Fleet Audit & Hardening Report // 2026.Q4

Security Posture // Hardened & Synchronized

Fleet Security Audit // Autumn 2026

Comprehensive security audit and perimeter remediation across all production and sandbox nodes. Hardened kernel firewalls, synchronized modern ACME ECC cipher suites, upgraded runtimes to PHP 8.5.12, and verified edge resistance against recent web exploits.

3/3 Nodes Audited

0 Critical Vulnerabilities

Node 01: diogenes.cyranix.net

PRIMARY // VERIFIED

Bare metal compute node running on a 64-core AMD EPYC 7713. Perimeter audit confirmed kernel-level packet inspection, zero public exposure of administrative ports, and active dynamic blackholing for abusive ingress.

Firewall Engine: nftables (stateful drop)

IPS Mitigation: fail2ban (dynamic sets)

HTTP Daemon: Apache 2.4.x (chrooted)

TLS Baseline: TLS 1.2 / 1.3 (AEAD only)

Ingress restricted to 80/443 and hardened SSH. PAM modules scrubbed of interactive desktop artifacts.

Node 02: epictetus.cyranix.net

COMMUNICATIONS // SECURED

Core communications and external mail hub (Postfix + Dovecot). Remediation centered on resolving ACME certificate synchronization, tuning cipher compatibility for external fetchers, and fixing IPv6 routing parity.

Certificate Sync: acme.sh ECC DV (ZeroSSL)

testssl A+

Dovecot POP3S / IMAPS: TLSv1.2 floor enforced (Google fetcher unblocked)

RESOLVED

IPv6 Gateway & NDP: Default route restored via fe80::1; NDP allowed in nftables

ROUTING OK

Intrusion Prevention: fail2ban 1.1.0 bootstrapped via ensurepip on Python 3.12

ACTIVE

POP3S retrieval and inbound SMTP handshakes confirmed operational across dual-stack IPv4/IPv6.

Node 03: chrysippus.cyranix.net

SANDBOX // LOCKED

Development and sandbox host. Initial audit showed an open ingress policy and globally bound database listeners. Applied an explicit nftables firewall, isolated internal services, compiled latest PHP from source, and hardened virtual host routing.

MariaDB Binding: Bound to 127.0.0.1:3306 (removed from 0.0.0.0)

CONTAINED

PHP Runtime: Upgraded 8.4.19 → 8.5.12 (ZTS + OPcache) from source

COMPILED

Apache Hardening: Default vhost /var/empty catch-all (403), -Indexes applied

SHIELDED

Reconnaissance Defense: expose_php = Off; Nmap verified all auxiliary ports filtered

VERIFIED

External reconnaissance scan confirmed all ports except 80, 443, and custom SSH (5578) report filtered.

Pentest Verification

Conducted manual attack simulation and port validation from workstation praetorian to verify edge filtering.

> NMAP SCAN REPORT:

22/tcp filtered (ssh default)

25/tcp filtered (smtp)

80/tcp open (http)

443/tcp open (https)

3306/tcp filtered (mysql)

5578/tcp open (custom ssh)

Latency: 0.12s // 0 rogue listeners

> Remediations Applied

CVE-2026-109618 PATCHED (PHP 8.5)

MariaDB Exposure BOUND 127.0.0.1

SSH Brute Forcing METERED & F2B

IPv6 NDP Deadlock ICMPv6 UNLOCKED

Directory Traversal -INDEXES ENFORCED

> Infrastructure Profile

Systems run bare-metal Slackware Linux installations without container abstraction, minimizing attack overhead and maintaining direct kernel configuration.

Distribution: Slackware64 -current