# Check password policy
cat /etc/login.defs | grep -E "PASS_MAX_DAYS|PASS_MIN_LEN"

# Check SSH configuration
grep -E "PermitRootLogin|PasswordAuthentication|PubkeyAuthentication" /etc/ssh/sshd_config

# Check sudo configuration
visudo -c

# Check account lockout policy
grep -E "faillock|pam_faillock" /etc/security/faillock.conf

# Check sensitive file permissions
stat -c "%a %U %G %n" /etc/shadow /etc/passwd /etc/gshadow /etc/group

# Check SUID/SGID binaries
find / -perm /6000 -type f 2>/dev/null

# Check sticky bits on tmp directories
ls -ld /tmp /var/tmp /dev/shm

# Check firewall rules
ufw status verbose

# Check encryption protocol versions
openssl ciphers -v 'ALL' | grep -E "SSLv|TLSv1\.0|TLSv1\.1"

# Check listening ports
ss -tulnp

import requests

def analyze_compliance(check_results, standard="cis"):
    """Send compliance check results to LLM for analysis"""
    
    prompt = f"""You are a professional security compliance auditor. Please analyze the following check results against the {standard} standard.

## Check Results Summary
{check_results}

## Analysis Requirements
1. List all non-compliant items
2. Categorize by risk level (High/Medium/Low)
3. Provide specific fix commands for each violation
4. Assess overall compliance rate
5. Identify the Top 3 issues that need priority attention

Please output in a structured format."""

    response = requests.post("http://localhost:11434/api/generate", json={
        "model": "llama3",
        "prompt": prompt,
        "stream": False
    })
    
    return response.json()

#!/bin/bash
# AI-generated security remediation script - 2026-07-13
# Source: CIS Ubuntu 24.04 Benchmark Automated Remediation

set -euo pipefail

echo "=== Starting AI-Driven Compliance Remediation ==="
echo "Time: $(date)"

# 1. Harden SSH configuration
echo "[1/5] Hardening SSH configuration..."
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#X11Forwarding.*/X11Forwarding no/' /etc/ssh/sshd_config
sed -i 's/^#MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config
systemctl reload sshd
echo "✅ SSH hardening complete"

# 2. Configure password policy
echo "[2/5] Configuring password policy..."
cat > /etc/security/pwquality.conf << 'EOF'
minlen = 14
minclass = 3
maxrepeat = 3
reject_username
EOF
echo "[PASS_MAX_DAYS]	90" >> /etc/login.defs
echo "[PASS_MIN_LEN]	14" >> /etc/login.defs
echo "✅ Password policy configured"

# 3. Fix file permissions
echo "[3/5] Repairing file permissions..."
chmod 640 /etc/shadow
chmod 644 /etc/passwd
chmod 640 /etc/gshadow
chmod 644 /etc/group
chmod 1777 /tmp /var/tmp
find / -perm /6000 -type f -exec chmod a-s {} \; 2>/dev/null || true
echo "✅ File permissions repaired"

# 4. Configure firewall
echo "[4/5] Configuring UFW firewall..."
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment 'SSH'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw --force enable
echo "✅ Firewall configured"

# 5. Enable audit logging
echo "[5/5] Configuring audit logging..."
apt-get install -y auditd audispd-plugins
systemctl enable --now auditd
echo "✅ Audit logging enabled"

echo ""
echo "=== Remediation Complete ==="
echo "Run 'compliance-check.sh' to verify fixes"

# crontab -e
# Daily compliance check at 2 AM
0 2 * * * /opt/compliance/check.sh --report-to /var/log/compliance/daily/
# Weekly report on Sundays
0 3 * * 0 /opt/compliance/weekly-report.sh
# Trigger immediately after major changes
inotifywait -m /etc/ -e modify,create,delete | while read; do
    /opt/compliance/check.sh --incremental
done

def evaluate_change_impact(old_config, new_config, standard):
    """Evaluate the compliance impact of configuration changes"""
    
    prompt = f"""Compare the following two configuration sets and assess the impact on {standard} compliance:

## Before Change
{old_config}

## After Change
{new_config}

Please answer:
1. What new compliance risks does this change introduce?
2. Does it resolve any existing compliance issues?
3. Are additional remediation measures needed?
4. Has the risk level changed (escalated/decreased/unchanged)?"""
    
    analysis = llm.generate(prompt)
    return parse_analysis(analysis)

# 1. Install dependencies
apt update && apt install -y python3 python3-pip ansible curl

# 2. Install Ollama (local LLM runtime)
curl -fsSL https://ollama.com/install.sh | sh

# 3. Pull compliance-specific models
ollama pull llama3
ollama pull mxbai-embed-large  # For vector similarity matching

# 4. Clone the compliance audit project
git clone https://github.com/example/vps-compliance-ai.git
cd vps-compliance-ai
pip3 install -r requirements.txt

# config.yaml
audit:
  schedule: "daily"
  standards:
    - cis-ubuntu-24.04
    - pci-dss-4.0
    - iso27001
  
llm:
  endpoint: "http://localhost:11434"
  model: "llama3"
  temperature: 0.1         # Low temperature for consistency
  
remediation:
  auto_apply: false        # Don't auto-apply by default
  require_approval: true   # Require human approval
  dry_run: true            # Dry run first
  
notification:
  channels:
    - type: webhook
      url: "https://hooks.example.com/compliance"
    - type: email
      recipients: ["admin@example.com"]
  severity_threshold: "medium"

# Full compliance check
./compliance-audit.sh --full --standards cis,pci-dss

# Sample output:
# ╔══════════════════════════════════════════╗
# ║       VPS Compliance Audit Report         ║
# ║       2026-07-13 02:00:00 UTC             ║
# ╠══════════════════════════════════════════╣
# ║ Overall Compliance: 73.2%                 ║
# ║ High Risk: 3                              ║
# ║ Medium Risk: 7                            ║
# ║ Low Risk: 12                              ║
# ╚══════════════════════════════════════════╝
#
# 🔴 High Risk:
#   1. SSH Root login not disabled
#   2. File permission /etc/shadow too open (644)
#   3. UFW firewall not enabled
#
# 🟡 Medium Risk:
#   1. Minimum password length insufficient (14 chars)
#   2. Missing SUID binary inventory
#   ...

# Use Ansible Galaxy roles for compliance management
ansible-galaxy install company.cis-benchmark
ansible-galaxy install company.pci-dss-controls

# Manage changes via GitOps
git add /etc/ansible/playbooks/
git commit -m "compliance: harden SSH per CIS 3.5.1"
git push origin main
# → Triggers CI pipeline → Auto-deploys to target VPS

# Audit event template
audit_event = {
    "timestamp": datetime.utcnow().isoformat(),
    "actor": "ai-compliance-agent",
    "action": "remediation",
    "target": "/etc/ssh/sshd_config",
    "change": {
        "before": "PermitRootLogin yes",
        "after": "PermitRootLogin no"
    },
    "standard": "cis-ubuntu-24.04",
    "control_id": "5.2.5",
    "risk_level": "high",
    "approved_by": "auto",
    "rollback_command": "sed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config"
}