claude-bot
5130b82639
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (pull_request) Successful in 2s
The script that sets the SSH, PAM, pwquality and auditd baseline on twelve containers existed only as a root-owned copy on the machines it hardens. Bring it into the repo so a change reaches one place instead of twelve. Two substantive changes over the copy that shipped on 2026-07-24: - Deny forwarding per option instead of via DisableForwarding. Same effect, but DisableForwarding overrides every other forwarding option and is invisible in sshd -T, which makes a rejected port-forward read as a configuration that should work. - Quote the command substitution in MODDIR (SC2046). The header and README now record the rollout command, the containers left unhardened as break-glass foundation, and why host-specific exceptions must live in a drop-in that sorts after 99-cis-hardening.conf.