<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Hardening Linux with CIS Benchmarks

## System Commands

| Command | Description |
|---|---|
| `sshd -T` | Dump effective SSH configuration |
| `sysctl -a` | List all kernel parameters |
| `sysctl -p /etc/sysctl.d/99-cis.conf` | Apply sysctl config |
| `auditpol /get /category:*` | Check audit policy (Windows) |
| `stat -c '%a %n' /etc/shadow` | Check file permissions |
| `ss -tlnp` | List listening TCP services |
| `systemctl list-unit-files --state=enabled` | List enabled services |
| `find / -perm -4000 -type f` | Find SUID binaries |
| `faillock --user <name>` | Check PAM lockout status |

## Ansible CIS Audit

```bash
# Dry-run audit
ansible-playbook --check -l target ansible-cis-ubuntu-2204/site.yml

# Apply remediation
ansible-playbook -l target ansible-cis-ubuntu-2204/site.yml

# Audit specific section
ansible-playbook --check -l target site.yml --tags ssh_hardening
```

## Agent Script

```bash
# List available checks
node agent.js list

# Run single check
node agent.js check ssh_root_login

# Run full audit
node agent.js audit

# Find SUID binaries
node agent.js find-suid
```
