Catalog 0.4 (70 computer checks: unique login, prohibited software, tamper protection on Mac/Linux), app 0.5.1
1e42c44 verified | # Devseis endpoint audit baseline | |
| # KEY=VALUE lines only. The collectors parse this file; they never execute it. | |
| # Lists are comma-separated. Name matching ignores case; "*" works as a wildcard. | |
| # --- Passwords ------------------------------------------------------------- | |
| PASSWORD_MIN_LENGTH=14 | |
| PASSWORD_HISTORY=24 | |
| # Passwords must expire within this many days. 0 = expiry not required (NIST SP 800-63B style). | |
| PASSWORD_MAX_AGE_DAYS=365 | |
| PASSWORD_MIN_AGE_DAYS=1 | |
| PASSWORD_COMPLEXITY=1 | |
| # --- Account lockout ------------------------------------------------------- | |
| LOCKOUT_THRESHOLD_MAX=5 | |
| LOCKOUT_DURATION_MIN_MINUTES=15 | |
| LOCKOUT_OBSERVATION_MIN_MINUTES=15 | |
| # --- Malware protection ---------------------------------------------------- | |
| SIGNATURE_MAX_AGE_DAYS=3 | |
| # Apple ships XProtect data less often than daily signature feeds. | |
| MACOS_XPROTECT_MAX_AGE_DAYS=30 | |
| # --- Firewall -------------------------------------------------------------- | |
| # Expected default outbound policy: allow | deny | |
| FIREWALL_OUTBOUND=allow | |
| # --- Screen lock ----------------------------------------------------------- | |
| # 300 seconds = 5 minutes | |
| SCREEN_LOCK_MAX_SECONDS=300 | |
| # --- USB storage (allow | deny) -------------------------------------------- | |
| # Whether USB mass storage devices may connect at all (deny = blocked completely). | |
| USB_DEVICE_ACCESS=allow | |
| USB_READ=allow | |
| USB_WRITE=deny | |
| # --- Administrators -------------------------------------------------------- | |
| # Accounts allowed to be administrators: user names, DOMAIN\name, or Windows SIDs. | |
| APPROVED_ADMINS=itadmin | |
| # Windows: a disabled built-in Administrator (RID 500) is not counted as unauthorized. | |
| ALLOW_DISABLED_BUILTIN_ADMIN=1 | |
| # --- Unique user login ------------------------------------------------------ | |
| # Account names that suggest a shared or generic login (exact match, any case). Each person should have their own account. | |
| SHARED_ACCOUNT_NAMES=admin,administrator,user,users,shared,office,staff,reception,frontdesk,test,temp,demo,student,kiosk,public,helpdesk,owner | |
| # --- Vulnerabilities ------------------------------------------------------- | |
| MAX_PENDING_SECURITY_UPDATES=0 | |
| MAX_OUTDATED_APPS=0 | |
| # Critical or high vulnerabilities allowed in installed software (offline OSV/NVD data) | |
| MAX_CRITICAL_HIGH_VULNERABILITIES=0 | |
| # Software that must not be installed: part of an installed app or package name, any case. Default: torrent clients | |
| # (any name containing "torrent": µTorrent, BitTorrent, qBittorrent…) and | |
| # Windows/Office activation cracks. Add your own (e.g. games, unlicensed tools). Licences cannot be checked from the device. | |
| PROHIBITED_SOFTWARE=Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit | |
| # --- GDPR technical controls ---------------------------------------------- | |
| UPDATES_MAX_AGE_DAYS=30 | |
| BACKUP_MAX_AGE_DAYS=7 | |
| # Remote access services that may be enabled: rdp, ssh, smb, winrm, vnc, screensharing, filesharing, remotemanagement | |
| APPROVED_REMOTE_SERVICES= | |
| # Lowest OS versions that still receive security updates. | |
| WINDOWS_MIN_BUILD=22631 | |
| MACOS_MIN_MAJOR=14 | |
| UBUNTU_MIN_VERSION=22.04 | |
| DEBIAN_MIN_VERSION=12 | |
| RHEL_MIN_VERSION=9 | |
| # Opt-in personal data discovery scan (0 = off). Not implemented in stage 1. | |
| PERSONAL_DATA_SCAN=0 | |
| # --- EU AI Act ------------------------------------------------------------- | |
| # AI tools allowed on endpoints, as named in the AI software inventory (e.g. Microsoft Copilot,ChatGPT). | |
| APPROVED_AI_TOOLS= | |
| # Phones (mobile web check) | |
| IOS_MIN_MAJOR=18 | |
| ANDROID_MIN_MAJOR=13 | |
| MOBILE_PATCH_MAX_AGE_DAYS=90 | |
| MOBILE_PASSCODE_MIN_DIGITS=6 | |