Whoever downvoted you probably doesn’t understand what you’re saying. This package doesn’t stipulate as to what regulations, frameworks, standards etc it is checking compliance against.

If it doesn’t say what it’s checking it’s compliant against, how can it determine if you’re compliant to it or not?

ISO 27001? SOC2? CIS Benchmarks? HIPAA? GDPR? NIST CSF? 800-53? PCI DSS? Cyber Essentials? Vendor guidance?

This seems, at best, some general security checks but not mapped to any framework in particular.

The Linux Security Audit Project is far more mature in this regard and maps checks to specific frameworks.

[–] melezhik@programming.dev 1 points 2 weeks ago* (last edited 2 weeks ago) (3 children)

This seems, at best, some general security checks but not mapped to any framework in particular.

So. Yes. Ssh access should be passwords only, etc. Some common sense. We don’t need standard to that

UPDATE: sorry for the typo, meant passwordless

[–] vk6flab@lemmy.radio 1 points 2 weeks ago (2 children)

Ssh access should be passwords only

What are you basing this on?

[–] melezhik@programming.dev 1 points 2 weeks ago

Typo )) sorry , meant password less

load more comments (1 replies)

load more comments (3 replies)