8` | **todas (79)** | ISO 27001 | 79 | ISO 27001:2022 Annex A.8 — controles técnicos |
| `dora-art9` | **todas (79)** | DORA | 79 | DORA Art. 9/10/13 — resiliencia TIC sector financiero |
| `all` | **todas (79)** | multi | 79 | Todos los checks de todos los marcos y plataformas |
| `quick` | Linux | multi | 14 | Quick scan Linux — controles críticos, < 30s |
| `macos-cis` | macOS | CIS | 17 | CIS macOS Benchmark v3.0 (Sonoma/Sequoia) |
| `macos-quick` | macOS | CIS | 8 | Quick scan macOS — controles críticos |
| `windows-cis` | Windows | CIS | 20 | CIS Windows Server Benchmark v2.0 |
| `windows-quick` | Windows | CIS | 8 | Quick scan Windows — controles críticos |

### Multi-perfil

`--profile` acepta uno o varios nombres: los checks se deduplicarán automáticamente.

```bash
# Cumplimiento NIS2 + ISO 27001 en una sola pasada
vamp-host-audit --local --profile nis2-art21 iso27001-a8

# Toda la normativa financiera + CIS completo Linux
vamp-host-audit --local --profile dora-art9 linux-cis
```

### Perfiles YAML personalizados

```yaml
# mi-perfil.yaml
title: "Perfil personalizado"
framework: "custom"
checks:
  - AUTH-001
  - AUTH-002
  - SERV-006
  - NET-001
```

```bash
vamp-host-audit --local --profile-file mi-perfil.yaml
```

---

## Sample Output

```
  vamp-host-audit v1.17 · Linux · profile: nis2-art21,cis-l1
  ─────────────────────────────────────────────────────────────────
  [PASS] AUTH-001 SSH root login disabled
  [PASS] AUTH-003 PAM password complexity: minlen=14, ucredit, dcredit
  [FAIL] AUTH-005 SSH protocol version: SSHv1 still enabled            ← HIGH
  [FAIL] KERN-002 kernel.randomize_va_space = 0 (ASLR disabled)        ← CRITICAL
  [WARN] FILE-007 /etc/crontab world-readable
  [PASS] SERV-001 Telnet disabled
  [FAIL] NET-004  IPv6 enabled without firewall rules                   ← MEDIUM
  [PASS] DOCK-003 Docker daemon socket not world-accessible
  [SKIP] WIN-001  Windows-only check (running Linux)

  ┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
  │ Normativa   │ Aplican │ Pass │ Fail+Warn │ Skip │ Cumplimiento │
  ├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
  │ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
  │ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
  └─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘

  272 checks · 3 CRITICAL · 5 HIGH · 4 MEDIUM · 6 WARN
```

## Tabla de cumplimiento (consola)

Al usar `--profile nis2-art21`, `iso27001-a8`, `dora-art9` o `all`, el tool muestra
automáticamente la tabla de cumplimiento por normativa al final de la ejecución:

```
┌─────────────┬─────────┬──────┬───────────┬──────┬──────────────┐
│ Normativa   │ Aplican │ Pass │ Fail+Warn │ Skip │ Cumplimiento │
├─────────────┼─────────┼──────┼───────────┼──────┼──────────────┤
│ NIS2        │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ISO 27001   │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ DORA        │ 46      │ 36   │ 7         │ 3    │ 83.7%        │
│ CIS         │ 79      │ 61   │ 12        │ 6    │ 83.6%        │
│ ENS         │ 42      │ 33   │ 6         │ 3    │ 84.6%        │
└─────────────┴─────────┴──────┴───────────┴──────┴──────────────┘
```

---

## Informes del engagement

### HTML técnico dark-theme (`--html`)

Genera un informe autocontenido con:
- Cabecera con logo VampSecure Studios y metadatos del engagement
- Tabla de todos los checks con columna **Normativa** (refs NIS2/ISO/DORA por check)
- Tabla de cumplimiento por marco al final
- Sin dependencias externas — un único fichero `.html`

### Informe profesional unificado VSL (`--report-html` / `--report-pdf`)

Genera un informe en el **formato unificado VampSecure Labs** compartido por todas las herramientas
del toolkit (`vampsec_report.py`). Incluye solo los hallazgos FAIL/WARN con:
- Portada con datos del engagement (auditor, empresa, cliente, referencia)
- Tabla resumen de hallazgos por severidad
- Fichas detalladas con evidencia, corrección y referencias normativas
- Formato HTML light profesional o PDF ejecutivo

```bash
# Solo informe técnico dark-theme
vamp-host-audit --local --profile all --html tecnico.html

# Solo informe cliente unificado
vamp-host-audit --local --profile nis2-art21 \
    --auditor-name "A. Hernández" --auditor-company "VampSecure Studios" \
    --client "ACME Corp" --engagement "AUD-2026-042" \
    --report-html cliente.html --report-pdf cliente.pdf

# Los tres a la vez
vamp-host-audit --local --profile all \
    --json raw.json --html tecnico.html \
    --auditor-name "A. Hernández" --client "ACME Corp" \
    --report-html cliente.html
```

---

## Checks disponibles — macOS (v1.1)

### macOS — CIS macOS Benchmark

| ID | Control | Severidad | CIS macOS |
|----|---------|-----------|-----------|
| MACOS-001 | SIP (System Integrity Protection) activo | CRÍTICO | 5.1.2 |
| MACOS-002 | FileVault 2 activo en el volumen del sistema | ALTO | 2.5.1 |
| MACOS-003 | Gatekeeper activo | ALTO | 5.1.1 |
| MACOS-004 | Firewall macOS activo | ALTO | 2.2.1 |
| MACOS-005 | Actualizaciones automáticas activadas | MEDIO | 1.1 |
| MACOS-006 | Acceso remoto SSH restringido o desactivado | MEDIO | 2.3.3.5 |
| MACOS-007 | Bloqueo automático de pantalla (≤ 5 min) | MEDIO | 2.5.2 |
| MACOS-008 | Screen Sharing desactivado | ALTO | 2.3.2.1 |
| MACOS-009 | Remote Management (ARD) desactivado | ALTO | 2.3.2.2 |
| MACOS-010 | Cuenta de invitado desactivada | ALTO | 5.6 |
| MACOS-011 | Bluetooth desactivado si no se necesita | BAJO | 2.1.1 |
| MACOS-012 | AirDrop restringido a Contactos o desactivado | MEDIO | 2.3.3.2 |
| MACOS-013 | XProtect / MRT activo y actualizado | MEDIO | 5.1.3 |
| MACOS-014 | Login window sin lista de usuarios | BAJO | 5.9 |
| MACOS-015 | SSH: PermitRootLogin desactivado (macOS) | CRÍTICO | 5.2.10 |
| MACOS-016 | sudo timestamp_timeout ≤ 5 min | MEDIO | 5.4 |
| MACOS-017 | Secure Boot activo (T2 / Apple Silicon) | CRÍTICO | — |

---

## Checks disponibles — Windows (v1.2)

### Windows — CIS Windows Server Benchmark

| ID | Control | Severidad | CIS Ref |
|----|---------|-----------|---------|
| WIN-001 | Account Lockout: umbral ≤ 10 intentos fallidos | ALTO | 1.2.2 |
| WIN-002 | Password Policy: min 14 chars, historia ≥ 24 | ALTO | 1.1.x |
| WIN-003 | Cuenta de invitado desactivada | ALTO | 2.3.1.2 |
| WIN-004 | Administrador SID-500 desactivado o renombrado | MEDIO | 2.3.1.1 |
| WIN-005 | UAC activo (EnableLUA=1, prompt admin) | ALTO | 2.3.17.x |
| WIN-006 | BitLocker activo en volumen del sistema | ALTO | 18.9.44 |
| WIN-007 | NTLM v1 desactivado (LMCompatibilityLevel ≥ 3) | CRÍTICO | 2.3.11.1 |
| WIN-008 | WDigest desactivado (UseLogonCredential=0) | CRÍTICO | 2.3.11.9 |
| WIN-009 | Windows Firewall activo en todos los perfiles | ALTO | 9.1.1/9.2.1/9.3.1 |
| WIN-010 | SMBv1 desactivado | CRÍTICO | 18.3.3 |
| WIN-011 | RDP con NLA obligatoria (UserAuthentication=1) | ALTO | 18.10.56.3.9 |
| WIN-012 | Remote Registry service desactivado | MEDIO | 2.2.40 |
| WIN-013 | Política de auditoría configurada | MEDIO | 17.x |
| WIN-014 | Windows Defender activo y actualizado | ALTO | 18.9.47 |
| WIN-015 | Actualizaciones automáticas activas | ALTO | 18.9.108.2 |
| WIN-016 | PowerShell Script Block Logging activo | MEDIO | 18.10.41.1 |
| WIN-017 | LSA RunAsPPL activo (protección de credenciales) | ALTO | 2.3.11.8 |
| WIN-018 | Credential Guard activo (Windows 10/Server 2016+) | ALTO | 18.9.29 |
| WIN-019 | AutoRun / AutoPlay desactivado | MEDIO | 18.9.8.1 |
| WIN-020 | Sin actualizaciones de seguridad pendientes | ALTO | — |

---

## Checks disponibles — Linux (v1.0)

### AUTH — Autenticación y control de acceso

| ID | Control | Severidad | CIS | ENS | NIS2 | ISO 27001 |
|----|---------|-----------|-----|-----|------|-----------|
| AUTH-001 | SSH PermitRootLogin no | CRÍTICO | 5.2.10 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-002 | SSH PasswordAuthentication no | ALTO | 5.2.14 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-003 | SSH MaxAuthTries ≤ 4 | MEDIO | 5.2.7 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-004 | SSH PermitEmptyPasswords no | CRÍTICO | 5.2.11 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-005 | SSH X11Forwarding no | BAJO | 5.2.6 | — | — | A.8.9 |
| AUTH-006 | SSH LogLevel INFO/VERBOSE | MEDIO | 5.2.5 | op.exp.8 | Art.21(2)(a) | A.8.15 |
| AUTH-007 | sudo sin NOPASSWD global | ALTO | 5.3.5 | op.acc.4 | Art.21(2)(i) | A.8.5 |
| AUTH-008 | PAM política de contraseñas | MEDIO | 5.4.1 | op.acc.6 | Art.21(2)(i) | A.8.5 |
| AUTH-009 | Cuenta root bloqueada | ALTO | 5.4.3 | op.acc.4 | Art.21(2)(i) | A.8.5 |
| AUTH-010 | Sin UIDs 0 adicionales | CRÍTICO | 5.4.3 | op.acc.4 | Art.21(2)(i) | A.8.5 |

### KERN — Parámetros del kernel (sysctl)

| ID | Control | Severidad | CIS | NIS2 | ISO 27001 |
|----|---------|-----------|-----|------|-----------|
| KERN-001 | ASLR activo (randomize_va_space=2) | ALTO | 1.6.2 | Art.21(2)(e) | A.8.8 |
| KERN-002 | Core dumps desactivados (suid_dumpable=0) | MEDIO | 1.6.1 | Art.21(2)(e) | A.8.3 |
| KERN-003 | dmesg restringido (dmesg_restrict=1) | BAJO | 1.6.3 | Art.21(2)(e) | A.8.3 |
| KERN-004 | IP forwarding desactivado | MEDIO | 3.1.1 | Art.21(2)(e) | A.8.20 |
| KERN-005 | ICMP redirects desactivados | MEDIO | 3.2.2 | Art.21(2)(e) | A.8.20 |
| KERN-006 | Send redirects desactivados | MEDIO | 3.1.2 | Art.21(2)(e) | A.8.20 |
| KERN-007 | SYN cookies activos | MEDIO | 3.2.8 | Art.21(2)(e) | A.8.20 |
| KERN-008 | IPv6 RA desactivados | BAJO | 3.1.3 | Art.21(2)(e) | A.8.20 |

### FILE — Permisos y ficheros críticos

| ID | Control | Severidad | CIS | NIS2 | ISO 27001 |
|----|---------|-----------|-----|------|-----------|
| FILE-001 | /etc/passwd permisos 644 | ALTO | 6.1.2 | Art.21(2)(e) | A.8.3 |
| FILE-002 | /etc/shadow permisos 640 | CRÍTICO | 6.1.3 | Art.21(2)(e) | A.8.3 |
| FILE-003 | /etc/group permisos 644 | MEDIO | 6.1.4 | Art.21(2)(e) | A.8.3 |
| FILE-004 | SUID/SGID inventario | MEDIO | 6.1.11 | Art.21(2)(e) | A.8.3 |
| FILE-005 | Sin world-writable en paths críticos | ALTO | 6.1.9 | Art.21(2)(e) | A.8.3 |
| FILE-006 | Sticky bit en dirs world-writable | MEDIO | 6.1.10 | Art.21(2)(e) | A.8.3 |
| FILE-007 | Sin ficheros sin propietario | BAJO | 6.1.13 | Art.21(2)(e) | A.8.3 |

### SERV — Servicios del sistema

| ID | Control | Severidad | CIS | NIS2 | ISO 27001 |
|----|---------|-----------|-----|------|-----------|
| SERV-001 | auditd activo y habilitado | ALTO | 4.1.1.1 | Art.21(2)(a) | A.8.15 |
| SERV-002 | Logging centralizado (rsyslog/journald) | ALTO | 4.2.1 | Art.21(2)(a) | A.8.15 |
| SERV-003 | cron acceso restringido | BAJO | 5.1.8 | Art.21(2)(i) | A.8.9 |
| SERV-004 | Telnet/rsh/rlogin desactivados | CRÍTICO | 2.2.18 | Art.21(2)(e) | A.8.9 |
| SERV-005 | NTP/chrony activo | MEDIO | 2.2.1.1 | Art.21(2)(a) | A.8.16 |
| SERV-006 | Firewall del host activo | CRÍTICO | 3.5.1 | Art.21(2)(e) | A.8.20 |
| SERV-007 | AppArmor/SELinux MAC activo | MEDIO | 1.7 | Art.21(2)(e) | A.8.7 |

### NET — Red

| ID | Control | Severidad | NIS2 | ISO 27001 |
|----|---------|-----------|------|-----------|
| NET-001 | Firewall con política INPUT restrictiva | CRÍTICO | Art.21(2)(e) | A.8.20 |
| NET-002 | Inventario de puertos en escucha | INFO | Art.21(2)(a) | A.8.9 |
| NET-003 | Protocolos no usados desactivados (dccp/sctp/rds) | BAJO | Art.21(2)(e) | A.8.20 |
| NET-004 | SSH solo en interfaces necesarias | BAJO | Art.21(2)(i) | A.8.5 |
| NET-005 | Sin FTP/Telnet/rsync en puertos estándar | ALTO | Art.21(2)(e) | A.8.9 |

### UPDT — Actualizaciones

| ID | Control | Severidad | NIS2 | ISO 27001 |
|----|---------|-----------|------|-----------|
| UPDT-001 | Actualizaciones de seguridad pendientes | ALTO | Art.21(2)(e) | A.8.8 |
| UPDT-002 | Actualizaciones automáticas configuradas | MEDIO | Art.21(2)(e) | A.8.8 |
| UPDT-003 | Sistema actualizado < 90 días | MEDIO | Art.21(2)(e) | A.8.8 |

### DOCK — Docker host

| ID | Control | Severidad | NIS2 | ISO 27001 |
|----|---------|-----------|------|-----------|
| DOCK-001 | docker.sock sin acceso universal | CRÍTICO | Art.21(2)(i) | A.8.5 |
| DOCK-002 | Sin contenedores privilegiados en ejecución | CRÍTICO | Art.21(2)(e) | A.8.7 |

---

## Opciones CLI completas

```
Destino (obligatorio, uno de los tres):
  --local                  Audita el host local (sin SSH ni WinRM)
  --host HOST              Hostname o IP del host remoto (SSH — Linux/macOS)
  --winrm HOST             Hostname o IP del host Windows (WinRM)

Conexión SSH (solo con --host):
  --user USER, -u USER     Usuario SSH (default: $USER)
  --port PORT, -p PORT     Puerto SSH (default: 22)
  --key KEY, -i KEY        Fichero de clave privada SSH
  --password PASS          Contraseña SSH (preferir siempre clave)
  --use-paramiko           Usa paramiko en lugar de subprocess SSH
  --sudo                   Usa sudo para comandos que lo requieren (--local)

Conexión WinRM (solo con --winrm):
  --winrm-port PORT        Puerto WinRM (default: 5985; HTTPS usa 5986)
  --winrm-ssl              Usa HTTPS en la conexión WinRM
  --winrm-transport TRANS  Transporte: ntlm (default), kerberos, basic, certificate
  --user USER, -u USER     Usuario Windows (dominio\usuario o .\usuario local)
  --password PASS          Contraseña Windows

Perfil:
  --profile NOMBRE [...]   Perfil(es) integrado(s) — acepta uno o varios; se deduplicarán
                           (default: linux-cis / windows-cis según destino)
                           Especial: 'all' ejecuta los 79 checks de todos los marcos
  --profile-file YAML      Fichero YAML de perfil personalizado
  --checks IDS             Lista de check IDs separados por coma

Salida:
  --json FICHERO           Guarda informe en JSON estructurado
  --html                   Genera informe HTML técnico dark-theme (todos los checks)
  --output FICHERO         Fichero HTML de salida (implica --html)
  --no-color               Sin colores en consola
  --verbose, -v            Muestra también checks PASS y SKIP

Engagement (portada del informe):
  --auditor-name NOMBRE    Nombre del auditor (aparece en portada)
  --auditor-company EMPRESA Empresa auditora (aparece en portada)
  --client EMPRESA         Empresa auditada / cliente (aparece en portada)
  --engagement REF         Referencia del engagement (p.ej. AUD-2026-001)
  --report-html FICHERO    Genera informe profesional HTML (formato unificado VSL)
  --report-pdf  FICHERO    Genera informe profesional PDF (requiere fpdf2)

General:
  --version                Muestra la versión
```

---

## Códigos de salida

| Código | Significado |
|--------|-------------|
| `0` | Sin hallazgos CRÍTICOS ni ALTOS |
| `1` | Hallazgos de severidad ALTA (sin críticos) |
| `2` | Hallazgos de severidad CRÍTICA |

Diseñados para CI/CD: un pipeline puede bloquear en código ≥ 1 o ≥ 2 según el umbral aceptable.

---

## Formato de salida JSON

```json
{
  "tool": "vamp-host-audit",
  "version": "1.16",
  "target": "servidor-prod",
  "platform": {"os": "linux", "distro": "ubuntu", "version": "22.04", "kernel": "5.15.0"},
  "profile": "NIS2 Art. 21(2) — Dominios técnicos",
  "timestamp": "2026-09-30T10:00:00Z",
  "duration_s": 14.2,
  "summary": {"critical": 1, "high": 3, "medium": 2, "pass": 61, "skip": 6, "total": 79},
  "findings": [
    {
      "check_id": "AUTH-001",
      "titulo": "SSH: PermitRootLogin desactivado",
      "categoria": "AUTH",
      "severidad": "critical",
      "estado": "fail",
      "evidencia": "PermitRootLogin = yes",
      "correccion": "Añade 'PermitRootLogin no' a /etc/ssh/sshd_config y reinicia sshd.",
      "marcos": ["CIS", "ENS", "NIS2", "ISO27001"],
      "refs": {
        "NIS2":     "Art.21(2)(i)",
        "ISO27001": "A.8.5",
        "CIS":      "5.2.10",
        "ENS":      "op.acc.6"
      },
      "cis_ref": "5.2.10",
      "ens_ctrl": "op.acc.6"
    }
  ]
}
```

---

## Integración con el ecosistema VSL

### vampsec_report.py

El módulo `vampsec_report.py` es el generador de informes unificado de VampSecure Labs, compartido
por todas las herramientas del toolkit. Al usar `--report-html` o `--report-pdf`, vamp-host-audit
convierte los hallazgos FAIL/WARN en objetos `Finding` y delega en `VampSecReport` la maquetación
del informe profesional.

Si `vampsec_report.py` no está disponible (instalación mínima), `--html` sigue funcionando con
el informe dark-theme autónomo.

### vamp-orchestrator

Los informes JSON generados con `--json` son consumibles directamente por `vamp-orchestrator`
para pipelines de auditoría multi-herramienta.

### VampSuite Sec

Integrado en [VampSuite Sec](https://vampsuite-sec.vampsecurestudios.com) como módulo de
auditoría de host via `vamp-orchestrator`.

---

## Why vamp-host-audit vs. Lynis · CIS-CAT Pro · OpenSCAP

| Característica | vamp-host-audit | Lynis | CIS-CAT Pro | OpenSCAP |
|---|---|---|---|---|
| Sin agente permanente | ✅ SSH/WinRM/local | ✅ local only | ❌ agente o runner dedicado | ⚠️ local o SSH manual |
| Windows Server (WinRM) | ✅ nativo | ❌ | ✅ | ⚠️ limitado |
| ENS RD 311/2022 + CCN-STIC 808 | ✅ 272 checks mapeados | ❌ | ❌ | ❌ |
| NIS2 Art. 21 / ISO 27001 / DORA | ✅ multi-framework por check | ❌ | ⚠️ solo CIS | ⚠️ SCAP/XCCDF |
| Multi-perfil en una pasada | ✅ `--profile A B` | ❌ | ❌ | ❌ |
| Informe profesional cliente (HTML+PDF) | ✅ unificado VSL | ❌ texto plano | ✅ HTML | ⚠️ HTML básico |
| Exit codes CI/CD 0/1/2 | ✅ | ❌ | ❌ | ❌ |
| Dependencias externas | solo `rich` | ninguna | JRE + licencia | libxml2 + OVAL |

- **ENS exclusivo en el mercado**: único auditor que implementa el Anexo II del RD 311/2022 completo — medidas principales, secundarias y refuerzos CCN-STIC 808 — por check, con test automatizado `test_ens.py` que garantiza la trazabilidad.
- **Sin agente ni base de datos**: Lynis solo audita en local; CIS-CAT Pro necesita un runner dedicado; vamp-host-audit audita cualquier host Linux/macOS/Windows desde tu máquina con una sola línea SSH o WinRM.
- **Multi-framework real**: el mismo check evidencia simultáneamente CIS, ENS, NIS2, ISO 27001 y DORA — sin ejecutar cuatro herramientas distintas ni reconciliar outputs manualmente.
- **Informes de engagement**: portada con datos del cliente, tabla de cumplimiento por normativa y fichas detalladas de hallazgos — listos para entregar a un auditor externo o a un CISO.

---

## Check Coverage

| Check ID | Description | Standard | Severity |
|----------|-------------|----------|----------|
| AUTH-001 | SSH PermitRootLogin disabled | CIS L1 §5.2.10 / ENS op.acc.6 / NIS2 Art.21(2)(i) | CRITICAL |
| AUTH-002 | SSH PasswordAuthentication disabled | CIS L1 §5.2.14 / ENS op.acc.6 | HIGH |
| AUTH-004 | SSH PermitEmptyPasswords disabled | CIS L1 §5.2.11 / ENS op.acc.6 | CRITICAL |
| AUTH-007 | sudo without global NOPASSWD | CIS L1 §5.3.5 / ENS op.acc.4 / ISO 27001 A.8.5 | HIGH |
| AUTH-010 | No additional UID 0 accounts | CIS L1 §5.4.3 / ENS op.acc.4 | CRITICAL |
| KERN-001 | ASLR active (randomize_va_space=2) | CIS L1 §1.6.2 / NIS2 Art.21(2)(e) | HIGH |
| FILE-002 | /etc/shadow permissions 640 or stricter | CIS L1 §6.1.3 / ENS mp.si.2 | CRITICAL |
| FILE-005 | No world-writable files in critical paths | CIS L1 §6.1.9 / ISO 27001 A.8.3 | HIGH |
| SERV-001 | auditd active and enabled | CIS L1 §4.1.1 / ENS op.exp.8 / NIS2 Art.21(2)(a) | HIGH |
| SERV-004 | Telnet/rsh/rlogin disabled | CIS L1 §2.2.18 / ENS mp.com.1 | CRITICAL |
| SERV-006 | Host firewall active | CIS L1 §3.5.1 / ENS mp.com.2 / DORA Art.9 | CRITICAL |
| NET-001 | Firewall INPUT policy is DROP or REJECT | CIS L1 §3.6 / NIS2 Art.21(2)(e) | CRITICAL |
| WIN-007 | NTLM v1 disabled (LMCompatibilityLevel >= 3) | CIS WS Benchmark v2.0 §2.3.11.1 / ENS | CRITICAL |
| WIN-010 | SMBv1 disabled | CIS WS Benchmark v2.0 §18.3.3 / ENS mp.com.1 | CRITICAL |
| MACOS-001 | SIP (System Integrity Protection) active | CIS macOS Benchmark v3.0 §5.1.2 | CRITICAL |
| UPDT-001 | No pending security updates | CIS L1 / NIS2 Art.21(2)(e) / ISO 27001 A.8.8 | HIGH |

---

## Historial de versiones

| Versión | Cambios principales |
|---------|---------------------|
| v1.16 | README bilingüe (EN/ES) |
| v1.15 | ENS cotejado con CCN-STIC 808: medidas secundarias y refuerzos por check · perfiles ENS filtrados por exigencia de la categoría · +13 checks para medidas sin cobertura (SSH limitado/último acceso/inactividad, TMOUT, permisos de logs, copias, compiladores, Postfix, SmartScreen, Safari) → 272 checks |
| v1.14 | Mapeo ENS alineado con el Anexo II del RD 311/2022 (144 checks reasignados; fuera las medidas del RD 3/2010) · sin `SyntaxWarning` en Python 3.12+ · versión real en `--help` |
| v1.5 | +20 checks (faillock/login.defs/.rhosts/kptr/hardlinks/tmp/suid/cron/fail2ban/syslog/SMB signing/PS CLM/EventLog/AppLocker + macOS stealth/login/RAE) · ENS completo en 99 checks |
| v1.4 | Engagement params · Logo VS · Informe unificado VSL |
| v1.3 | Marcos cruzados NIS2/ISO27001/DORA — todos los checks |
| v1.2 | Windows Server 2019/2022 (WinRM + PowerShell) |
| v1.1 | macOS (Sonoma/Sequoia, Apple Silicon + Intel) |
| v1.0 | Linux (Debian/Ubuntu/RHEL/Rocky/Alpine/Arch) |

---

## Licencia

AGPL-3.0-only · © VampSecure Studios — VampSecure Labs Security Research Division

Para uso exclusivo en pruebas de penetración autorizadas. Úsalo solo
contra sistemas en los que tengas autorización explícita por escrito.
