kastelldev/kastell

v1.12.0 — Lock Advanced + Audit Explain

Deep lock hardening (19 steps, 413 audit checks) with audit --explain inline explanations.

Added

• audit --explain — Inline "Why:" + fix explanation for each failing check in CLI and MCP
• Lock: auditd CIS L2 rules — Deep audit rules (time-change, network-change, kernel-module) in 50-kastell-deep.rules
• Lock: sysctl deep tuning — 21 kernel hardening settings (dmesg_restrict, kptr_restrict, bpf_jit_harden, rp_filter, ASLR)
• Lock: pwquality — CIS L1 password policy (minlen=14, complexity classes), non-fatal with graceful skip
• Lock: SSH cipher blacklist — Weak ciphers/MACs/KEX removed with sshd -t validation and automatic rollback
• Lock: Docker runtime hardening — daemon.json merge with platform-aware guards and reload-not-restart
• Lock 19-step hardening — Expanded from 16 to 19 steps
• Audit 413 checks — 4 new checks (BPF JIT, audit time/network/module rules)

Fixed

• jq injection prevention (stdin pipe instead of shell interpolation)
• SSH sed tab pattern for cipher/MAC/KEX directives

Install

npm install -g [email protected]
# or
npx [email protected]

Full changelog: https://github.com/kastelldev/kastell/blob/main/CHANGELOG.md