9j&dZddlmZddlZddlZddlZddlmZddlm Z m Z ej dZ da d!d Zd"d Zd ZdZd#dZd"dZd!dZd$dZd%dZd&dZdddd'dZddddd(d ZdS))u9Startup security posture audit (warn-on-load, never blocks). Surfaces dangerous host / deployment posture at process start so operators get an at-a-glance "you're exposed" signal. Motivated by the June 2026 MCP-config persistence campaign, where compromised boxes ran as root with an exposed dashboard / API server and no firewall — and nothing ever told the operator. These checks are advisory: they emit ``logger.warning`` records and return human-readable strings; they never raise or block startup. Checks (each is independent and fail-safe — any internal error is swallowed and simply yields no finding): 1. Running as root (POSIX uid 0). 2. SSH daemon present with password authentication enabled. 3. Running inside a container with no persistent volume mount over the HERMES_HOME data dir (state is ephemeral — lost on container restart). 4. A network-accessible gateway listener (dashboard / API server) with no authentication configured. Cross-platform: the root and SSH checks are POSIX-only and no-op on Windows. Everything is best-effort and read-only. ) annotationsNPath)AnyOptionalzhermes.security_auditFreturnboolcttddpttdd}|dS |dkS#t$rYdSwxYw)zCTrue when the process runs as POSIX uid 0. Always False on Windows.geteuidNgetuidFr)getattros Exception)r s G/home/rurouni/.hermes/hermes-agent/hermes_cli/security_audit_startup.py_is_rootr&se RD ) ) HWR4-H-HF ~uvxx1} uus A A A Optional[str]c(tsdS dS)Nu Running as ROOT. The agent's terminal/file tools execute with full root privileges — a single prompt-injection or exposed endpoint is a full host compromise. Run Hermes as an unprivileged user (or in a sandboxed terminal backend / container with a non-root user).)rr_running_as_rootr1s# ::t Hr)z/etc/ssh/sshd_configz/etc/ssh/sshd_config.d list[str]cg}dtD} tt}|r5|t |dn#t$rYnwxYw|D]} |dd D]B}| }|r*| ds| |Cp#t$rY|wxYw|S)zAYield non-comment lines from sshd_config + its drop-in directory.c,g|]}t|Srr).0ps r z+_iter_sshd_config_lines..Es===Qa===rz*.confutf-8replaceencodingerrors#) _SSHD_CONFIG_PATHSr_SSHD_CONFIG_DIRis_dirextendsortedglobr read_text splitlinesstrip startswithappend)linespathsdrrawstrippeds r_iter_sshd_config_linesr3Bs-E==*<===E ! " " 88:: 3 LLx 0 011 2 2 2       {{GI{FFQQSS + +99;;+H$7$7$<$<+LL*** +    H  Ls%AA33 B?BA,C55 DDct}|sdSd}d}|D]B}tjd|}|r)|d}d}C|dkrdS|rdnd }d |d S) a(Warn when an SSH daemon has password authentication enabled. Password auth on a public SSH daemon is the classic brute-force surface and pairs badly with a root-capable agent box. POSIX-only; returns None when there's no sshd config to read (e.g. Windows, or SSH not installed). NyesFz#(?i)^PasswordAuthentication\s+(\w+)Tnou$ (default — no explicit directive)z&SSH password authentication is ENABLEDz. Password auth is brute-forceable and dangerous on an internet-facing box. Set 'PasswordAuthentication no' in sshd_config and use key-based auth.)r3rematchgrouplower)r.verdict saw_directivelinem qualifiers r_ssh_password_auth_enabledrBWs $ % %E tGM!! H;T B B  !ggajj&&((G M$t#O)OI M M M Mrc2tjdrdStjdrdS t dddtfd d DrdSn#t$rYnwxYwdS) z@Best-effort container detection (Docker / Podman / generic OCI).z /.dockerenvTHERMES_DESKTOP_CHILD_PIDFz/proc/1/cgrouprrrc3 K|]}|vV dS)Nr)rtokcgroups r z _in_container..{s'WWsf}WWWWWWr)docker containerdkubepodslibpod) rpathexistsenvirongetrr)anyr)rGs@r _in_containerrRss w~~m$$t z~~011u &''11791UU WWWW(VWWW W W 4       5s?B BBrMrcV |}n#t$r|}YnwxYw tddd}n#t$rYdSwxYwd}d}|D]}|}t |dkr*|d |d }} t|} n#t$rYWwxYw| |ks | |jvr@|:t t| t t|kr| }|}|dS|d vS) a;True if *path* sits on (or under) a real mount point per /proc/mounts. Container overlay/root filesystems are ephemeral; a bind/volume mount over the data dir shows up as a distinct mount entry. We treat the path as persisted when a mountpoint at or above it is NOT the container root overlay. z /proc/mountsrrrTNr8r6)overlaytmpfsaufs) resolverrr)r*splitlenparentsstr) rMtargetmountsbest best_fstyper?parts mountpointfstypemps r_path_is_mountedrfsi n%%///SS^^`` tt DK % %  u::>> "1XuQxF  j!!BB    H  <<2//|s3r77||c#d))nn<<$  |t : ::s/ &&6A!! A/.A/3C CC hermes_homeOptional[Path]ctsdS|pIttjdtjd} t|rdSn#t$rYdSwxYwd|dS)N HERMES_HOMEz ~/.hermesz)Running in a container but the data dir (u) is NOT on a persistent volume mount — sessions, memory, skills, and API keys are ephemeral and lost on container restart. Mount a host volume over the HERMES_HOME data directory.) rRrrrOrPrM expanduserrfr)rghomes r_container_no_volume_mountrms ??t  $ }bg&8&8&E&EFFD D ! ! 4  tt &D & & &sA00 A>=A>configOptional[dict]cg} ddlm}n#t$r|cYSwxYw|pi} |dpi}t |t r|dnd}t |t r|dr|dpi}|dpt jd d }|d pt jd d }|t|r:t| s| d|dn#t$rYnwxYw|S)a,Warn about network-accessible gateway listeners with no auth. Covers the API server (no API_SERVER_KEY) and the dashboard (non-loopback bind with no auth provider). Read-only against config + env; overlaps the hard fail-closed guards but surfaces the posture proactively at startup. r)is_network_accessible platforms api_serverNenabledextrahostAPI_SERVER_HOSTz 127.0.0.1keyAPI_SERVER_KEYr8z4OpenAI-compatible API server is network-accessible (u) with NO API_SERVER_KEY. It dispatches terminal-capable agent work — an unauthenticated network endpoint is remote code execution. Set a strong API_SERVER_KEY.) gateway.platforms.baserqrrP isinstancedictrrOr]r+r-) rnfindingsrqcfgplatsapirurvrxs r_network_listener_without_authrsH@@@@@@@  ,BC %%+)3E4)@)@Jeii %%%d c4 SWWY%7%7 GGG$$*E99V$$V 7H+(V(VD))E""Jbjnn5Er&J&JC$$SYY// C8H8H >4>>>       Os EE## E0/E0rgrnchg}ttfD]4} |}|r||%#t$rY1wxYw t |}|r||n#t$rYnwxYw |t |n#t$rYnwxYw|S)zRun all checks and return a list of human-readable warning strings. Pure: no logging, no side effects. Each check is independently fail-safe. Used directly by tests; the logging wrapper is :func:`log_startup_security_warnings`. )rrBr-rrmr&r)rgrnr}checkrs rrun_security_auditrsH"   A #"""    H  &{ 3 3   OOA          6v>>????      Os3!6 AA&A.. A;:A;?"B"" B/.B/)rgrnforcerc>tr|sgSda t||}n#t$rgcYSwxYw|rhtdt |t |dD]/\}}td|t ||0|S)zRun the audit once per process and emit each finding via logger.warning. Returns the findings (also for tests). Never raises. Idempotent unless ``force=True`` (used by tests). TruDSecurity posture audit found %d issue(s) — review your deployment:r6z [security %d/%d] %s) _AUDIT_RANrrloggerwarningr[ enumerate)rgrnrr}ifs rlog_startup_security_warningsrs% J%+fMMM  I R MM   h** I IDAq NN2As8}}a H H H H Os ! 00)rr )rr)rr)rMrrr )rgrhrr)rnrorr)rgrhrnrorr)rgrhrnrorr rr)__doc__ __future__rloggingrr9pathlibrtypingrr getLoggerrrrrr#r$r3rBrRrfrmrrrrrrrs,#"""""   2 3 3 ,*8    #;#;#;#;L&!!!!J&*DF#'! r