<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing Post-Ransomware Security Hardening — API Reference

## Lynis Hardening Audit

```bash
# Full system audit
lynis audit system

# Quick audit
lynis audit system --quick

# Show only warnings and suggestions
lynis audit system --quiet | grep -E "Suggestion|Warning"

# Specific test category
lynis audit system --tests-from-group "authentication ssh"
```

## Credential Management

```bash
# Force password change for user
chage -d 0 <username>

# Check password expiry policy
chage -l <username>

# Lock an account
usermod -L <username>

# List all users with login shells
getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1, $7}'
```

## auditd Configuration

```bash
# Load new audit rules
augenrules --load

# Check current rules
auditctl -l

# Search audit logs for persistence changes
ausearch -k cron_change --start today
ausearch -k ssh_keys --start today
ausearch -k systemd_change --start today
```

## sysctl Hardening

```bash
# Apply all sysctl settings
sysctl --system

# Verify specific setting
sysctl net.ipv4.tcp_syncookies

# List all current settings
sysctl -a 2>/dev/null | grep -E "accept_redirect|source_route|syncookies"
```

## Service Hardening

```bash
# List enabled services
systemctl list-unit-files --state=enabled --type=service

# Disable unnecessary service
systemctl disable --now <service>

# Check listening ports
ss -tlnp | grep LISTEN
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `task` | Hardening task ID | `credential_reset` |
| `priority` | Task priority (1-5) | `1` (highest) |
| `audit_profile` | Lynis audit profile | `default` |
| `check_type` | Persistence check type | `cron`, `ssh`, `systemd` |
