healthcheck

CrawClaw Host Hardening

Assess the host running CrawClaw, then propose a hardening plan that matches the user's risk tolerance without breaking access.

Rules

• Require explicit approval before any state-changing action.
• Do not change firewall, SSH, RDP, or package state without confirmation.
• Prefer reversible, staged changes with a rollback plan.
• Never imply CrawClaw itself manages host firewall or OS updates.
• Use numbered choices whenever the user needs to pick from options.

Workflow

1. Ask once for permission to run read-only checks.
2. Establish context:
3. OS and version
4. privilege level
5. local vs remote access path
6. exposure level
7. CrawClaw gateway status and bind
8. backup, disk encryption, and update posture
9. Run CrawClaw checks:
10. crawclaw security audit --deep
11. crawclaw update status
12. Ask the user to pick a risk posture:
13. Home/workstation balanced
14. VPS hardened
15. Developer convenience
16. Custom
17. Produce a remediation plan with current posture, gaps, exact commands, rollback, and lockout risks.
18. Only execute after explicit approval.
19. Re-run audits and summarize deferred items.

Scheduling

After any audit or hardening pass, explicitly offer periodic checks. If the user agrees, schedule stable named jobs such as:

• healthcheck:security-audit
• healthcheck:update-status

Do not create or edit cron jobs without approval.