<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Compliance Evidence Collection — API Reference

## CIS Benchmark Categories

| Section | Category | Key Controls |
|---------|----------|-------------|
| 1.x | Initial Setup | Filesystem config, updates, mandatory access control |
| 2.x | Services | inetd, special purpose services, service clients |
| 3.x | Network Config | Network parameters, IPv6, firewall, wireless |
| 4.x | Logging & Auditing | auditd configuration, log collection |
| 5.x | Access & Auth | SSH, PAM, password policy, su restriction |
| 6.x | System Maintenance | File permissions, user/group settings |

## Evidence Collection Commands

```bash
# SSH configuration
sshd -T 2>/dev/null | grep -E 'permitrootlogin|passwordauthentication|x11forwarding|maxauthtries'

# File permissions
stat -c '%a %U %G %n' /etc/passwd /etc/shadow /etc/group /etc/crontab

# Sysctl parameters
sysctl net.ipv4.ip_forward net.ipv4.conf.all.accept_redirects net.ipv4.tcp_syncookies

# Audit rules
auditctl -l

# Password policy
grep -E '^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_WARN_AGE' /etc/login.defs

# Users with UID 0
awk -F: '$3 == 0 {print $1}' /etc/passwd

# World-writable files
find / -xdev -type f -perm -0002 -ls 2>/dev/null

# SUID/SGID files
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null

# Unowned files
find / -xdev -nouser -o -nogroup 2>/dev/null

# Listening services
ss -tulnp

# Installed packages
dpkg -l 2>/dev/null || rpm -qa 2>/dev/null

# Firewall rules
iptables -L -n -v 2>/dev/null
nft list ruleset 2>/dev/null
```

## NIST 800-53 Control Families

| Family | ID | Description |
|--------|----|-------------|
| Access Control | AC | Account management, access enforcement |
| Audit | AU | Audit events, content, storage |
| Config Mgmt | CM | Baseline config, change control |
| Identification | IA | Authentication, credential management |
| Incident Response | IR | Incident handling, reporting |
| System Protection | SC | Transmission confidentiality, boundary |
| System Integrity | SI | Flaw remediation, malicious code |

## Ansible Compliance Collection

```yaml
- name: Collect CIS evidence
  hosts: all
  become: true
  tasks:
    - name: Get SSH config
      command: sshd -T
      register: sshd_config

    - name: Get file permissions
      stat:
        path: "{{ item }}"
      loop:
        - /etc/passwd
        - /etc/shadow
        - /etc/group
      register: file_perms

    - name: Save evidence
      copy:
        content: "{{ {'sshd': sshd_config.stdout, 'perms': file_perms.results} | to_json }}"
        dest: "/tmp/evidence/{{ inventory_hostname }}.json"
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All checks compliant |
| 1 | Non-compliant findings detected |
| 2 | Collection error or insufficient permissions |
