`gj&dZddlmZddlZddlZddlZddlmZddlm Z m Z ejdZ da ddZdd Zd Zd Zdd Zdd ZddZddZddZddZddd ddZdddd ddZy)u9Startup security posture audit (warn-on-load, never blocks). Surfaces dangerous host / deployment posture at process start so operators get an at-a-glance "you're exposed" signal. Motivated by the June 2026 MCP-config persistence campaign, where compromised boxes ran as root with an exposed dashboard / API server and no firewall — and nothing ever told the operator. These checks are advisory: they emit ``logger.warning`` records and return human-readable strings; they never raise or block startup. Checks (each is independent and fail-safe — any internal error is swallowed and simply yields no finding): 1. Running as root (POSIX uid 0). 2. SSH daemon present with password authentication enabled. 3. Running inside a container with no persistent volume mount over the HERMES_HOME data dir (state is ephemeral — lost on container restart). 4. A network-accessible gateway listener (dashboard / API server) with no authentication configured. Cross-platform: the root and SSH checks are POSIX-only and no-op on Windows. Everything is best-effort and read-only. ) annotationsN)Path)AnyOptionalzhermes.security_auditFcttddxsttdd}|y |dk(S#t$rYywxYw)zCTrue when the process runs as POSIX uid 0. Always False on Windows.geteuidNgetuidFr)getattros Exception)r s T/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/security_audit_startup.py_is_rootr&sI RD ) HWR4-HF ~x1} s 3 ??ctsy y)Nu Running as ROOT. The agent's terminal/file tools execute with full root privileges — a single prompt-injection or exposed endpoint is a full host compromise. Run Hermes as an unprivileged user (or in a sandboxed terminal backend / container with a non-root user).)rr _running_as_rootr1s : Hr)z/etc/ssh/sshd_configz/etc/ssh/sshd_config.dcg}tDcgc] }t|}} tt}|jr)|j t |j d|D]_} |jddjD]8}|j}|s|jdr(|j|:a|Scc}w#t$rYvwxYw#t$rYwxYw)zAYield non-comment lines from sshd_config + its drop-in directory.z*.confutf-8replaceencodingerrors#) _SSHD_CONFIG_PATHSr_SSHD_CONFIG_DIRis_dirextendsortedglobr read_text splitlinesstrip startswithappend)linesppathsdrawstrippeds r _iter_sshd_config_linesr+BsE*<=Qa=E= ! " 88: LLx 01 2 {{GI{FQQS +99;H$7$7$<LL* + L>       s5CAC.6C"%C"7C" CC" C.-C.ct}|syd}d}|D]<}tjd|}|s|jdj }d}>|dk(ry|rdnd }d |d S) a(Warn when an SSH daemon has password authentication enabled. Password auth on a public SSH daemon is the classic brute-force surface and pairs badly with a root-capable agent box. POSIX-only; returns None when there's no sshd config to read (e.g. Windows, or SSH not installed). NyesFz#(?i)^PasswordAuthentication\s+(\w+)Tnou$ (default — no explicit directive)z&SSH password authentication is ENABLEDz. Password auth is brute-forceable and dangerous on an internet-facing box. Set 'PasswordAuthentication no' in sshd_config and use key-based auth.)r+rematchgrouplower)r%verdict saw_directivelinem qualifiers r _ssh_password_auth_enabledr:Ws $ %E GM! HH;T B ggaj&&(G M ! $#)OI 0 z _in_container..{sWsf}Ws)docker containerdkubepodslibpod) r pathexistsenvirongetrr anyr )r@s@r _in_containerrKss~ ww~~m$ zz~~01 &'11791U W(VW W X     s0A66 BBc |j} tdjddj }d}d}|D]{}|j }t |dkr"|d |d }} t|} | |k(s| |jvsL|*t t| t t|kDsx| }|}}|y|d vS#t$r|}YwxYw#t$rYywxYw#t$rYwxYw) a;True if *path* sits on (or under) a real mount point per /proc/mounts. Container overlay/root filesystems are ephemeral; a bind/volume mount over the data dir shows up as a distinct mount entry. We treat the path as persisted when a mountpoint at or above it is NOT the container root overlay. z /proc/mountsrrrTNr0r.)overlaytmpfsaufs) resolver rr r!splitlenparentsstr) rFtargetmountsbest best_fstyper7parts mountpointfstypemps r _path_is_mountedr_sn%///S^^` DK %  u:> "1XuQxF  j!B <2/|s3r7|c#d)n<$  % | : ::3     s4C*C0 C( CC C%$C%( C43C4ctsy|xsFttjj dtj j d} t|ry d|dS#t$rYywxYw)N HERMES_HOMEz ~/.hermesz)Running in a container but the data dir (u) is NOT on a persistent volume mount — sessions, memory, skills, and API keys are ephemeral and lost on container restart. Mount a host volume over the HERMES_HOME data directory.) rKrr rHrIrF expanduserr_r ) hermes_homehomes r _container_no_volume_mountres} ?  $ }bgg&8&8&EFD D ! " 4D6:& & s A** A65A6cg} ddlm}|xsi} |jdxsi}t |t r|jdnd}t |t r|jdr|jdxsi}|jdxs t jjd d }|jd xs t jjd d }|t|r.t|js|jd|d|S#t$r|cYSwxYw#t$rY|SwxYw)a,Warn about network-accessible gateway listeners with no auth. Covers the API server (no API_SERVER_KEY) and the dashboard (non-loopback bind with no auth provider). Read-only against config + env; overlaps the hard fail-closed guards but surfaces the posture proactively at startup. r)is_network_accessible platforms api_serverNenabledextrahostAPI_SERVER_HOSTz 127.0.0.1keyAPI_SERVER_KEYr0z4OpenAI-compatible API server is network-accessible (u) with NO API_SERVER_KEY. It dispatches terminal-capable agent work — an unauthenticated network endpoint is remote code execution. Set a strong API_SERVER_KEY.) gateway.platforms.basergr rI isinstancedictr rHrVr"r$) configfindingsrgcfgplatsapirkrlrns r _network_listener_without_authrxs'H@ ,BC %+)3E4)@eii %d c4 SWWY%7GGG$*E99V$V 7H+(VD))E"Jbjjnn5Er&JC$SY/C8HJ4&Q>> O/ (   O s#D&DD7& D43D47 EErcrsc2g}ttfD]} |}|r|j| t |}|r|j| |j t ||S#t$rYgwxYw#t$rY7wxYw#t$rY|SwxYw)zRun all checks and return a list of human-readable warning strings. Pure: no logging, no side effects. Each check is independently fail-safe. Used directly by tests; the logging wrapper is :func:`log_startup_security_warnings`. )rr:r$r rerrx)rcrsrtcheckrs r run_security_auditr}sH"  A"  &{ 3 OOA  6v>? O          O s4A+A:B + A76A7: BB BB)rcrsforcectr|sgSda t||}|rTtj dt |t |dD]&\}}tj d|t ||(|S#t$rgcYSwxYw)zRun the audit once per process and emit each finding via logger.warning. Returns the findings (also for tests). Never raises. Idempotent unless ``force=True`` (used by tests). TryuDSecurity posture audit found %d issue(s) — review your deployment:r.z [security %d/%d] %s) _AUDIT_RANr}r loggerwarningrT enumerate)rcrsr~rtifs r log_startup_security_warningsrs% J%+fM R M h* IDAq NN2As8}a H I O  s A33 BB)returnbool)r Optional[str])r list[str])rFrrr)rcOptional[Path]rr)rsOptional[dict]rr)rcrrsrrr)rcrrsrr~rrr)__doc__ __future__rloggingr r1pathlibrtypingrr getLoggerrrrrrrr+r:rKr_rerxr}rrrr rs,#    2 3 ,*8 #;L&!J&*D"3AF#'!      r