<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Configuration Management — API Reference

## Ansible Hardening Playbook

```yaml
- name: CIS Ubuntu 22.04 Hardening
  hosts: all
  become: true
  tasks:
    - name: Disable SSH root login
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin no'
      notify: restart sshd

    - name: Ensure auditd is running
      systemd:
        name: auditd
        state: started
        enabled: true
```

## OpenSCAP CLI

```bash
# Scan with CIS profile
oscap xccdf eval --profile cis_level1_server \
  --results results.xml --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

# Generate fix script
oscap xccdf generate fix --profile cis_level1_server \
  --output remediate.sh results.xml
```

## AWS Systems Manager

```python
import boto3

ssm = boto3.client("ssm")

# Run command across fleet
ssm.send_command(
    Targets=[{"Key": "tag:Environment", "Values": ["production"]}],
    DocumentName="AWS-RunShellScript",
    Parameters={"commands": ["grep PermitRootLogin /etc/ssh/sshd_config"]},
)
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All checks passed — baseline compliant |
| 1 | Configuration drift detected |
| 2 | Scan execution failure |
