this post was submitted on 09 Jul 2026
17 points (90.5% liked)

Linux

14906 readers
408 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
 

Some times ago I posted about scc tool, here is a short update with some example reports provided. https://dev.to/melezhik/linux-compliance-checks-with-sparrow-plugin-2160

People can use the plugin to check if their Linux configuration files are security compliant

Sparrow is a Raku automation framework

you are viewing a single comment's thread
view the rest of the comments
[–] vk6flab@lemmy.radio 17 points 1 month ago (7 children)

Compliant with what?

"Security compliant" is a completely meaningless phrase, right up there with "locked door" or "secret code".

[–] fartsparkles@lemmy.world 13 points 1 month ago (6 children)

Whoever downvoted you probably doesn’t understand what you’re saying. This package doesn’t stipulate as to what regulations, frameworks, standards etc it is checking compliance against.

If it doesn’t say what it’s checking it’s compliant against, how can it determine if you’re compliant to it or not?

ISO 27001? SOC2? CIS Benchmarks? HIPAA? GDPR? NIST CSF? 800-53? PCI DSS? Cyber Essentials? Vendor guidance?

This seems, at best, some general security checks but not mapped to any framework in particular.

The Linux Security Audit Project is far more mature in this regard and maps checks to specific frameworks.

[–] melezhik@programming.dev 1 points 1 month ago* (last edited 1 month ago) (1 children)

This seems, at best, some general security checks but not mapped to any framework in particular.

So. Yes. Ssh access should be passwords only, etc. Some common sense. We don’t need standard to that

UPDATE: sorry for the typo, meant passwordless

[–] vk6flab@lemmy.radio 1 points 1 month ago (2 children)

Ssh access should be passwords only

What are you basing this on?

[–] fartsparkles@lemmy.world 4 points 1 month ago

Definitely not NIST 800-53, PCI-DSS, or ISO 27001; all of which stipulate ssh key management not password-based authentication.

[–] melezhik@programming.dev 1 points 1 month ago

Typo )) sorry , meant password less

load more comments (4 replies)
load more comments (4 replies)