<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Endpoint Compliance Assessment

## Windows — Security Policy Export

```powershell
secedit /export /cfg C:\Temp\secpol.cfg
auditpol /get /category:*
Get-NetFirewallProfile | Select-Object Name, Enabled
Get-BitLockerVolume | Select-Object MountPoint, ProtectionStatus
```

## Linux — Configuration Audit

```bash
# SSH config
grep -E "^(PermitRootLogin|PasswordAuthentication)" /etc/ssh/sshd_config

# File permissions
stat -c '%a %n' /etc/passwd /etc/shadow /etc/group

# Lynis scan
lynis audit system --quick
```

## CIS Benchmark References

| ID | Check |
|---|---|
| CIS 5.2.10 | SSH PermitRootLogin = no |
| CIS 5.2.12 | SSH PasswordAuthentication = no |
| CIS 6.1.2 | /etc/passwd permissions 0644 |
| CIS 6.1.3 | /etc/shadow permissions 0640 |

## Agent Script

```bash
node agent.js check-ssh --config /etc/ssh/sshd_config
node agent.js check-permissions --paths /etc/passwd /etc/shadow
node agent.js report --hostname server01 --results checks.json
```
