raspberry_security_audit.py

#!/usr/bin/env python3
"""
Raspberry Pi Security Audit Script v1.0.0-PI - Multi-Framework Edition
COMPREHENSIVE security audit tool for Raspberry Pi OS

✓ 35+ Categories, 150+ Security Checks
  - 136 standard Linux checks (SSH, firewall, users, files, kernel, etc.)
  - 15+ Raspberry Pi-specific checks (default user, GPIO, VNC, Wi-Fi, etc.)
✓ Multi-Framework Compliance: CIS, NIST 800-53, DISA STIG, NSA, CISA, DoD
✓ 95%+ Automated Remediation with Interactive Fix Application
✓ Raspberry Pi Hardware Detection (auto-skips Pi checks on non-Pi systems)
✓ IoT Security Focus (wireless, remote access, interfaces)
✓ Framework Filtering & Per-Framework Compliance Scoring
✓ Professional Reports: Text, HTML, JSON, CSV

Raspberry Pi-Specific Features:
- Auto-detects Raspberry Pi hardware and model
- Checks default 'pi' user security (CAT I critical)
- GPIO/I2C/SPI/Camera interface security
- Wi-Fi/Bluetooth/VNC security (CAT I critical)
- Boot configuration hardening
- Serial console security
- Firmware update checks
- SD card optimizations

Supported Systems:
- Raspberry Pi 5, 4, 3, 2, Zero 2 W (all models)
- Raspberry Pi OS (32-bit and 64-bit)
- Debian-based distributions on Raspberry Pi

Framework Coverage:
- CIS Benchmark (42 scored + unscored checks)
- NIST 800-53 (40+ control mappings)
- DISA STIG (42+ finding IDs, CAT I/II/III - adapted for Pi)
- NSA Hardening Guide (41+ requirements)
- CISA Best Practices (33+ priority checks)
- Raspberry Pi Security Best Practices (15+ Pi-specific)

For: Raspberry Pi OS (Bookworm, Bullseye), compatible with all Pi models
Version: 1.0.0-PI
License: MIT
Based on: linux_security_audit.py (https://github.com/Sandler73/Linux-Security-Audit-and-Remediation-Script)
"""

import os
import sys
import subprocess
import pwd
import grp
import re
from datetime import datetime
from pathlib import Path
import json
import tempfile
import shutil
import time
import argparse
from io import StringIO
import csv

VERSION = "1.0.0-PI"

# ============================================================================
# COMPREHENSIVE MULTI-FRAMEWORK COMPLIANCE MAPPING
# Every check mapped to: CIS ID, NIST controls, DISA STIG ID, NSA flag, CISA flag, STIG category
# ============================================================================

FRAMEWORK_MAP = {
    # ========== FILE PERMISSIONS (CIS 6.1.x, NIST AC-6, STIG CAT I/II) ==========
    "/etc/passwd permissions": {
        "cis": "6.1.2", "nist": ["AC-6", "CM-6"], "stig": "RHEL-07-020010", 
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/shadow permissions": {
        "cis": "6.1.3", "nist": ["AC-6", "MP-2"], "stig": "RHEL-07-020020",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "/etc/group permissions": {
        "cis": "6.1.4", "nist": ["AC-6"], "stig": "RHEL-07-020030",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/gshadow permissions": {
        "cis": "6.1.5", "nist": ["AC-6"], "stig": "RHEL-07-020040",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/ssh/sshd_config permissions": {
        "cis": "5.2.1", "nist": ["AC-6", "CM-6"], "stig": "RHEL-07-040420",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/passwd- permissions": {
        "cis": "6.1.6", "nist": ["AC-6"], "stig": "RHEL-07-020010",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/shadow- permissions": {
        "cis": "6.1.7", "nist": ["AC-6"], "stig": "RHEL-07-020020",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/etc/group- permissions": {
        "cis": "6.1.8", "nist": ["AC-6"], "stig": "RHEL-07-020030",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== USER ACCOUNTS - CRITICAL (CIS 6.2.x, NIST IA-x, STIG CAT I) ==========
    "Empty Password Accounts": {
        "cis": "6.2.1", "nist": ["IA-5"], "stig": "RHEL-07-010290",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "UID 0 Accounts": {
        "cis": "6.2.5", "nist": ["AC-6", "IA-2"], "stig": "RHEL-07-020310",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Max Days": {
        "cis": "5.4.1.1", "nist": ["IA-5"], "stig": "RHEL-07-010250",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Min Days": {
        "cis": "5.4.1.2", "nist": ["IA-5"], "stig": "RHEL-07-010260",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Warn Age": {
        "cis": "5.4.1.3", "nist": ["IA-5"], "stig": "RHEL-07-010270",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "Inactive Password Lock": {
        "cis": "5.4.1.4", "nist": ["IA-5"], "stig": "RHEL-07-010310",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Default UMASK": {
        "cis": "5.4.4", "nist": ["AC-6"], "stig": "RHEL-07-020240",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Root PATH Integrity": {
        "cis": "6.2.6", "nist": ["CM-6"], "stig": "RHEL-07-020720",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== SSH CONFIGURATION - CRITICAL (CIS 5.2.x, STIG CAT I/II) ==========
    "SSH Protocol": {
        "cis": "5.2.1", "nist": ["SC-8"], "stig": "RHEL-07-040390",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "SSH LogLevel": {
        "cis": "5.2.2", "nist": ["AU-3", "AU-12"], "stig": "RHEL-07-040460",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "SSH X11Forwarding": {
        "cis": "5.2.3", "nist": ["CM-7"], "stig": "RHEL-07-040710",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH MaxAuthTries": {
        "cis": "5.2.4", "nist": ["AC-7"], "stig": "RHEL-07-010430",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH IgnoreRhosts": {
        "cis": "5.2.5", "nist": ["AC-17", "CM-6"], "stig": "RHEL-07-040660",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH HostbasedAuthentication": {
        "cis": "5.2.6", "nist": ["IA-2", "AC-17"], "stig": "RHEL-07-010470",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH PermitRootLogin": {
        "cis": "5.2.7", "nist": ["AC-6", "IA-2"], "stig": "RHEL-07-040370",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "SSH PermitEmptyPasswords": {
        "cis": "5.2.8", "nist": ["IA-5"], "stig": "RHEL-07-010290",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "SSH PermitUserEnvironment": {
        "cis": "5.2.9", "nist": ["CM-6"], "stig": "RHEL-07-010460",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH Ciphers": {
        "cis": "5.2.11", "nist": ["SC-8", "SC-13"], "stig": "RHEL-07-040110",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH MACs": {
        "cis": "5.2.12", "nist": ["SC-8", "SC-13"], "stig": "RHEL-07-040400",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH KexAlgorithms": {
        "cis": "5.2.13", "nist": ["SC-8", "SC-13"], "stig": "RHEL-07-040440",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH ClientAliveInterval": {
        "cis": "5.2.14", "nist": ["AC-11", "SC-10"], "stig": "RHEL-07-040320",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH LoginGraceTime": {
        "cis": "5.2.15", "nist": ["AC-12"], "stig": "RHEL-07-040340",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "SSH Banner": {
        "cis": "5.2.16", "nist": ["AC-8"], "stig": "RHEL-07-040170",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== FIREWALL - CRITICAL (CIS 3.5.x, NIST SC-7, STIG CAT I) ==========
    "UFW Status": {
        "cis": "3.5.1.1", "nist": ["SC-7"], "stig": "RHEL-07-040520",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "UFW Enabled": {
        "cis": "3.5.1.2", "nist": ["SC-7", "AC-4"], "stig": "RHEL-07-040520",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "UFW Default Deny": {
        "cis": "3.5.1.7", "nist": ["SC-7"], "stig": "RHEL-07-040520",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    
    # ========== KERNEL PARAMETERS (CIS 3.x, NIST SC-x, STIG CAT II) ==========
    "IP Forwarding": {
        "cis": "3.1.1", "nist": ["SC-7", "CM-6"], "stig": "RHEL-07-040740",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Send Packet Redirects": {
        "cis": "3.1.2", "nist": ["SC-7"], "stig": "RHEL-07-040660",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "ICMP Redirects": {
        "cis": "3.2.2", "nist": ["SC-7"], "stig": "RHEL-07-040641",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Secure ICMP Redirects": {
        "cis": "3.2.3", "nist": ["SC-7"], "stig": "RHEL-07-040630",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Log Suspicious Packets": {
        "cis": "3.2.4", "nist": ["AU-12", "SI-4"], "stig": "RHEL-07-040680",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "Ignore Broadcast Requests": {
        "cis": "3.2.5", "nist": ["SC-5"], "stig": "RHEL-07-040630",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "TCP SYN Cookies": {
        "cis": "3.2.8", "nist": ["SC-5"], "stig": "RHEL-07-040820",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "IPv6 Router Advertisements": {
        "cis": "3.2.9", "nist": ["CM-7"], "stig": "RHEL-07-040830",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Randomize VA Space": {
        "cis": "1.5.1", "nist": ["SI-16"], "stig": "RHEL-07-040201",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== FILESYSTEM (CIS 1.1.x, NIST CM-6, STIG CAT II) ==========
    "/tmp nodev": {
        "cis": "1.1.3", "nist": ["CM-6"], "stig": "RHEL-07-021020",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/tmp nosuid": {
        "cis": "1.1.4", "nist": ["CM-6"], "stig": "RHEL-07-021030",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/tmp noexec": {
        "cis": "1.1.5", "nist": ["CM-6"], "stig": "RHEL-07-021040",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/tmp Mount Options": {
        "cis": "1.1.3-5", "nist": ["CM-6"], "stig": "RHEL-07-021020",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/tmp Sticky Bit": {
        "cis": "1.1.21", "nist": ["AC-6"], "stig": "RHEL-07-021030",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Separate /home Partition": {
        "cis": "1.1.14", "nist": ["CM-6"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": True
    },
    "Separate /var Partition": {
        "cis": "1.1.10", "nist": ["CM-6"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": True
    },
    
    # ========== LOGGING & AUDITING (CIS 4.x, NIST AU-x, STIG CAT II) ==========
    "auditd Installation": {
        "cis": "4.1.1.1", "nist": ["AU-2", "AU-12"], "stig": "RHEL-07-030000",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 2, "scored": True
    },
    "auditd Service Enabled": {
        "cis": "4.1.1.2", "nist": ["AU-12"], "stig": "RHEL-07-030010",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 2, "scored": True
    },
    "auditd Service Running": {
        "cis": "4.1.1.3", "nist": ["AU-12"], "stig": "RHEL-07-030010",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 2, "scored": True
    },
    "rsyslog Service": {
        "cis": "4.2.1.1", "nist": ["AU-4", "AU-9"], "stig": "RHEL-07-031000",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "rsyslog Enabled": {
        "cis": "4.2.1.2", "nist": ["AU-4"], "stig": "RHEL-07-031010",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== SYSTEM HARDENING (CIS 1.x, NIST AC-6/SI-x, STIG CAT II) ==========
    "AppArmor Status": {
        "cis": "1.6.1.1", "nist": ["AC-6", "CM-6"], "stig": "RHEL-07-020210",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "AppArmor Enabled": {
        "cis": "1.6.1.2", "nist": ["AC-6"], "stig": "RHEL-07-020220",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Core Dumps Restricted": {
        "cis": "1.5.1", "nist": ["SI-11"], "stig": "RHEL-07-010480",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "SUID Core Dumps": {
        "cis": "1.5.1", "nist": ["SI-11"], "stig": "RHEL-07-010480",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "AIDE Installed": {
        "cis": "1.3.1", "nist": ["CM-3", "CM-6", "SI-7"], "stig": "RHEL-07-020030",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "AIDE Initialized": {
        "cis": "1.3.2", "nist": ["SI-7"], "stig": "RHEL-07-020040",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== NETWORK HARDENING (CIS 3.x, NIST SC-7, STIG CAT III) ==========
    "TCP Wrappers Installed": {
        "cis": "3.4.1", "nist": ["SC-7"], "stig": "RHEL-07-040810",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "/etc/hosts.allow configured": {
        "cis": "3.4.2", "nist": ["SC-7"], "stig": "RHEL-07-040810",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "/etc/hosts.deny configured": {
        "cis": "3.4.3", "nist": ["SC-7"], "stig": "RHEL-07-040810",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    
    # ========== CRON & ACCESS CONTROL (CIS 5.1.x, NIST AC-6, STIG CAT II/III) ==========
    "Cron Daemon Enabled": {
        "cis": "5.1.1", "nist": ["CM-6"], "stig": "RHEL-07-021100",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "Cron Access Control": {
        "cis": "5.1.8", "nist": ["AC-6", "CM-6"], "stig": "RHEL-07-021110",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== BOOTLOADER (CIS 1.4.x, NIST AC-3, STIG CAT II) ==========
    "GRUB Password Protection": {
        "cis": "1.4.2", "nist": ["AC-3"], "stig": "RHEL-07-010480",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "/boot/grub/grub.cfg permissions": {
        "cis": "1.4.1", "nist": ["AC-6"], "stig": "RHEL-07-010480",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== SYSTEM MAINTENANCE (CIS 1.x/6.x, NIST SI-2, STIG CAT II) ==========
    "Available System Updates": {
        "cis": "1.9", "nist": ["SI-2"], "stig": "RHEL-07-020260",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": False
    },
    "Automatic Security Updates": {
        "cis": "1.9", "nist": ["SI-2"], "stig": "RHEL-07-020260",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "World Writable Files": {
        "cis": "6.1.10", "nist": ["AC-6"], "stig": "RHEL-07-020270",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Unowned Files": {
        "cis": "6.1.11", "nist": ["AC-6"], "stig": "RHEL-07-020280",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Ungrouped Files": {
        "cis": "6.1.12", "nist": ["AC-6"], "stig": "RHEL-07-020290",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "SUID System Executables": {
        "cis": "6.1.13", "nist": ["CM-6"], "stig": "RHEL-07-020240",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": False
    },
    "SGID System Executables": {
        "cis": "6.1.14", "nist": ["CM-6"], "stig": "RHEL-07-020250",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": False
    },
    
    # ========== SUDO CONFIGURATION (CIS 5.3.x, NIST AU-3/CM-6, STIG CAT III) ==========
    "Sudo Log File": {
        "cis": "5.3.3", "nist": ["AU-3"], "stig": "RHEL-07-030670",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "Sudo use_pty": {
        "cis": "5.3.2", "nist": ["CM-6"], "stig": "RHEL-07-030680",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    
    # ========== BANNERS (CIS 1.7.x, NIST AC-8, STIG CAT III) ==========
    "/etc/issue": {
        "cis": "1.7.1.1", "nist": ["AC-8"], "stig": "RHEL-07-010030",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    "/etc/issue.net": {
        "cis": "1.7.1.2", "nist": ["AC-8"], "stig": "RHEL-07-010040",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 1, "scored": True
    },
    
    # ========== EXTENDED AUDIT - PASSWORD COMPLEXITY (CIS 5.3.1, NIST IA-5(1), STIG CAT II) ==========
    "Password Minimum Length": {
        "cis": "5.3.1", "nist": ["IA-5(1)"], "stig": "RHEL-07-010280",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Complexity - Digits": {
        "cis": "5.3.1", "nist": ["IA-5(1)"], "stig": "RHEL-07-010170",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Complexity - Uppercase": {
        "cis": "5.3.1", "nist": ["IA-5(1)"], "stig": "RHEL-07-010180",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Complexity - Lowercase": {
        "cis": "5.3.1", "nist": ["IA-5(1)"], "stig": "RHEL-07-010190",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Password Complexity - Special": {
        "cis": "5.3.1", "nist": ["IA-5(1)"], "stig": "RHEL-07-010200",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== EXTENDED AUDIT - ACCOUNT LOCKOUT (CIS 5.3.2, NIST AC-7, STIG CAT II) ==========
    "Account Lockout - Deny": {
        "cis": "5.3.2", "nist": ["AC-7"], "stig": "RHEL-07-010320",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Account Lockout - Unlock Time": {
        "cis": "5.3.2", "nist": ["AC-7"], "stig": "RHEL-07-010320",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== EXTENDED AUDIT - TIME SYNC (CIS 2.2.1.1, NIST AU-8, STIG CAT II) ==========
    "Time Synchronization Service": {
        "cis": "2.2.1.1", "nist": ["AU-8"], "stig": "RHEL-07-040500",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Time Synchronization Running": {
        "cis": "2.2.1.2", "nist": ["AU-8"], "stig": "RHEL-07-040500",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== EXTENDED AUDIT - USB/HARDWARE (NIST MP-7, STIG CAT II) ==========
    "USB Storage Disabled": {
        "cis": "N/A", "nist": ["MP-7"], "stig": "RHEL-07-021700",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== EXTENDED AUDIT - SSH KEYS (CIS 5.2.x, NIST SC-13, STIG CAT II) ==========
    "SSH Private Key Permissions": {
        "cis": "N/A", "nist": ["SC-13"], "stig": "RHEL-07-040270",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SSH authorized_keys Permissions": {
        "cis": "N/A", "nist": ["SC-13"], "stig": "RHEL-07-040280",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== HOME DIRECTORY SECURITY (CIS 6.2.x, NIST AC-6, STIG CAT II) ==========
    "Home Directory Permissions": {
        "cis": "6.2.7", "nist": ["AC-6"], "stig": "RHEL-07-020630",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Home Directory Ownership": {
        "cis": "6.2.8", "nist": ["AC-6"], "stig": "RHEL-07-020640",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    ".forward Files": {
        "cis": "6.2.10", "nist": ["CM-6"], "stig": "RHEL-07-020710",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    ".netrc Files": {
        "cis": "6.2.11", "nist": ["CM-6"], "stig": "RHEL-07-020700",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    ".rhosts Files": {
        "cis": "6.2.12", "nist": ["CM-6"], "stig": "RHEL-07-020690",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    
    # ========== RASPBERRY PI SPECIFIC CHECKS ==========
    "Default Pi User Security": {
        "cis": "5.4.2", "nist": ["IA-5", "AC-6"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "Pi Boot Config Permissions": {
        "cis": "1.4.1", "nist": ["AC-6"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "Pi Boot Cmdline Permissions": {
        "cis": "1.4.1", "nist": ["AC-6"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT II", "level": 1, "scored": True
    },
    "GPIO Permissions": {
        "cis": "N/A", "nist": ["AC-6"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "Camera Interface Security": {
        "cis": "N/A", "nist": ["AC-6", "CM-7"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "I2C Interface Security": {
        "cis": "N/A", "nist": ["CM-7"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "SPI Interface Security": {
        "cis": "N/A", "nist": ["CM-7"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "Serial Console Security": {
        "cis": "N/A", "nist": ["AC-17"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "Wi-Fi Security Configuration": {
        "cis": "N/A", "nist": ["SC-8", "SC-13"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "Bluetooth Security": {
        "cis": "N/A", "nist": ["CM-7", "AC-18"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "VNC Server Security": {
        "cis": "N/A", "nist": ["SC-8", "IA-5", "AC-17"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT I", "level": 1, "scored": True
    },
    "Avahi/mDNS Service": {
        "cis": "2.2.x", "nist": ["CM-7"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "Default Hostname Changed": {
        "cis": "N/A", "nist": ["IA-4"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
    "Raspberry Pi Firmware Updates": {
        "cis": "1.9", "nist": ["SI-2"], "stig": "N/A",
        "nsa": True, "cisa": True, "cat": "CAT II", "level": 1, "scored": True
    },
    "SD Card Security": {
        "cis": "N/A", "nist": ["MP-2"], "stig": "N/A",
        "nsa": True, "cisa": False, "cat": "CAT III", "level": 2, "scored": False
    },
}

def get_framework_info(check_name):
    """Get comprehensive framework information for a check"""
    return FRAMEWORK_MAP.get(check_name, {
        "cis": "N/A", "nist": [], "stig": "N/A", 
        "nsa": False, "cisa": False, "cat": "CAT III",
        "level": 1, "scored": False
    })

def format_framework_ids(info):
    """Format framework IDs for display"""
    ids = []
    if info["cis"] != "N/A":
        ids.append(f"CIS {info['cis']}")
    if info["nist"]:
        nist_str = ','.join(info['nist'])
        ids.append(f"NIST {nist_str}")
    if info["stig"] != "N/A":
        ids.append(f"STIG {info['stig']}")
    if info["nsa"]:
        ids.append("NSA ✓")
    if info["cisa"]:
        ids.append("CISA ✓")
    return " | ".join(ids) if ids else "N/A"

class SecurityAudit:
    def __init__(self):
        self.results = []
        self.timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
        self.timestamp_file = datetime.now().strftime("%Y%m%d_%H%M%S")
        self.hostname = subprocess.run(['hostname'], capture_output=True, text=True).stdout.strip()
        self.is_root = os.geteuid() == 0
        self.filter_args = None
        
    def check_root(self):
        """Verify script is running with appropriate privileges"""
        if not self.is_root:
            print("WARNING: This script should be run as root for complete results.")
            print("Some checks will be skipped without root privileges.\n")
            return False
        return True
    
    def add_result(self, category, check_name, status, current_value, expected_value, 
                   recommendation, severity="Medium", fix_commands=None, special_fix_data=None):
        """Add a check result with comprehensive multi-framework information"""
        info = get_framework_info(check_name)
        
        self.results.append({
            'Category': category,
            'Check': check_name,
            'CIS_ID': info["cis"],
            'NIST_Controls': info["nist"],
            'STIG_ID': info["stig"],
            'NSA': info["nsa"],
            'CISA': info["cisa"],
            'STIG_Cat': info["cat"],
            'CIS_Level': info["level"],
            'CIS_Scored': 'Scored' if info["scored"] else 'Not Scored',
            'Status': status,
            'Current Value': str(current_value),
            'Expected Value': str(expected_value),
            'Recommendation': recommendation,
            'Severity': severity,
            'FrameworkIDs': format_framework_ids(info),
            'FixCommands': fix_commands or [],
            'SpecialFixData': special_fix_data
        })
    
    def run_command(self, command, shell=False):
        """Execute a system command and return output"""
        try:
            if isinstance(command, str) and not shell:
                command = command.split()
            result = subprocess.run(command, capture_output=True, text=True, shell=shell, timeout=10)
            return result.stdout.strip(), result.returncode
        except subprocess.TimeoutExpired:
            return "", -1
        except Exception as e:
            return str(e), -1
    
    def file_exists(self, filepath):
        """Check if file exists"""
        return os.path.exists(filepath)
    
    def get_file_permissions(self, filepath):
        """Get file permissions in octal format (last 3 digits only)"""
        try:
            return oct(os.stat(filepath).st_mode)[-3:]
        except:
            return None
    
    def fix_tmp_mount_options(self, missing_opts):
        """Fix /tmp mount options - called during interactive remediation"""
        print(f"   Applying fix for /tmp mount options...")
        
        # Determine which approach to use
        fstab_check, _ = self.run_command("grep -E '^[^#].*[[:space:]]/tmp[[:space:]]' /etc/fstab", shell=True)
        systemd_check, _ = self.run_command("systemctl status tmp.mount 2>/dev/null", shell=True)
        
        if 'tmp.mount' in systemd_check:
            # Use systemd approach
            print(f"   Detected systemd-managed /tmp, creating override...")
            
            try:
                # Create directory
                os.makedirs('/etc/systemd/system/tmp.mount.d', exist_ok=True)
                
                # Write configuration file
                config_file = '/etc/systemd/system/tmp.mount.d/options.conf'
                with open(config_file, 'w') as f:
                    f.write('[Mount]\n')
                    f.write('Options=mode=1777,strictatime,nodev,nosuid,noexec\n')
                
                print(f"   Created {config_file}")
                
                # Reload systemd
                print(f"   Reloading systemd...")
                _, rc = self.run_command("systemctl daemon-reload")
                if rc != 0:
                    print(f"   ⚠ Warning: systemctl daemon-reload returned {rc}")
                    return False
                
                # Restart tmp.mount
                print(f"   Restarting tmp.mount...")
                _, rc = self.run_command("systemctl restart tmp.mount")
                if rc != 0:
                    print(f"   ⚠ Warning: systemctl restart tmp.mount returned {rc}")
                    return False
                
                # Verify
                output, _ = self.run_command("mount | grep '/tmp'")
                if all(opt in output for opt in ['nodev', 'nosuid', 'noexec']):
                    print(f"   ✓ All mount options applied successfully")
                    return True
                else:
                    print(f"   ⚠ Warning: Some options may not have been applied")
                    print(f"   Current mount: {output}")
                    return False
                    
            except Exception as e:
                print(f"   ✗ Error: {e}")
                return False
                
        elif fstab_check:
            # Manual edit required for fstab
            print(f"   /tmp is configured in /etc/fstab")
            print(f"   Current line: {fstab_check}")
            print(f"   ")
            print(f"   MANUAL ACTION REQUIRED:")
            print(f"   1. Edit /etc/fstab: sudo nano /etc/fstab")
            print(f"   2. Find the /tmp line and add: nodev,nosuid,noexec to options")
            print(f"   3. Save and run: sudo mount -o remount /tmp")
            print(f"   ")
            return False  # Manual action required
            
        else:
            # No existing /tmp mount, add to fstab
            print(f"   No existing /tmp mount found, adding to /etc/fstab...")
            
            try:
                # Backup fstab
                import shutil
                from datetime import datetime
                backup_file = f"/etc/fstab.backup.{datetime.now().strftime('%Y%m%d_%H%M%S')}"
                shutil.copy2('/etc/fstab', backup_file)
                print(f"   Backed up /etc/fstab to {backup_file}")
                
                # Add tmpfs entry
                with open('/etc/fstab', 'a') as f:
                    f.write('\n# Secure /tmp mount added by security audit\n')
                    f.write('tmpfs /tmp tmpfs defaults,nodev,nosuid,noexec,mode=1777 0 0\n')
                
                print(f"   Added tmpfs entry to /etc/fstab")
                
                # Remount
                print(f"   Remounting /tmp...")
                _, rc = self.run_command("mount -o remount /tmp")
                if rc != 0:
                    print(f"   ⚠ Warning: Remount may have failed, try: sudo mount -a")
                    return False
                
                # Verify
                output, _ = self.run_command("mount | grep '/tmp'")
                if all(opt in output for opt in ['nodev', 'nosuid', 'noexec']):
                    print(f"   ✓ All mount options applied successfully")
                    return True
                else:
                    print(f"   ⚠ Warning: Options may require reboot to take effect")
                    return False
                    
            except Exception as e:
                print(f"   ✗ Error: {e}")
                return False
    
    def get_file_permissions_full(self, filepath):
        """Get full file permissions in octal format (including sticky/setuid/setgid bits)"""
        try:
            return oct(os.stat(filepath).st_mode)[-4:]
        except:
            return None
    
    def get_file_owner(self, filepath):
        """Get file owner"""
        try:
            stat_info = os.stat(filepath)
            return pwd.getpwuid(stat_info.st_uid).pw_name
        except:
            return None
    
    def get_file_group(self, filepath):
        """Get file group"""
        try:
            stat_info = os.stat(filepath)
            return grp.getgrgid(stat_info.st_gid).gr_name
        except:
            return None
    
    # ============================================================================
    # CATEGORY 1: FILE PERMISSIONS AND OWNERSHIP
    # ============================================================================
    
    def check_file_permissions(self):
        """Check permissions on critical system files"""
        category = "File Permissions"
        
        critical_files = {
            '/etc/passwd': {'perms': '644', 'owner': 'root', 'group': 'root'},
            '/etc/shadow': {'perms': '640', 'owner': 'root', 'group': 'shadow'},
            '/etc/group': {'perms': '644', 'owner': 'root', 'group': 'root'},
            '/etc/gshadow': {'perms': '640', 'owner': 'root', 'group': 'shadow'},
            '/etc/ssh/sshd_config': {'perms': '600', 'owner': 'root', 'group': 'root'},
            '/boot/grub/grub.cfg': {'perms': '600', 'owner': 'root', 'group': 'root'},
        }
        
        for filepath, expected in critical_files.items():
            if not self.file_exists(filepath):
                self.add_result(category, f"File Exists: {filepath}", "INFO", 
                               "Not Found", "Should Exist", 
                               f"File {filepath} not found on this system", "Low")
                continue
            
            # Check permissions
            current_perms = self.get_file_permissions(filepath)
            if current_perms != expected['perms']:
                self.add_result(category, f"Permissions: {filepath}", "FAIL",
                               current_perms, expected['perms'],
                               f"chmod {expected['perms']} {filepath}", "High",
                               fix_commands=[f"chmod {expected['perms']} {filepath}"])
            else:
                self.add_result(category, f"Permissions: {filepath}", "PASS",
                               current_perms, expected['perms'], "No action needed", "High")
            
            # Check ownership
            current_owner = self.get_file_owner(filepath)
            if current_owner != expected['owner']:
                self.add_result(category, f"Owner: {filepath}", "FAIL",
                               current_owner, expected['owner'],
                               f"chown {expected['owner']} {filepath}", "High",
                               fix_commands=[f"chown {expected['owner']} {filepath}"])
            else:
                self.add_result(category, f"Owner: {filepath}", "PASS",
                               current_owner, expected['owner'], "No action needed", "High")
            
            # Check group
            current_group = self.get_file_group(filepath)
            if current_group != expected['group']:
                self.add_result(category, f"Group: {filepath}", "FAIL",
                               current_group, expected['group'],
                               f"chgrp {expected['group']} {filepath}", "High",
                               fix_commands=[f"chgrp {expected['group']} {filepath}"])
            else:
                self.add_result(category, f"Group: {filepath}", "PASS",
                               current_group, expected['group'], "No action needed", "High")
    
    # ============================================================================
    # CATEGORY 2: USER ACCOUNTS AND PASSWORD POLICIES
    # ============================================================================
    
    def check_user_accounts(self):
        """Check user account configurations"""
        category = "User Accounts"
        
        # Check for users with UID 0 (should only be root)
        output, _ = self.run_command("awk -F: '($3 == 0) {print $1}' /etc/passwd", shell=True)
        uid_zero_users = output.split('\n') if output else []
        if len(uid_zero_users) > 1 or (len(uid_zero_users) == 1 and uid_zero_users[0] != 'root'):
            self.add_result(category, "UID 0 Accounts", "FAIL",
                           ', '.join(uid_zero_users), "root only",
                           "Remove UID 0 from non-root accounts", "Critical")
        else:
            self.add_result(category, "UID 0 Accounts", "PASS",
                           "root only", "root only", "No action needed", "Critical")
        
        # Check for accounts with empty passwords
        if self.is_root:
            output, _ = self.run_command("awk -F: '($2 == \"\") {print $1}' /etc/shadow", shell=True)
            empty_pass_users = [u for u in output.split('\n') if u]
            if empty_pass_users:
                fix_cmds = [f"passwd -l {user}" for user in empty_pass_users]
                self.add_result(category, "Empty Password Accounts", "FAIL",
                               ', '.join(empty_pass_users), "None",
                               "Lock or set passwords for these accounts", "Critical",
                               fix_commands=fix_cmds)
            else:
                self.add_result(category, "Empty Password Accounts", "PASS",
                               "None found", "None", "No action needed", "Critical")
        
        # Check password aging in login.defs
        if self.file_exists('/etc/login.defs'):
            output, _ = self.run_command("grep '^PASS_MAX_DAYS' /etc/login.defs", shell=True)
            if output:
                max_days = output.split()[-1]
                if int(max_days) > 90:
                    self.add_result(category, "Password Max Age", "FAIL",
                                   max_days, "90 or less",
                                   "Edit /etc/login.defs and set PASS_MAX_DAYS to 90", "Medium",
                                   fix_commands=["sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   90/' /etc/login.defs"])
                else:
                    self.add_result(category, "Password Max Age", "PASS",
                                   max_days, "90 or less", "No action needed", "Medium")
            
            output, _ = self.run_command("grep '^PASS_MIN_DAYS' /etc/login.defs", shell=True)
            if output:
                min_days = output.split()[-1]
                if int(min_days) < 1:
                    self.add_result(category, "Password Min Age", "FAIL",
                                   min_days, "1 or more",
                                   "Edit /etc/login.defs and set PASS_MIN_DAYS to 1", "Medium",
                                   fix_commands=["sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS   1/' /etc/login.defs"])
                else:
                    self.add_result(category, "Password Min Age", "PASS",
                                   min_days, "1 or more", "No action needed", "Medium")
            
            # Check UMASK
            output, _ = self.run_command("grep '^UMASK' /etc/login.defs", shell=True)
            if output:
                umask = output.split()[-1]
                if umask != '027':
                    self.add_result(category, "Default UMASK", "FAIL",
                                   umask, "027",
                                   "Set UMASK to 027 in /etc/login.defs", "Medium",
                                   fix_commands=["sed -i 's/^UMASK.*/UMASK           027/' /etc/login.defs"])
                else:
                    self.add_result(category, "Default UMASK", "PASS",
                                   umask, "027", "No action needed", "Medium")
    
    # ============================================================================
    # CATEGORY 3: SSH CONFIGURATION
    # ============================================================================
    
    def check_ssh_config(self):
        """Check SSH daemon configuration"""
        category = "SSH Configuration"
        ssh_config = "/etc/ssh/sshd_config"
        
        if not self.file_exists(ssh_config):
            self.add_result(category, "SSH Config File", "INFO",
                           "Not Found", "Should Exist",
                           "SSH server may not be installed", "Low")
            return
        
        ssh_checks = {
            'PermitRootLogin': {'expected': 'no', 'severity': 'Critical'},
            'PasswordAuthentication': {'expected': 'no', 'severity': 'High'},
            'PermitEmptyPasswords': {'expected': 'no', 'severity': 'Critical'},
            'X11Forwarding': {'expected': 'no', 'severity': 'Medium'},
            'MaxAuthTries': {'expected': '4', 'severity': 'Medium'},
            'Protocol': {'expected': '2', 'severity': 'High'},
        }
        
        for setting, config in ssh_checks.items():
            # Try to find the setting (uncommented)
            output, _ = self.run_command(f"grep -E '^{setting}' {ssh_config}", shell=True)
            
            if not output:
                # Setting not found - use sed to add it at the end
                fix_cmds = [
                    f"sed -i '$ a\\{setting} {config['expected']}' {ssh_config}",
                    "systemctl restart sshd"
                ]
                self.add_result(category, f"SSH {setting}", "FAIL",
                               "Not explicitly set (using default)",
                               config['expected'],
                               f"Add '{setting} {config['expected']}' to {ssh_config}",
                               config['severity'],
                               fix_commands=fix_cmds)
            else:
                current_value = output.split()[-1].lower()
                expected_value = config['expected'].lower()
                
                if current_value == expected_value:
                    self.add_result(category, f"SSH {setting}", "PASS",
                                   current_value, expected_value,
                                   "No action needed", config['severity'])
                else:
                    fix_cmd = f"sed -i 's/^{setting}.*/{setting} {config['expected']}/' {ssh_config}"
                    self.add_result(category, f"SSH {setting}", "FAIL",
                                   current_value, expected_value,
                                   f"Change {setting} to {config['expected']} in {ssh_config}",
                                   config['severity'],
                                   fix_commands=[fix_cmd, "systemctl restart sshd"])
    
    # ============================================================================
    # CATEGORY 4: FIREWALL CONFIGURATION
    # ============================================================================
    
    def check_firewall(self):
        """Check firewall configuration"""
        category = "Firewall"
        
        # Check if UFW is installed and active
        output, returncode = self.run_command("which ufw")
        if returncode == 0:
            output, _ = self.run_command("ufw status")
            if "Status: active" in output:
                self.add_result(category, "UFW Status", "PASS",
                               "Active", "Active",
                               "No action needed", "High")
            else:
                self.add_result(category, "UFW Status", "FAIL",
                               "Inactive", "Active",
                               "Enable UFW: sudo ufw enable", "High",
                               fix_commands=["ufw --force enable"])
        else:
            # Check iptables
            output, returncode = self.run_command("iptables -L -n")
            if returncode == 0:
                rules_count = len([l for l in output.split('\n') if l and not l.startswith('Chain') and not l.startswith('target')])
                if rules_count > 0:
                    self.add_result(category, "Firewall (iptables)", "PASS",
                                   f"{rules_count} rules configured", "Rules present",
                                   "Review iptables rules for correctness", "High")
                else:
                    self.add_result(category, "Firewall (iptables)", "FAIL",
                                   "No rules configured", "Rules should be configured",
                                   "Configure iptables or install UFW", "High",
                                   fix_commands=["apt-get install -y ufw", "ufw --force enable"])
    
    # ============================================================================
    # CATEGORY 5: KERNEL PARAMETERS (sysctl)
    # ============================================================================
    
    def check_kernel_parameters(self):
        """Check kernel security parameters"""
        category = "Kernel Parameters"
        
        sysctl_checks = {
            'net.ipv4.conf.all.send_redirects': {'expected': '0', 'desc': 'Disable ICMP redirects'},
            'net.ipv4.conf.default.send_redirects': {'expected': '0', 'desc': 'Disable ICMP redirects (default)'},
            'net.ipv4.conf.all.accept_redirects': {'expected': '0', 'desc': 'Disable accept ICMP redirects'},
            'net.ipv4.conf.default.accept_redirects': {'expected': '0', 'desc': 'Disable accept ICMP redirects (default)'},
            'net.ipv4.conf.all.secure_redirects': {'expected': '0', 'desc': 'Disable secure ICMP redirects'},
            'net.ipv4.conf.default.secure_redirects': {'expected': '0', 'desc': 'Disable secure ICMP redirects (default)'},
            'net.ipv4.ip_forward': {'expected': '0', 'desc': 'Disable IP forwarding'},
            'net.ipv4.conf.all.log_martians': {'expected': '1', 'desc': 'Log martian packets'},
            'net.ipv4.conf.default.log_martians': {'expected': '1', 'desc': 'Log martian packets (default)'},
            'net.ipv4.icmp_echo_ignore_broadcasts': {'expected': '1', 'desc': 'Ignore ICMP echo broadcasts'},
            'net.ipv4.icmp_ignore_bogus_error_responses': {'expected': '1', 'desc': 'Ignore bogus ICMP errors'},
            'net.ipv4.conf.all.rp_filter': {'expected': '1', 'desc': 'Enable reverse path filtering'},
            'net.ipv4.conf.default.rp_filter': {'expected': '1', 'desc': 'Enable reverse path filtering (default)'},
            'net.ipv4.tcp_syncookies': {'expected': '1', 'desc': 'Enable TCP SYN cookies'},
            'kernel.randomize_va_space': {'expected': '2', 'desc': 'Enable ASLR'},
            'kernel.dmesg_restrict': {'expected': '1', 'desc': 'Restrict dmesg access'},
            'kernel.kptr_restrict': {'expected': '2', 'desc': 'Hide kernel pointers'},
        }
        
        for param, config in sysctl_checks.items():
            output, returncode = self.run_command(f"sysctl {param}")
            if returncode == 0:
                current_value = output.split('=')[-1].strip()
                expected = config['expected']
                
                if current_value == expected:
                    self.add_result(category, f"sysctl: {param}", "PASS",
                                   current_value, expected,
                                   "No action needed", "Medium")
                else:
                    fix_cmds = [
                        f"sysctl -w {param}={expected}",
                        f"echo '{param} = {expected}' >> /etc/sysctl.d/99-security.conf"
                    ]
                    self.add_result(category, f"sysctl: {param}", "FAIL",
                                   current_value, expected,
                                   f"Set {param} = {expected} in /etc/sysctl.conf or /etc/sysctl.d/",
                                   "Medium",
                                   fix_commands=fix_cmds)
            else:
                self.add_result(category, f"sysctl: {param}", "INFO",
                               "Unable to check", expected,
                               "Parameter may not be available on this system", "Low")
    
    # ============================================================================
    # CATEGORY 6: AUDIT SYSTEM (auditd)
    # ============================================================================
    
    def check_auditd(self):
        """Check audit daemon configuration"""
        category = "Audit System"
        
        # Check if auditd is installed
        output, returncode = self.run_command("which auditd")
        if returncode != 0:
            self.add_result(category, "Auditd Installation", "FAIL",
                           "Not Installed", "Installed",
                           "Install auditd package: apt-get install auditd", "Medium",
                           fix_commands=["apt-get install -y auditd audispd-plugins"])
            return
        
        # Check if auditd is enabled
        output, returncode = self.run_command("systemctl is-enabled auditd")
        if returncode == 0 and "enabled" in output:
            self.add_result(category, "Auditd Enabled", "PASS",
                           "Enabled", "Enabled",
                           "No action needed", "Medium")
        else:
            self.add_result(category, "Auditd Enabled", "FAIL",
                           "Not Enabled", "Enabled",
                           "Enable auditd: systemctl enable auditd", "Medium",
                           fix_commands=["systemctl enable auditd"])
        
        # Check if auditd is running
        output, returncode = self.run_command("systemctl is-active auditd")
        if returncode == 0 and "active" in output:
            self.add_result(category, "Auditd Running", "PASS",
                           "Running", "Running",
                           "No action needed", "Medium")
        else:
            self.add_result(category, "Auditd Running", "FAIL",
                           "Not Running", "Running",
                           "Start auditd: systemctl start auditd", "Medium",
                           fix_commands=["systemctl start auditd"])
    
    # ============================================================================
    # CATEGORY 7: FILESYSTEM CONFIGURATION
    # ============================================================================
    
    def check_filesystem(self):
        """Check filesystem mount options"""
        category = "Filesystem Configuration"
        
        # Get mount information
        output, _ = self.run_command("mount")
        
        # Check for nodev, nosuid, noexec on /tmp
        if '/tmp' in output:
            tmp_line = [line for line in output.split('\n') if ' /tmp ' in line]
            if tmp_line:
                mount_opts = tmp_line[0]
                checks = {
                    'nodev': 'nodev' in mount_opts,
                    'nosuid': 'nosuid' in mount_opts,
                    'noexec': 'noexec' in mount_opts
                }
                
                missing_opts = [opt for opt, present in checks.items() if not present]
                
                if not missing_opts:
                    # All options are set
                    self.add_result(category, "/tmp Mount Options", "PASS",
                                   "nodev,nosuid,noexec all set", "All three options required",
                                   "No action needed", "Medium")
                else:
                    # Some options are missing - use special fix handler
                    present_opts = [opt for opt, present in checks.items() if present]
                    current_status = f"Present: {','.join(present_opts) if present_opts else 'none'}; Missing: {','.join(missing_opts)}"
                    
                    self.add_result(category, "/tmp Mount Options", "FAIL",
                                   current_status,
                                   "nodev,nosuid,noexec",
                                   f"Add missing mount options: {','.join(missing_opts)}", "Medium",
                                   fix_commands=['SPECIAL:fix_tmp_mount_options'],
                                   special_fix_data={'missing_opts': missing_opts})
        
        # Check for sticky bit on /tmp
        if self.file_exists('/tmp'):
            perms = self.get_file_permissions_full('/tmp')
            # Sticky bit is set if first digit is 1 (1xxx permissions)
            if perms and len(perms) == 4 and perms[0] == '1':
                self.add_result(category, "/tmp Sticky Bit", "PASS",
                               "Set (permissions: {})".format(perms), "Set",
                               "No action needed", "Medium")
            else:
                current = perms if perms else "Unable to determine"
                self.add_result(category, "/tmp Sticky Bit", "FAIL",
                               "Not Set (permissions: {})".format(current), "Set (1777)",
                               "Set sticky bit on /tmp", "Medium",
                               fix_commands=["chmod 1777 /tmp"])
        
        # Check if /home is on separate partition
        if ' /home ' in output:
            self.add_result(category, "Separate /home partition", "PASS",
                           "Separate partition", "Separate partition",
                           "No action needed", "Low")
        else:
            self.add_result(category, "Separate /home partition", "INFO",
                           "Not separate", "Separate partition recommended",
                           "Consider creating separate /home partition", "Low")
        
        # Check if /var is on separate partition
        if ' /var ' in output:
            self.add_result(category, "Separate /var partition", "PASS",
                           "Separate partition", "Separate partition",
                           "No action needed", "Low")
        else:
            self.add_result(category, "Separate /var partition", "INFO",
                           "Not separate", "Separate partition recommended",
                           "Consider creating separate /var partition", "Low")
    
    # ============================================================================
    # CATEGORY 8: SYSTEM UPDATES
    # ============================================================================
    
    def check_updates(self):
        """Check for available system updates"""
        category = "System Updates"
        
        # Check last update time
        if self.file_exists('/var/log/apt/history.log'):
            output, _ = self.run_command("ls -l /var/log/apt/history.log", shell=True)
            self.add_result(category, "APT History Log", "INFO",
                           "Available", "Check recent updates",
                           "Review /var/log/apt/history.log for update history", "Low")
        
        # Check for pending updates
        output, returncode = self.run_command("apt list --upgradable 2>/dev/null | wc -l", shell=True)
        if returncode == 0:
            try:
                upgradable = int(output) - 1  # Subtract header line
                if upgradable > 0:
                    self.add_result(category, "Available Updates", "FAIL",
                                   f"{upgradable} packages", "0 packages",
                                   "Update system: apt-get update && apt-get upgrade", "High",
                                   fix_commands=["apt-get update", "apt-get upgrade -y"])
                else:
                    self.add_result(category, "Available Updates", "PASS",
                                   "System up to date", "Up to date",
                                   "No action needed", "High")
            except:
                self.add_result(category, "Available Updates", "INFO",
                               "Unable to determine", "Check manually",
                               "Run: apt-get update && apt list --upgradable", "Medium")
        
        # Check for automatic updates
        output, returncode = self.run_command("which unattended-upgrade")
        if returncode == 0:
            # Check if enabled
            output, _ = self.run_command("systemctl is-enabled unattended-upgrades 2>/dev/null || systemctl is-enabled apt-daily-upgrade.timer 2>/dev/null", shell=True)
            if "enabled" in output:
                self.add_result(category, "Automatic Security Updates", "PASS",
                               "Enabled", "Enabled",
                               "No action needed", "Medium")
            else:
                self.add_result(category, "Automatic Security Updates", "FAIL",
                               "Not Enabled", "Enabled",
                               "Enable automatic security updates", "Medium",
                               fix_commands=[
                                   "apt-get install -y unattended-upgrades",
                                   "dpkg-reconfigure -plow unattended-upgrades"
                               ])
        else:
            self.add_result(category, "Automatic Security Updates", "FAIL",
                           "Not Installed", "Installed and Enabled",
                           "Install unattended-upgrades package", "Medium",
                           fix_commands=[
                               "apt-get install -y unattended-upgrades",
                               "dpkg-reconfigure -plow unattended-upgrades"
                           ])
    
    # ============================================================================
    # CATEGORY 9: APPARMOR/SELINUX
    # ============================================================================
    
    def check_mandatory_access_control(self):
        """Check AppArmor or SELinux status"""
        category = "Mandatory Access Control"
        
        # Check for AppArmor
        output, returncode = self.run_command("which apparmor_status")
        if returncode == 0:
            output, returncode = self.run_command("apparmor_status")
            if returncode == 0:
                if "apparmor module is loaded" in output.lower():
                    self.add_result(category, "AppArmor Status", "PASS",
                                   "Loaded and running", "Active",
                                   "No action needed", "High")
                else:
                    self.add_result(category, "AppArmor Status", "FAIL",
                                   "Not active", "Active",
                                   "Enable AppArmor and load profiles", "High",
                                   fix_commands=[
                                       "systemctl enable apparmor",
                                       "systemctl start apparmor"
                                   ])
        else:
            # Check for SELinux
            output, returncode = self.run_command("which getenforce")
            if returncode == 0:
                output, returncode = self.run_command("getenforce")
                if returncode == 0:
                    if output.lower() == "enforcing":
                        self.add_result(category, "SELinux Status", "PASS",
                                       "Enforcing", "Enforcing",
                                       "No action needed", "High")
                    elif output.lower() == "permissive":
                        self.add_result(category, "SELinux Status", "FAIL",
                                       "Permissive", "Enforcing",
                                       "Set SELinux to enforcing mode", "High",
                                       fix_commands=["setenforce 1"])
                    else:
                        self.add_result(category, "SELinux Status", "FAIL",
                                       "Disabled", "Enforcing",
                                       "Enable and configure SELinux", "High")
            else:
                self.add_result(category, "Mandatory Access Control", "FAIL",
                               "Neither AppArmor nor SELinux found", "Should be enabled",
                               "Install and configure AppArmor or SELinux", "High",
                               fix_commands=[
                                   "apt-get install -y apparmor apparmor-utils",
                                   "systemctl enable apparmor",
                                   "systemctl start apparmor"
                               ])
    
    # ============================================================================
    # CATEGORY 10: NETWORK CONFIGURATION
    # ============================================================================
    
    def check_network(self):
        """Check network configuration"""
        category = "Network Configuration"
        
        # Check for IPv6 if not needed
        output, _ = self.run_command("sysctl net.ipv6.conf.all.disable_ipv6")
        if output:
            current_value = output.split('=')[-1].strip()
            self.add_result(category, "IPv6 Status", "INFO",
                           "Enabled" if current_value == "0" else "Disabled",
                           "Disabled if not needed",
                           "If IPv6 not needed, disable via sysctl", "Low")
        
        # Check listening services
        output, returncode = self.run_command("ss -tuln")
        if returncode == 0:
            listening_ports = len([l for l in output.split('\n') if 'LISTEN' in l])
            self.add_result(category, "Listening Services", "INFO",
                           f"{listening_ports} services listening",
                           "Minimize unnecessary services",
                           "Review listening services and disable unnecessary ones", "Medium")
        
        # Check for hosts.allow and hosts.deny
        if self.file_exists('/etc/hosts.allow'):
            self.add_result(category, "TCP Wrappers (hosts.allow)", "PASS",
                           "File exists", "Recommended",
                           "Review and maintain /etc/hosts.allow", "Medium")
        else:
            self.add_result(category, "TCP Wrappers (hosts.allow)", "INFO",
                           "Not configured", "Optional but recommended",
                           "Create /etc/hosts.allow for access control (used with hosts.deny)", "Low")
        
        if self.file_exists('/etc/hosts.deny'):
            self.add_result(category, "TCP Wrappers (hosts.deny)", "PASS",
                           "File exists", "Should exist",
                           "Review and maintain /etc/hosts.deny", "Medium")
        else:
            self.add_result(category, "TCP Wrappers (hosts.deny)", "FAIL",
                           "Not configured", "Should be configured",
                           "Create /etc/hosts.deny with 'ALL: ALL'", "Medium",
                           fix_commands=[
                               "# Create hosts.deny to deny all by default",
                               "echo 'ALL: ALL' > /etc/hosts.deny",
                               "chmod 644 /etc/hosts.deny",
                               "# Then configure hosts.allow with specific allowances"
                           ])
    
    # ============================================================================
    # CATEGORY 11: CRON AND AT
    # ============================================================================
    
    def check_cron_permissions(self):
        """Check cron and at permissions"""
        category = "Scheduled Tasks"
        
        cron_files = {
            '/etc/crontab': '600',
            '/etc/cron.hourly': '700',
            '/etc/cron.daily': '700',
            '/etc/cron.weekly': '700',
            '/etc/cron.monthly': '700',
            '/etc/cron.d': '700',
        }
        
        for filepath, expected_perms in cron_files.items():
            if self.file_exists(filepath):
                current_perms = self.get_file_permissions(filepath)
                if current_perms == expected_perms:
                    self.add_result(category, f"Permissions: {filepath}", "PASS",
                                   current_perms, expected_perms,
                                   "No action needed", "Medium")
                else:
                    self.add_result(category, f"Permissions: {filepath}", "FAIL",
                                   current_perms, expected_perms,
                                   f"chmod {expected_perms} {filepath}", "Medium",
                                   fix_commands=[f"chmod {expected_perms} {filepath}"])
        
        # Check for cron.allow / cron.deny
        if self.file_exists('/etc/cron.allow'):
            self.add_result(category, "Cron Access Control", "PASS",
                           "/etc/cron.allow exists", "Whitelist approach",
                           "Verify authorized users in /etc/cron.allow", "Medium")
        else:
            self.add_result(category, "Cron Access Control", "FAIL",
                           "/etc/cron.allow not found", "Should exist",
                           "Create /etc/cron.allow with authorized users", "Medium",
                           fix_commands=[
                               "# Create cron.allow with root user",
                               "touch /etc/cron.allow",
                               "chmod 600 /etc/cron.allow",
                               "echo 'root' > /etc/cron.allow",
                               "# MANUAL: Add other authorized users as needed:",
                               "# echo 'username' >> /etc/cron.allow"
                           ])
    
    # ============================================================================
    # CATEGORY 12: BOOTLOADER SECURITY
    # ============================================================================
    
    def check_bootloader(self):
        """Check GRUB bootloader security"""
        category = "Bootloader Security"
        
        grub_cfg = "/boot/grub/grub.cfg"
        if self.file_exists(grub_cfg):
            # Check if password is set
            output, _ = self.run_command(f"grep '^password' {grub_cfg}", shell=True)
            if output:
                self.add_result(category, "GRUB Password", "PASS",
                               "Password set", "Password required",
                               "No action needed", "High")
            else:
                self.add_result(category, "GRUB Password", "FAIL",
                               "No password set", "Password required",
                               "Set GRUB password using grub-mkpasswd-pbkdf2, then add to /etc/grub.d/40_custom and run update-grub", "High",
                               fix_commands=[
                                   "# MANUAL: This requires user interaction to set password",
                                   "# Run: grub-mkpasswd-pbkdf2",
                                   "# Add output to /etc/grub.d/40_custom",
                                   "# Then run: update-grub"
                               ])
    
    # ============================================================================
    # CATEGORY 13: LOG CONFIGURATION
    # ============================================================================
    
    def check_logging(self):
        """Check system logging configuration"""
        category = "Logging Configuration"
        
        # Check if rsyslog or syslog-ng is installed and running
        for syslog in ['rsyslog', 'syslog-ng']:
            output, returncode = self.run_command(f"systemctl is-active {syslog}")
            if returncode == 0 and 'active' in output:
                self.add_result(category, f"{syslog} Status", "PASS",
                               "Running", "Running",
                               "No action needed", "Medium")
                break
        else:
            self.add_result(category, "Syslog Service", "FAIL",
                           "No syslog service running", "Should be running",
                           "Install and enable rsyslog or syslog-ng", "Medium",
                           fix_commands=[
                               "apt-get install -y rsyslog",
                               "systemctl enable rsyslog",
                               "systemctl start rsyslog"
                           ])
        
        # Check log file permissions
        log_files = ['/var/log/syslog', '/var/log/auth.log', '/var/log/kern.log']
        for log_file in log_files:
            if self.file_exists(log_file):
                perms = self.get_file_permissions(log_file)
                if perms and int(perms[-1]) == 0:
                    self.add_result(category, f"Log Permissions: {log_file}", "PASS",
                                   perms, "No world access",
                                   "No action needed", "Medium")
                else:
                    self.add_result(category, f"Log Permissions: {log_file}", "FAIL",
                                   perms or "Unknown", "No world access",
                                   f"Restrict permissions: chmod 640 {log_file}", "Medium",
                                   fix_commands=[f"chmod 640 {log_file}"])
    
    # ============================================================================
    # CATEGORY 14: SYSTEM SERVICES
    # ============================================================================
    
    def check_unnecessary_services(self):
        """Check for unnecessary services"""
        category = "System Services"
        
        unnecessary_services = [
            'avahi-daemon',
            'cups',
            'isc-dhcp-server',
            'isc-dhcp-server6',
            'nfs-server',
            'rpcbind',
            'snmpd',
        ]
        
        for service in unnecessary_services:
            output, returncode = self.run_command(f"systemctl is-enabled {service} 2>/dev/null", shell=True)
            if returncode == 0 and 'enabled' in output:
                self.add_result(category, f"Service: {service}", "FAIL",
                               "Enabled", "Disabled (if not needed)",
                               f"If not needed, disable: systemctl disable {service}", "Low",
                               fix_commands=[
                                   f"systemctl stop {service}",
                                   f"systemctl disable {service}"
                               ])
    
    # ============================================================================
    # CATEGORY 15: CORE DUMPS
    # ============================================================================
    
    def check_core_dumps(self):
        """Check core dump configuration"""
        category = "Core Dumps"
        
        # Check limits.conf
        if self.file_exists('/etc/security/limits.conf'):
            output, _ = self.run_command("grep -E '^\\*.*hard.*core' /etc/security/limits.conf", shell=True)
            if output and '0' in output:
                self.add_result(category, "Core Dumps (limits.conf)", "PASS",
                               "Disabled", "Disabled",
                               "No action needed", "Medium")
            else:
                self.add_result(category, "Core Dumps (limits.conf)", "FAIL",
                               "Not disabled", "Disabled",
                               "Disable core dumps in /etc/security/limits.conf", "Medium",
                               fix_commands=["echo '* hard core 0' >> /etc/security/limits.conf"])
        
        # Check sysctl
        output, returncode = self.run_command("sysctl fs.suid_dumpable")
        if returncode == 0:
            current_value = output.split('=')[-1].strip()
            if current_value == "0":
                self.add_result(category, "SUID Core Dumps", "PASS",
                               "0", "0",
                               "No action needed", "Medium")
            else:
                self.add_result(category, "SUID Core Dumps", "FAIL",
                               current_value, "0",
                               "Set fs.suid_dumpable = 0", "Medium",
                               fix_commands=[
                                   "sysctl -w fs.suid_dumpable=0",
                                   "echo 'fs.suid_dumpable = 0' >> /etc/sysctl.d/99-security.conf"
                               ])
    
    # ============================================================================
    # CATEGORY 16: INTRUSION DETECTION
    # ============================================================================
    
    def check_intrusion_detection(self):
        """Check for intrusion detection systems"""
        category = "Intrusion Detection"
        
        # Check for AIDE
        output, returncode = self.run_command("which aide")
        if returncode == 0:
            # Check if database is initialized
            if self.file_exists('/var/lib/aide/aide.db'):
                self.add_result(category, "AIDE (File Integrity)", "PASS",
                               "Installed and initialized", "Installed and configured",
                               "Regularly run aide checks", "Medium")
            else:
                self.add_result(category, "AIDE (File Integrity)", "FAIL",
                               "Installed but not initialized", "Installed and configured",
                               "Initialize AIDE database", "Medium",
                               fix_commands=["aideinit"])
        else:
            self.add_result(category, "AIDE (File Integrity)", "FAIL",
                           "Not installed", "Installed and configured",
                           "Install AIDE for file integrity monitoring", "Medium",
                           fix_commands=[
                               "apt-get install -y aide aide-common",
                               "aideinit"
                           ])
        
        # Check for fail2ban
        output, returncode = self.run_command("which fail2ban-client")
        if returncode == 0:
            output, returncode = self.run_command("systemctl is-active fail2ban")
            if returncode == 0 and 'active' in output:
                self.add_result(category, "Fail2ban Status", "PASS",
                               "Running", "Running",
                               "No action needed", "High")
            else:
                self.add_result(category, "Fail2ban Status", "FAIL",
                               "Installed but not running", "Running",
                               "Start fail2ban service", "High",
                               fix_commands=[
                                   "systemctl enable fail2ban",
                                   "systemctl start fail2ban"
                               ])
        else:
            self.add_result(category, "Fail2ban Installation", "FAIL",
                           "Not installed", "Installed and running",
                           "Install fail2ban for intrusion prevention", "High",
                           fix_commands=[
                               "apt-get install -y fail2ban",
                               "systemctl enable fail2ban",
                               "systemctl start fail2ban"
                           ])
    
    # ============================================================================
    # CATEGORY 17: WORLD WRITABLE FILES
    # ============================================================================
    
    def check_world_writable_files(self):
        """Check for world-writable files (sampling)"""
        category = "World Writable Files"
        
        # Quick check in common locations
        output, returncode = self.run_command(
            "find /etc /usr/local/bin /usr/local/sbin -xdev -type f -perm -0002 2>/dev/null | head -20",
            shell=True
        )
        
        if output:
            files = output.split('\n')
            self.add_result(category, "World-Writable Files in System Directories", "FAIL",
                           f"{len(files)} files found (showing first 20)",
                           "None",
                           "Review and fix permissions on world-writable files", "High",
                           fix_commands=[
                               "# MANUAL: Review each file and fix permissions appropriately",
                               "# Example: chmod o-w /path/to/file",
                               f"# Files found: {', '.join(files[:5])}{'...' if len(files) > 5 else ''}"
                           ])
        else:
            self.add_result(category, "World-Writable Files in System Directories", "PASS",
                           "None found in sampled locations", "None",
                           "No action needed", "High")
    
    # ============================================================================
    # CATEGORY 18: SUDO CONFIGURATION
    # ============================================================================
    
    def check_sudo_config(self):
        """Check sudo configuration"""
        category = "Sudo Configuration"
        
        if self.file_exists('/etc/sudoers'):
            # Check for NOPASSWD entries
            output, _ = self.run_command("grep -i 'nopasswd' /etc/sudoers /etc/sudoers.d/* 2>/dev/null", shell=True)
            if output:
                self.add_result(category, "Sudo NOPASSWD Entries", "FAIL",
                               "NOPASSWD entries found", "Should be minimal",
                               "Review and minimize NOPASSWD sudo entries", "High",
                               fix_commands=[
                                   "# MANUAL: Review NOPASSWD entries and remove if not needed",
                                   "# Use: visudo or visudo -f /etc/sudoers.d/filename",
                                   "# Remove or comment out lines with NOPASSWD",
                                   f"# Files with NOPASSWD: {output[:100]}..."
                               ])
            else:
                self.add_result(category, "Sudo NOPASSWD Entries", "PASS",
                               "No NOPASSWD entries", "Minimal use",
                               "No action needed", "High")
            
            # Check sudoers file permissions
            perms = self.get_file_permissions('/etc/sudoers')
            if perms == '440' or perms == '400':
                self.add_result(category, "Sudoers File Permissions", "PASS",
                               perms, "440 or 400",
                               "No action needed", "High")
            else:
                self.add_result(category, "Sudoers File Permissions", "FAIL",
                               perms, "440 or 400",
                               "Fix sudoers file permissions", "High",
                               fix_commands=["chmod 440 /etc/sudoers"])
    
    # ============================================================================
    # CATEGORY 19: BANNER CONFIGURATION
    # ============================================================================
    
    def check_banners(self):
        """Check login banners"""
        category = "Login Banners"
        
        banner_files = ['/etc/issue', '/etc/issue.net', '/etc/motd']
        for banner_file in banner_files:
            if self.file_exists(banner_file):
                with open(banner_file, 'r') as f:
                    content = f.read()
                    if content.strip():
                        self.add_result(category, f"Banner: {banner_file}", "PASS",
                                       "Configured", "Should be configured",
                                       f"Review content of {banner_file}", "Low")
                    else:
                        self.add_result(category, f"Banner: {banner_file}", "INFO",
                                       "Empty", "Should contain warning",
                                       f"Add security warning to {banner_file}", "Low",
                                       fix_commands=[
                                           f"# MANUAL: Add appropriate legal warning to {banner_file}",
                                           f"# Example:",
                                           f"# echo 'Unauthorized access is prohibited.' > {banner_file}",
                                           f"# echo 'All activities are monitored and logged.' >> {banner_file}"
                                       ])
            else:
                self.add_result(category, f"Banner: {banner_file}", "INFO",
                               "Not found", "Should exist with warning",
                               f"Create {banner_file} with security warning", "Low",
                               fix_commands=[
                                   f"# MANUAL: Create {banner_file} with appropriate legal warning",
                                   f"# Example:",
                                   f"# echo 'Unauthorized access is prohibited.' > {banner_file}",
                                   f"# echo 'All activities are monitored and logged.' >> {banner_file}"
                               ])
    
    # ============================================================================
    # GENERATE REPORT
    # ============================================================================
    
    def generate_report(self, output_format='text'):
        """Generate the audit report"""
        if output_format == 'text':
            return self._generate_text_report()
        elif output_format == 'html':
            return self._generate_html_report()
        elif output_format == 'json':
            return self._generate_json_report()
    
    def _generate_text_report(self):
        """Generate text format report"""
        report = []
        report.append("=" * 80)
        report.append("LINUX SECURITY CONFIGURATION AUDIT REPORT")
        report.append("=" * 80)
        report.append(f"Hostname: {self.hostname}")
        report.append(f"Scan Date: {self.timestamp}")
        report.append("=" * 80)
        report.append("")
        
        # Summary statistics
        total_checks = len(self.results)
        passed = len([r for r in self.results if r['Status'] == 'PASS'])
        failed = len([r for r in self.results if r['Status'] == 'FAIL'])
        info = len([r for r in self.results if r['Status'] == 'INFO'])
        
        report.append("SUMMARY")
        report.append("-" * 80)
        report.append(f"Total Checks: {total_checks}")
        report.append(f"Passed: {passed}")
        report.append(f"Failed: {failed}")
        report.append(f"Informational: {info}")
        report.append("")
        
        # Group by severity for failed checks
        critical = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Critical'])
        high = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'High'])
        medium = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Medium'])
        low = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Low'])
        
        report.append("FAILED CHECKS BY SEVERITY")
        report.append("-" * 80)
        report.append(f"Critical: {critical}")
        report.append(f"High: {high}")
        report.append(f"Medium: {medium}")
        report.append(f"Low: {low}")
        report.append("")
        report.append("=" * 80)
        report.append("")
        
        # Detailed results by category
        current_category = None
        for result in sorted(self.results, key=lambda x: (x['Category'], x['Severity'], x['Status'])):
            if result['Category'] != current_category:
                current_category = result['Category']
                report.append("")
                report.append(f"CATEGORY: {current_category}")
                report.append("=" * 80)
            
            report.append(f"\nCheck: {result['Check']}")
            report.append(f"Status: {result['Status']} (Severity: {result['Severity']})")
            report.append(f"Current Value: {result['Current Value']}")
            report.append(f"Expected Value: {result['Expected Value']}")
            report.append(f"Recommendation: {result['Recommendation']}")
            report.append("-" * 80)
        
        return '\n'.join(report)
    
    def _generate_html_report(self):
        """Generate HTML format report"""
        # Calculate statistics
        total_checks = len(self.results)
        passed = len([r for r in self.results if r['Status'] == 'PASS'])
        failed = len([r for r in self.results if r['Status'] == 'FAIL'])
        info = len([r for r in self.results if r['Status'] == 'INFO'])
        
        critical = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Critical'])
        high = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'High'])
        medium = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Medium'])
        low = len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Low'])
        
        html = f"""
<!DOCTYPE html>
<html>
<head>
    <title>Linux Security Audit Report</title>
    <style>
        body {{ font-family: Arial, sans-serif; margin: 20px; background-color: #f5f5f5; }}
        .header {{ background-color: #2c3e50; color: white; padding: 20px; border-radius: 5px; }}
        .summary {{ background-color: white; padding: 20px; margin: 20px 0; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }}
        .stats {{ display: flex; justify-content: space-around; flex-wrap: wrap; }}
        .stat-box {{ text-align: center; padding: 15px; margin: 10px; background-color: #ecf0f1; border-radius: 5px; min-width: 120px; }}
        .stat-number {{ font-size: 36px; font-weight: bold; }}
        .passed {{ color: #27ae60; }}
        .failed {{ color: #e74c3c; }}
        .info {{ color: #3498db; }}
        .critical {{ color: #c0392b; }}
        .high {{ color: #e67e22; }}
        .medium {{ color: #f39c12; }}
        .low {{ color: #95a5a6; }}
        .category {{ background-color: white; margin: 20px 0; padding: 20px; border-radius: 5px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }}
        .category-header {{ background-color: #34495e; color: white; padding: 10px; border-radius: 3px; margin-bottom: 15px; }}
        .check-item {{ border-left: 4px solid #bdc3c7; padding: 10px; margin: 10px 0; background-color: #f8f9fa; }}
        .check-item.PASS {{ border-left-color: #27ae60; }}
        .check-item.FAIL {{ border-left-color: #e74c3c; }}
        .check-item.INFO {{ border-left-color: #3498db; }}
        .check-title {{ font-weight: bold; font-size: 16px; }}
        .check-detail {{ margin: 5px 0; }}
        .label {{ font-weight: bold; color: #7f8c8d; }}
    </style>
</head>
<body>
    <div class="header">
        <h1>Linux Security Configuration Audit Report</h1>
        <p><strong>Hostname:</strong> {self.hostname}</p>
        <p><strong>Scan Date:</strong> {self.timestamp}</p>
    </div>
    
    <div class="summary">
        <h2>Summary</h2>
        <div class="stats">
            <div class="stat-box">
                <div class="stat-number">{total_checks}</div>
                <div>Total Checks</div>
            </div>
            <div class="stat-box">
                <div class="stat-number passed">{passed}</div>
                <div>Passed</div>
            </div>
            <div class="stat-box">
                <div class="stat-number failed">{failed}</div>
                <div>Failed</div>
            </div>
            <div class="stat-box">
                <div class="stat-number info">{info}</div>
                <div>Informational</div>
            </div>
        </div>
        
        <h3>Failed Checks by Severity</h3>
        <div class="stats">
            <div class="stat-box">
                <div class="stat-number critical">{critical}</div>
                <div>Critical</div>
            </div>
            <div class="stat-box">
                <div class="stat-number high">{high}</div>
                <div>High</div>
            </div>
            <div class="stat-box">
                <div class="stat-number medium">{medium}</div>
                <div>Medium</div>
            </div>
            <div class="stat-box">
                <div class="stat-number low">{low}</div>
                <div>Low</div>
            </div>
        </div>
    </div>
"""
        
        # Group results by category
        categories = {}
        for result in self.results:
            cat = result['Category']
            if cat not in categories:
                categories[cat] = []
            categories[cat].append(result)
        
        # Generate category sections
        for category, results in sorted(categories.items()):
            html += f"""
    <div class="category">
        <div class="category-header">
            <h2>{category}</h2>
        </div>
"""
            for result in sorted(results, key=lambda x: (x['Status'] != 'FAIL', x['Severity'])):
                html += f"""
        <div class="check-item {result['Status']}">
            <div class="check-title">{result['Check']}</div>
            <div class="check-detail"><span class="label">Status:</span> <span class="{result['Status'].lower()}">{result['Status']}</span> (Severity: {result['Severity']})</div>
            <div class="check-detail"><span class="label">Current Value:</span> {result['Current Value']}</div>
            <div class="check-detail"><span class="label">Expected Value:</span> {result['Expected Value']}</div>
            <div class="check-detail"><span class="label">Recommendation:</span> {result['Recommendation']}</div>
        </div>
"""
            html += """
    </div>
"""
        
        html += """
</body>
</html>
"""
        return html
    
    def _generate_json_report(self):
        """Generate JSON format report"""
        report_data = {
            'hostname': self.hostname,
            'scan_date': self.timestamp,
            'summary': {
                'total_checks': len(self.results),
                'passed': len([r for r in self.results if r['Status'] == 'PASS']),
                'failed': len([r for r in self.results if r['Status'] == 'FAIL']),
                'informational': len([r for r in self.results if r['Status'] == 'INFO']),
                'failed_by_severity': {
                    'critical': len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Critical']),
                    'high': len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'High']),
                    'medium': len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Medium']),
                    'low': len([r for r in self.results if r['Status'] == 'FAIL' and r['Severity'] == 'Low'])
                }
            },
            'results': self.results
        }
        return json.dumps(report_data, indent=2)
    

    # =========================================================================
    # RASPBERRY PI DETECTION AND SPECIFIC CHECKS
    # =========================================================================
    
    def detect_raspberry_pi(self):
        """Detect if running on Raspberry Pi hardware"""
        try:
            with open('/proc/cpuinfo', 'r') as f:
                cpuinfo = f.read()
                if 'Raspberry Pi' in cpuinfo or 'BCM' in cpuinfo:
                    return True
        except:
            pass
        
        # Alternative check - look for Pi-specific files
        if os.path.exists('/boot/config.txt') and os.path.exists('/boot/cmdline.txt'):
            return True
        
        return False
    
    def get_pi_model(self):
        """Get Raspberry Pi model information"""
        try:
            with open('/proc/device-tree/model', 'r') as f:
                model = f.read().strip()
                return model
        except:
            return "Unknown Raspberry Pi"
    
    def get_pi_architecture(self):
        """Determine if running 32-bit or 64-bit Raspberry Pi OS"""
        arch = os.uname().machine
        if 'aarch64' in arch or 'arm64' in arch:
            return "64-bit"
        elif 'arm' in arch:
            return "32-bit"
        return arch
    
    def check_pi_default_user(self):
        """Check if default 'pi' user is properly secured"""
        category = "Raspberry Pi Security"
        check_name = "Default Pi User Security"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            # Check if 'pi' user exists
            pi_user = pwd.getpwnam('pi')
            
            # Check if pi user has UID 1000 (typical default)
            if pi_user.pw_uid == 1000:
                issues = []
                
                # Check if account is locked
                try:
                    shadow_entry = subprocess.run(
                        ['sudo', 'passwd', '-S', 'pi'],
                        capture_output=True, text=True, timeout=5
                    )
                    
                    if 'L' not in shadow_entry.stdout:  # Not locked
                        issues.append("Account not locked")
                except:
                    issues.append("Could not check lock status")
                
                # Check if default shell is still active
                if '/bin/bash' in pi_user.pw_shell or '/bin/sh' in pi_user.pw_shell:
                    issues.append("Login shell still active")
                
                if issues:
                    self.add_result(
                        category, check_name, "FAIL",
                        f"Default 'pi' user exists: {', '.join(issues)}",
                        "User disabled or renamed",
                        "CRITICAL: Default 'pi' user should be disabled, renamed, or secured",
                        "Critical",
                        fix_commands=[
                            "# Option 1: Lock the account",
                            "sudo passwd -l pi",
                            "# Option 2: Disable login shell",
                            "sudo usermod -s /usr/sbin/nologin pi",
                            "# Option 3: Rename the user (recommended)",
                            "# sudo usermod -l newusername pi",
                            "# sudo groupmod -n newusername pi",
                            "# sudo usermod -d /home/newusername -m newusername"
                        ]
                    )
                else:
                    self.add_result(
                        category, check_name, "PASS",
                        "Default 'pi' user is secured",
                        "Secured",
                        "OK - Default user is locked or disabled",
                        "Low"
                    )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "'pi' user exists but not default UID",
                    "Custom configuration",
                    "OK - Not default configuration",
                    "Low"
                )
        
        except KeyError:
            # 'pi' user doesn't exist
            self.add_result(
                category, check_name, "PASS",
                "Default 'pi' user does not exist",
                "User removed or renamed",
                "OK - Default user has been removed",
                "Low"
            )
        except Exception as e:
            self.add_result(
                category, check_name, "INFO",
                f"Could not check: {str(e)}",
                "Manual verification needed",
                "Manually verify default 'pi' user security",
                "Medium"
            )
    
    def check_pi_boot_config(self):
        """Check Raspberry Pi boot configuration file permissions"""
        category = "Raspberry Pi Security"
        
        # Check /boot/config.txt
        check_name = "Pi Boot Config Permissions"
        if self.should_run_check(check_name):
            self.check_file_permissions(
                "/boot/config.txt", "644", "root", "root",
                category, check_name,
                "Contains boot configuration, should be read-only for non-root users"
            )
        
        # Check /boot/cmdline.txt
        check_name = "Pi Boot Cmdline Permissions"
        if self.should_run_check(check_name):
            self.check_file_permissions(
                "/boot/cmdline.txt", "644", "root", "root",
                category, check_name,
                "Contains kernel boot parameters, should be read-only for non-root users"
            )
    
    def check_pi_gpio_permissions(self):
        """Check GPIO group permissions"""
        category = "Raspberry Pi Security"
        check_name = "GPIO Permissions"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            gpio_group = grp.getgrnam('gpio')
            members = gpio_group.gr_mem
            
            if len(members) > 2:  # More than expected users
                self.add_result(
                    category, check_name, "INFO",
                    f"Multiple users in gpio group: {', '.join(members)}",
                    "Only authorized users",
                    "Review gpio group membership - ensure only authorized users have hardware access",
                    "Low"
                )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    f"GPIO group has {len(members)} member(s)",
                    "Limited membership",
                    "OK",
                    "Low"
                )
        except KeyError:
            self.add_result(
                category, check_name, "INFO",
                "GPIO group does not exist",
                "N/A",
                "GPIO functionality may not be available or configured",
                "Low"
            )
    
    def check_pi_camera(self):
        """Check camera interface security"""
        category = "Raspberry Pi Security"
        check_name = "Camera Interface Security"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            with open('/boot/config.txt', 'r') as f:
                config = f.read()
            
            camera_enabled = False
            if 'start_x=1' in config or 'start_file=start_x.elf' in config:
                camera_enabled = True
            
            if camera_enabled:
                # Check if camera group exists and has limited membership
                try:
                    video_group = grp.getgrnam('video')
                    members = video_group.gr_mem
                    
                    if len(members) > 3:
                        self.add_result(
                            category, check_name, "INFO",
                            f"Camera enabled, {len(members)} users have video access",
                            "Only authorized users",
                            "Camera is enabled - review 'video' group membership",
                            "Medium"
                        )
                    else:
                        self.add_result(
                            category, check_name, "PASS",
                            f"Camera enabled with {len(members)} authorized user(s)",
                            "Limited access",
                            "OK - Camera access properly restricted",
                            "Low"
                        )
                except KeyError:
                    self.add_result(
                        category, check_name, "INFO",
                        "Camera enabled but video group not found",
                        "Verify configuration",
                        "Manually verify camera access controls",
                        "Medium"
                    )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "Camera interface is disabled",
                    "Disabled",
                    "OK - Unnecessary interface disabled",
                    "Low"
                )
        except FileNotFoundError:
            self.add_result(
                category, check_name, "INFO",
                "Cannot check - /boot/config.txt not found",
                "N/A",
                "Not a standard Raspberry Pi configuration",
                "Low"
            )
    
    def check_pi_interfaces(self):
        """Check I2C and SPI interface security"""
        category = "Raspberry Pi Security"
        
        # Check I2C
        check_name = "I2C Interface Security"
        if self.should_run_check(check_name):
            try:
                i2c_enabled = os.path.exists('/dev/i2c-1')
                
                if i2c_enabled:
                    self.add_result(
                        category, check_name, "INFO",
                        "I2C interface is enabled",
                        "Disabled if not needed",
                        "I2C provides hardware access - disable if not required",
                        "Low",
                        fix_commands=[
                            "# To disable I2C, edit /boot/config.txt",
                            "# Comment out: dtparam=i2c_arm=on",
                            "sudo sed -i 's/^dtparam=i2c_arm=on/#dtparam=i2c_arm=on/' /boot/config.txt",
                            "# Reboot required",
                            "# sudo reboot"
                        ]
                    )
                else:
                    self.add_result(
                        category, check_name, "PASS",
                        "I2C interface is disabled",
                        "Disabled",
                        "OK - Unnecessary interface disabled",
                        "Low"
                    )
            except:
                pass
        
        # Check SPI
        check_name = "SPI Interface Security"
        if self.should_run_check(check_name):
            try:
                spi_enabled = os.path.exists('/dev/spidev0.0')
                
                if spi_enabled:
                    self.add_result(
                        category, check_name, "INFO",
                        "SPI interface is enabled",
                        "Disabled if not needed",
                        "SPI provides hardware access - disable if not required",
                        "Low",
                        fix_commands=[
                            "# To disable SPI, edit /boot/config.txt",
                            "# Comment out: dtparam=spi=on",
                            "sudo sed -i 's/^dtparam=spi=on/#dtparam=spi=on/' /boot/config.txt",
                            "# Reboot required",
                            "# sudo reboot"
                        ]
                    )
                else:
                    self.add_result(
                        category, check_name, "PASS",
                        "SPI interface is disabled",
                        "Disabled",
                        "OK - Unnecessary interface disabled",
                        "Low"
                    )
            except:
                pass
    
    def check_pi_serial_console(self):
        """Check serial console security"""
        category = "Raspberry Pi Security"
        check_name = "Serial Console Security"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            with open('/boot/cmdline.txt', 'r') as f:
                cmdline = f.read()
            
            if 'console=serial0' in cmdline or 'console=ttyAMA0' in cmdline:
                self.add_result(
                    category, check_name, "FAIL",
                    "Serial console is enabled",
                    "Disabled for security",
                    "Serial console provides root access - should be disabled in production",
                    "High",
                    fix_commands=[
                        "# Backup cmdline.txt",
                        "sudo cp /boot/cmdline.txt /boot/cmdline.txt.backup",
                        "# Remove serial console parameters",
                        "sudo sed -i 's/console=serial0,[0-9]* //g' /boot/cmdline.txt",
                        "sudo sed -i 's/console=ttyAMA0,[0-9]* //g' /boot/cmdline.txt",
                        "# Also disable in config.txt",
                        "echo 'enable_uart=0' | sudo tee -a /boot/config.txt",
                        "# Reboot required",
                        "# sudo reboot"
                    ]
                )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "Serial console is disabled",
                    "Disabled",
                    "OK - Serial console properly disabled",
                    "Low"
                )
        except FileNotFoundError:
            self.add_result(
                category, check_name, "INFO",
                "Cannot check - /boot/cmdline.txt not found",
                "N/A",
                "Not a standard Raspberry Pi configuration",
                "Low"
            )
    
    def check_pi_wifi_security(self):
        """Check Wi-Fi configuration security"""
        category = "Raspberry Pi Security"
        check_name = "Wi-Fi Security Configuration"
        
        if not self.should_run_check(check_name):
            return
        
        wpa_supplicant = "/etc/wpa_supplicant/wpa_supplicant.conf"
        
        if not os.path.exists(wpa_supplicant):
            self.add_result(
                category, check_name, "PASS",
                "No Wi-Fi configuration found",
                "N/A or ethernet only",
                "OK - No wireless configuration",
                "Low"
            )
            return
        
        try:
            with open(wpa_supplicant, 'r') as f:
                config = f.read()
            
            issues = []
            
            # Check for plaintext passwords (psk="password")
            plaintext_psk = re.findall(r'psk="([^"]+)"', config)
            if plaintext_psk:
                issues.append("Plaintext PSK found (should use hashed)")
            
            # Check for weak encryption (WEP, open networks)
            if 'key_mgmt=NONE' in config:
                issues.append("Open network configured")
            if 'wep_key' in config.lower():
                issues.append("WEP encryption (insecure)")
            
            # Check for WPA3 support
            if 'proto=RSN' not in config and 'key_mgmt=WPA-PSK' in config:
                issues.append("Using WPA2 only (consider WPA3)")
            
            if issues:
                self.add_result(
                    category, check_name, "FAIL",
                    f"Wi-Fi security issues: {', '.join(issues)}",
                    "WPA3 with hashed PSK",
                    "Update Wi-Fi configuration to use WPA3 and hashed passwords",
                    "Critical",
                    fix_commands=[
                        "# Generate PSK hash:",
                        "# wpa_passphrase 'SSID' 'password'",
                        "# Replace psk=\"password\" with psk=HASH in wpa_supplicant.conf",
                        "# For WPA3, add: proto=RSN",
                        "# key_mgmt=SAE"
                    ]
                )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "Wi-Fi configuration appears secure",
                    "Secure configuration",
                    "OK",
                    "Low"
                )
        except Exception as e:
            self.add_result(
                category, check_name, "INFO",
                f"Could not check Wi-Fi config: {str(e)}",
                "Manual verification",
                "Manually review /etc/wpa_supplicant/wpa_supplicant.conf",
                "Medium"
            )
    
    def check_pi_bluetooth(self):
        """Check Bluetooth security"""
        category = "Raspberry Pi Security"
        check_name = "Bluetooth Security"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            # Check if Bluetooth service is running
            result = subprocess.run(
                ['systemctl', 'is-active', 'bluetooth'],
                capture_output=True, text=True, timeout=5
            )
            
            if result.returncode == 0:  # Active
                # Check if discoverable
                try:
                    hci_result = subprocess.run(
                        ['hciconfig'],
                        capture_output=True, text=True, timeout=5
                    )
                    
                    if 'PSCAN' in hci_result.stdout:  # Page scan = discoverable
                        self.add_result(
                            category, check_name, "FAIL",
                            "Bluetooth is active and discoverable",
                            "Disabled or not discoverable",
                            "Bluetooth should be disabled if not needed, or set to non-discoverable",
                            "High",
                            fix_commands=[
                                "# To disable Bluetooth completely:",
                                "sudo systemctl stop bluetooth",
                                "sudo systemctl disable bluetooth",
                                "# Or make non-discoverable:",
                                "sudo hciconfig hci0 noscan"
                            ]
                        )
                    else:
                        self.add_result(
                            category, check_name, "INFO",
                            "Bluetooth is active but not discoverable",
                            "Disabled if not needed",
                            "Consider disabling Bluetooth if not required",
                            "Low",
                            fix_commands=[
                                "sudo systemctl stop bluetooth",
                                "sudo systemctl disable bluetooth"
                            ]
                        )
                except FileNotFoundError:
                    self.add_result(
                        category, check_name, "INFO",
                        "Bluetooth is active",
                        "Disabled if not needed",
                        "Consider disabling Bluetooth if not required",
                        "Low",
                        fix_commands=[
                            "sudo systemctl stop bluetooth",
                            "sudo systemctl disable bluetooth"
                        ]
                    )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "Bluetooth service is not active",
                    "Disabled",
                    "OK - Bluetooth properly disabled",
                    "Low"
                )
        except Exception as e:
            self.add_result(
                category, check_name, "INFO",
                f"Could not check Bluetooth: {str(e)}",
                "Manual verification",
                "Manually check Bluetooth status",
                "Low"
            )
    
    def check_pi_vnc(self):
        """Check VNC server security"""
        category = "Raspberry Pi Security"
        check_name = "VNC Server Security"
        
        if not self.should_run_check(check_name):
            return
        
        # Check for RealVNC (common on Raspberry Pi OS)
        vnc_services = ['vncserver-x11-serviced', 'vncserver-virtuald', 'vnc']
        vnc_running = False
        running_service = None
        
        for service in vnc_services:
            try:
                result = subprocess.run(
                    ['systemctl', 'is-active', service],
                    capture_output=True, text=True, timeout=5
                )
                if result.returncode == 0:
                    vnc_running = True
                    running_service = service
                    break
            except:
                continue
        
        if vnc_running:
            issues = []
            
            # Check VNC config for encryption
            vnc_config = "/root/.vnc/config.d/vncserver-x11"
            try:
                with open(vnc_config, 'r') as f:
                    config = f.read()
                    if 'Encryption=' in config:
                        if 'PreferOff' in config or 'AlwaysOff' in config:
                            issues.append("Encryption disabled or weak")
                    else:
                        issues.append("Encryption setting not specified")
            except:
                issues.append("Could not verify encryption settings")
            
            # Check if VNC is password protected
            if not os.path.exists("/root/.vnc/config.d/vncserver-x11"):
                issues.append("VNC may not be password protected")
            
            if issues:
                self.add_result(
                    category, check_name, "FAIL",
                    f"VNC running with issues: {', '.join(issues)}",
                    "Encrypted with strong password or disabled",
                    "VNC should use encryption and strong authentication",
                    "Critical",
                    fix_commands=[
                        "# To disable VNC:",
                        f"sudo systemctl stop {running_service}",
                        f"sudo systemctl disable {running_service}",
                        "# Or configure encryption:",
                        "# Use raspi-config -> Interface Options -> VNC",
                        "# Or edit /root/.vnc/config.d/vncserver-x11",
                        "# Add: Encryption=AlwaysOn"
                    ]
                )
            else:
                self.add_result(
                    category, check_name, "INFO",
                    "VNC is running",
                    "Verify security settings",
                    "Manually verify VNC uses encryption and strong password",
                    "Medium"
                )
        else:
            self.add_result(
                category, check_name, "PASS",
                "VNC server is not running",
                "Disabled",
                "OK - VNC properly disabled",
                "Low"
            )
    
    def check_pi_avahi(self):
        """Check Avahi/mDNS service"""
        category = "Raspberry Pi Security"
        check_name = "Avahi/mDNS Service"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            result = subprocess.run(
                ['systemctl', 'is-active', 'avahi-daemon'],
                capture_output=True, text=True, timeout=5
            )
            
            if result.returncode == 0:
                self.add_result(
                    category, check_name, "INFO",
                    "Avahi (mDNS) is running",
                    "Disabled if not needed",
                    "Avahi provides .local hostname resolution - disable if not required",
                    "Low",
                    fix_commands=[
                        "sudo systemctl stop avahi-daemon",
                        "sudo systemctl disable avahi-daemon"
                    ]
                )
            else:
                self.add_result(
                    category, check_name, "PASS",
                    "Avahi is not running",
                    "Disabled",
                    "OK",
                    "Low"
                )
        except:
            self.add_result(
                category, check_name, "PASS",
                "Avahi service not found",
                "Not installed",
                "OK",
                "Low"
            )
    
    def check_pi_hostname(self):
        """Check if default hostname has been changed"""
        category = "Raspberry Pi Security"
        check_name = "Default Hostname Changed"
        
        if not self.should_run_check(check_name):
            return
        
        hostname = os.uname().nodename
        
        if hostname == 'raspberrypi':
            self.add_result(
                category, check_name, "INFO",
                "Using default hostname 'raspberrypi'",
                "Unique hostname",
                "Change hostname to something unique for security and identification",
                "Low",
                fix_commands=[
                    "# Change hostname:",
                    "sudo raspi-config  # System Options -> Hostname",
                    "# Or manually:",
                    "# sudo hostnamectl set-hostname newhostname",
                    "# sudo sed -i 's/raspberrypi/newhostname/g' /etc/hosts"
                ]
            )
        else:
            self.add_result(
                category, check_name, "PASS",
                f"Hostname is '{hostname}'",
                "Custom hostname",
                "OK - Hostname has been customized",
                "Low"
            )
    
    def check_pi_firmware_updates(self):
        """Check for Raspberry Pi firmware updates"""
        category = "Raspberry Pi Security"
        check_name = "Raspberry Pi Firmware Updates"
        
        if not self.should_run_check(check_name):
            return
        
        try:
            # Check if rpi-update is available
            result = subprocess.run(
                ['which', 'rpi-update'],
                capture_output=True, text=True, timeout=5
            )
            
            if result.returncode == 0:
                self.add_result(
                    category, check_name, "INFO",
                    "rpi-update is available",
                    "Keep firmware updated",
                    "Regularly update Raspberry Pi firmware with 'sudo rpi-update'",
                    "Medium",
                    fix_commands=[
                        "# Update firmware (use with caution):",
                        "sudo rpi-update",
                        "# Reboot after update:",
                        "# sudo reboot"
                    ]
                )
            else:
                self.add_result(
                    category, check_name, "INFO",
                    "rpi-update not installed",
                    "Install if needed",
                    "Consider installing rpi-update for firmware updates: sudo apt install rpi-update",
                    "Low"
                )
        except Exception as e:
            self.add_result(
                category, check_name, "INFO",
                f"Could not check firmware tools: {str(e)}",
                "Manual verification",
                "Manually check firmware update status",
                "Low"
            )
    
    def check_pi_sd_card_security(self):
        """Check SD card security settings"""
        category = "Raspberry Pi Security"
        check_name = "SD Card Security"
        
        if not self.should_run_check(check_name):
            return
        
        # Check if root is on SD card (typical for Pi)
        try:
            result = subprocess.run(
                ['findmnt', '-n', '-o', 'SOURCE', '/'],
                capture_output=True, text=True, timeout=5
            )
            root_device = result.stdout.strip()
            
            if '/dev/mmcblk' in root_device:  # SD card
                # Check mount options
                mount_result = subprocess.run(
                    ['findmnt', '-n', '-o', 'OPTIONS', '/'],
                    capture_output=True, text=True, timeout=5
                )
                options = mount_result.stdout.strip()
                
                recommendations = []
                if 'noatime' not in options:
                    recommendations.append("Consider 'noatime' to reduce writes")
                
                if recommendations:
                    self.add_result(
                        category, check_name, "INFO",
                        f"SD card recommendations: {', '.join(recommendations)}",
                        "Optimize for SD card longevity",
                        "SD cards have limited write cycles - consider optimizations",
                        "Low",
                        fix_commands=[
                            "# Add noatime to /etc/fstab for root partition:",
                            "# Edit /etc/fstab and add 'noatime' to mount options"
                        ]
                    )
                else:
                    self.add_result(
                        category, check_name, "PASS",
                        "SD card mount options are optimized",
                        "Optimized",
                        "OK",
                        "Low"
                    )
            else:
                self.add_result(
                    category, check_name, "INFO",
                    "Root filesystem not on SD card",
                    "External storage",
                    "System using external storage",
                    "Low"
                )
        except Exception as e:
            self.add_result(
                category, check_name, "INFO",
                f"Could not check SD card: {str(e)}",
                "Manual verification",
                "Manually verify storage configuration",
                "Low"
            )
    
    def run_raspberry_pi_checks(self):
        """Run all Raspberry Pi-specific security checks"""
        if not self.detect_raspberry_pi():
            return  # Silently skip if not on Pi
        
        pi_model = self.get_pi_model()
        pi_arch = self.get_pi_architecture()
        
        print(f"\n{'='*80}")
        print(f"🍓 RASPBERRY PI DETECTED")
        print(f"Model: {pi_model}")
        print(f"Architecture: {pi_arch}")
        print(f"{'='*80}\n")
        
        print("Running Raspberry Pi-specific security checks...")
        
        self.check_pi_default_user()
        self.check_pi_boot_config()
        self.check_pi_gpio_permissions()
        self.check_pi_camera()
        self.check_pi_interfaces()
        self.check_pi_serial_console()
        self.check_pi_wifi_security()
        self.check_pi_bluetooth()
        self.check_pi_vnc()
        self.check_pi_avahi()
        self.check_pi_hostname()
        self.check_pi_firmware_updates()
        self.check_pi_sd_card_security()

    def run_all_checks(self):
        """Run all security checks"""
        # Run Raspberry Pi-specific checks first if on Pi hardware
        self.run_raspberry_pi_checks()
        
        print("Starting Linux Security Audit...")
        print(f"Hostname: {self.hostname}")
        print(f"Timestamp: {self.timestamp}\n")
        
        self.check_root()
        
        print("Running security checks...")
        self.check_file_permissions()
        print("✓ File Permissions")
        
        self.check_user_accounts()
        print("✓ User Accounts")
        
        self.check_ssh_config()
        print("✓ SSH Configuration")
        
        self.check_firewall()
        print("✓ Firewall")
        
        self.check_kernel_parameters()
        print("✓ Kernel Parameters")
        
        self.check_auditd()
        print("✓ Audit System")
        
        self.check_filesystem()
        print("✓ Filesystem Configuration")
        
        self.check_updates()
        print("✓ System Updates")
        
        self.check_mandatory_access_control()
        print("✓ Mandatory Access Control")
        
        self.check_network()
        print("✓ Network Configuration")
        
        self.check_cron_permissions()
        print("✓ Scheduled Tasks")
        
        self.check_bootloader()
        print("✓ Bootloader Security")
        
        self.check_logging()
        print("✓ Logging Configuration")
        
        self.check_unnecessary_services()
        print("✓ System Services")
        
        self.check_core_dumps()
        print("✓ Core Dumps")
        
        self.check_intrusion_detection()
        print("✓ Intrusion Detection")
        
        self.check_world_writable_files()
        print("✓ World Writable Files")
        
        self.check_sudo_config()
        print("✓ Sudo Configuration")
        
        self.check_banners()
        print("✓ Login Banners")
        
        print("\nAudit complete!")
    
    def interactive_remediation(self, statuses=['FAIL']):
        """Interactive menu to fix failed/info checks
        
        Args:
            statuses: List of statuses to remediate (e.g., ['FAIL'], ['INFO'], or ['FAIL', 'INFO'])
        """
        results_to_fix = [r for r in self.results if r['Status'] in statuses and r['FixCommands']]
        
        if not results_to_fix:
            status_str = ' or '.join(statuses)
            print(f"\n✓ No {status_str} checks with automated fixes available!")
            return
        
        # Separate automated vs manual fixes
        automated_fixes = []
        manual_fixes = []
        
        for result in results_to_fix:
            # Check if this is a manual-only fix (commands start with "# MANUAL:")
            if result['FixCommands'] and result['FixCommands'][0].startswith('# MANUAL:'):
                manual_fixes.append(result)
            else:
                automated_fixes.append(result)
        
        print("\n" + "=" * 80)
        status_str = '/'.join(statuses)
        print(f"INTERACTIVE REMEDIATION - {status_str.upper()} ITEMS")
        print("=" * 80)
        
        # Explain the difference between FAIL and INFO
        if 'FAIL' in statuses and 'INFO' in statuses:
            print("\nNote: FAIL items are security issues. INFO items are optional improvements.")
        elif 'INFO' in statuses:
            print("\nNote: INFO items are optional improvements and best practices.")
            print("These are not security failures but can enhance your system's configuration.")
        
        if manual_fixes:
            print(f"\n{len(manual_fixes)} issue(s) require manual remediation (shown at end)")
        
        if not automated_fixes:
            print("\n✓ No automated fixes available!")
            print("\nThe following checks require manual intervention:")
            for result in manual_fixes:
                print(f"\n- {result['Check']} ({result['Category']})")
                print(f"  Recommendation: {result['Recommendation']}")
            return
        
        print(f"\nFound {len(automated_fixes)} checks with automated fixes.\n")
        
        # Group by severity
        by_severity = {'Critical': [], 'High': [], 'Medium': [], 'Low': []}
        for result in automated_fixes:
            by_severity[result['Severity']].append(result)
        
        # Process by severity
        for severity in ['Critical', 'High', 'Medium', 'Low']:
            items = by_severity[severity]
            if not items:
                continue
            
            print(f"\n{severity} Severity Issues ({len(items)} items)")
            print("-" * 80)
            
            for idx, result in enumerate(items, 1):
                print(f"\n{idx}. {result['Check']}")
                print(f"   Category: {result['Category']}")
                print(f"   Status: {result['Status']}")
                print(f"   Current: {result['Current Value']}")
                print(f"   Expected: {result['Expected Value']}")
                print(f"   Fix commands:")
                for cmd in result['FixCommands']:
                    print(f"      {cmd}")
                
                while True:
                    choice = input(f"\n   Apply fix? (y/n/q to quit): ").lower().strip()
                    if choice in ['y', 'n', 'q']:
                        break
                    print("   Invalid choice. Please enter y, n, or q.")
                
                if choice == 'q':
                    print("\nRemediation cancelled by user.")
                    return
                elif choice == 'y':
                    print(f"\n   Applying fix for: {result['Check']}")
                    success = True
                    
                    # Check if this is a special fix that needs custom handling
                    if result['FixCommands'] and result['FixCommands'][0].startswith('SPECIAL:'):
                        fix_method_name = result['FixCommands'][0].replace('SPECIAL:', '')
                        
                        if fix_method_name == 'fix_tmp_mount_options':
                            missing_opts = result.get('SpecialFixData', {}).get('missing_opts', [])
                            success = self.fix_tmp_mount_options(missing_opts)
                        else:
                            print(f"   ✗ Unknown special fix method: {fix_method_name}")
                            success = False
                    else:
                        # Check if fix commands contain shell script blocks (heredoc, if/then, etc.)
                        has_script_block = any('<<' in cmd or cmd.strip().startswith('if [') or cmd.strip() == 'EOF' 
                                              for cmd in result['FixCommands'])
                        
                        if has_script_block:
                            # Execute as a complete shell script
                            script_lines = []
                            in_comment_block = False
                            for cmd in result['FixCommands']:
                                if cmd.startswith('# MANUAL:'):
                                    # This is a manual-only fix, skip execution
                                    print(f"   Note: {cmd}")
                                    in_comment_block = True
                                    continue
                                elif cmd.startswith('#') and not in_comment_block:
                                    # Regular comment, show but don't add to script
                                    print(f"   Note: {cmd}")
                                    continue
                                else:
                                    # Actual command
                                    script_lines.append(cmd)
                            
                            if script_lines:
                                script_content = '\n'.join(script_lines)
                                print(f"   Executing script block...")
                                # Create temporary script file
                                with tempfile.NamedTemporaryFile(mode='w', suffix='.sh', delete=False) as f:
                                    f.write('#!/bin/bash\n')
                                    f.write('set -e\n')  # Exit on error
                                    f.write(script_content)
                                    f.write('\n')
                                    temp_script = f.name
                                

    def set_filter_args(self, args):
        """Set filtering arguments for framework-specific audits"""
        self.filter_args = args
    
    def should_run_check(self, check_name):
        """Determine if check should run based on framework filters"""
        if not self.filter_args:
            return True
        
        info = get_framework_info(check_name)
        a = self.filter_args
        
        # Framework filter
        if hasattr(a, 'framework') and a.framework:
            fw = a.framework.lower()
            if fw == "cis" and info["cis"] == "N/A":
                return False
            elif fw == "nist" and not info["nist"]:
                return False
            elif fw == "stig" and info["stig"] == "N/A":
                return False
            elif fw == "nsa" and not info["nsa"]:
                return False
            elif fw == "cisa" and not info["cisa"]:
                return False
        
        # CIS Level filter
        if hasattr(a, 'level') and a.level and info["level"] != a.level:
            return False
        
        # STIG Category filter  
        if hasattr(a, 'cat') and a.cat and info["cat"] != a.cat:
            return False
        
        # Scored only filter
        if hasattr(a, 'scored_only') and a.scored_only and not info["scored"]:
            return False
        
        return True


    def generate_framework_compliance_summary(self):
        """Generate per-framework compliance statistics"""
        compliance = {}
        
        for framework in ["CIS", "NIST", "STIG", "NSA", "CISA"]:
            if framework == "CIS":
                fw_results = [x for x in self.results if x.get('CIS_ID', 'N/A') != 'N/A']
            elif framework == "NIST":
                fw_results = [x for x in self.results if x.get('NIST_Controls', [])]
            elif framework == "STIG":
                fw_results = [x for x in self.results if x.get('STIG_ID', 'N/A') != 'N/A']
            elif framework in ["NSA", "CISA"]:
                fw_results = [x for x in self.results if x.get(framework, False)]
            else:
                continue
            
            if fw_results:
                passed = sum(1 for x in fw_results if x['Status'] == 'PASS')
                failed = sum(1 for x in fw_results if x['Status'] == 'FAIL')
                total = len(fw_results)
                compliance[framework] = {
                    'total': total,
                    'passed': passed,
                    'failed': failed,
                    'compliance_pct': f"{(passed/total*100):.1f}%" if total > 0 else "0%"
                }
        
        return compliance
    
    def generate_csv_report(self):
        """Generate CSV format report with all framework IDs"""
        output = StringIO()
        writer = csv.writer(output)
        
        # CSV Header
        writer.writerow([
            'CIS_ID', 'CIS_Level', 'CIS_Scored', 'NIST_Controls', 'STIG_ID', 
            'STIG_Cat', 'NSA', 'CISA', 'Category', 'Check', 'Status', 
            'Severity', 'Current', 'Expected', 'Recommendation'
        ])
        
        # Sort by STIG category (CAT I first) then CIS ID
        cat_order = {"CAT I": 0, "CAT II": 1, "CAT III": 2}
        sorted_results = sorted(self.results, 
                               key=lambda x: (cat_order.get(x.get('STIG_Cat', 'CAT III'), 3),
                                            x.get('CIS_ID', 'ZZZ')))
        
        for result in sorted_results:
            nist_str = ','.join(result.get('NIST_Controls', [])) if result.get('NIST_Controls') else ''
            writer.writerow([
                result.get('CIS_ID', 'N/A'),
                result.get('CIS_Level', '1'),
                result.get('CIS_Scored', 'Not Scored'),
                nist_str,
                result.get('STIG_ID', 'N/A'),
                result.get('STIG_Cat', 'N/A'),
                '✓' if result.get('NSA', False) else '',
                '✓' if result.get('CISA', False) else '',
                result['Category'],
                result['Check'],
                result['Status'],
                result['Severity'],
                result['Current Value'],
                result['Expected Value'],
                result['Recommendation']
            ])
        
        return output.getvalue()


def main():
    """Main execution with comprehensive framework support"""
    parser = argparse.ArgumentParser(
        description=f'Raspberry Pi Security Audit v{VERSION} - Multi-Framework Edition',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog='''
🍓 Raspberry Pi Features:
  Auto-detects Pi hardware and runs Pi-specific checks
  Checks default 'pi' user, GPIO, VNC, Wi-Fi, Bluetooth, interfaces
  
Framework Filtering Examples:
  %(prog)s --framework nist              # NIST 800-53 controls only
  %(prog)s --framework stig              # DISA STIG findings only
  %(prog)s --framework cisa              # CISA best practices only
  %(prog)s --cat "CAT I"                 # STIG Category I (Critical) only
  %(prog)s --level 1                     # CIS Level 1 (essential) only
  %(prog)s --framework stig --cat "CAT I" --remediate  # Fix STIG CAT I issues

Output & Remediation:
  %(prog)s -f csv --auto-save            # CSV with all framework IDs
  %(prog)s -f json -o compliance.json    # JSON compliance report
  %(prog)s --remediate                   # Interactive fix for FAIL items
  %(prog)s --remediate-all               # Interactive fix for FAIL + INFO items
  
Complete Examples:
  %(prog)s                               # Full audit, all frameworks
  %(prog)s --framework nist --remediate  # NIST compliance + fixes
  %(prog)s --cat "CAT I" --remediate     # Fix critical STIG findings
        '''
    )
    
    # Output options
    parser.add_argument('-f', '--format', choices=['text', 'html', 'json', 'csv'],
                       default='text', help='Output format (default: text)')
    parser.add_argument('-o', '--output', help='Output file path')
    parser.add_argument('--auto-save', action='store_true',
                       help='Auto-save report with timestamp')
    parser.add_argument('--no-console', action='store_true',
                       help='Suppress console output (file only)')
    
    # Framework filtering
    parser.add_argument('--framework', choices=['cis', 'nist', 'stig', 'nsa', 'cisa'],
                       help='Filter by compliance framework')
    parser.add_argument('--level', type=int, choices=[1, 2],
                       help='CIS Level filter (1=essential, 2=comprehensive)')
    parser.add_argument('--cat', choices=['CAT I', 'CAT II', 'CAT III'],
                       help='STIG Category filter (CAT I=Critical)')
    parser.add_argument('--scored-only', action='store_true',
                       help='Only run scored CIS checks')
    
    # Remediation options
    parser.add_argument('--remediate', action='store_true',
                       help='Interactive remediation for FAIL items')
    parser.add_argument('--remediate-info', action='store_true',
                       help='Interactive remediation for INFO items')
    parser.add_argument('--remediate-all', action='store_true',
                       help='Interactive remediation for FAIL + INFO items')
    
    args = parser.parse_args()
    
    # Initialize audit
    audit = SecurityAudit()
    audit.set_filter_args(args)
    
    # Display banner
    print("=" * 80)
    print(f"Linux Security Audit v{VERSION} - Multi-Framework Edition")
    print("=" * 80)
    print(f"Hostname: {audit.hostname}")
    print(f"Timestamp: {audit.timestamp}")
    
    if args.framework:
        print(f"Framework Filter: {args.framework.upper()}")
    if args.level:
        print(f"CIS Level: {args.level}")
    if args.cat:
        print(f"STIG Category: {args.cat}")
    
    print("=" * 80)
    print()
    
    # Check root privileges
    audit.check_root()
    
    # Run all audits
    print("Running comprehensive security audit...")
    print()
    
    audit.run_all_checks()
    
    # Generate report
    if args.format == 'csv':
        report = audit.generate_csv_report()
    elif args.format == 'json':
        report = audit._generate_json_report()
    elif args.format == 'html':
        report = audit._generate_html_report()
    else:  # text
        report = audit._generate_text_report()
    
    # Save to file
    output_file = args.output
    if args.auto_save and not output_file:
        ext = args.format if args.format != 'text' else 'txt'
        output_file = f"security_audit_{audit.hostname}_{audit.timestamp_file}.{ext}"
    
    if output_file:
        with open(output_file, 'w') as f:
            f.write(report)
        print()
        print("=" * 80)
        print(f"Report saved to: {output_file}")
        print("=" * 80)
        print()
    
    # Display to console
    if not args.no_console:
        # Show framework compliance summary
        compliance = audit.generate_framework_compliance_summary()
        if compliance:
            print("\nFRAMEWORK COMPLIANCE SUMMARY")
            print("-" * 80)
            for fw, stats in compliance.items():
                print(f"{fw:6s}: {stats['passed']:3d}/{stats['total']:3d} checks passed ({stats['compliance_pct']})")
            print()
        
        print(report)
    
    # Interactive remediation
    if args.remediate or args.remediate_info or args.remediate_all:
        if not audit.is_root:
            print("\n" + "=" * 80)
            print("WARNING: Remediation requires root privileges!")
            print("=" * 80)
            response = input("\nContinue anyway? (y/n): ").lower().strip()
            if response != 'y':
                print("Remediation cancelled.")
                return
        
        if args.remediate_all:
            statuses = ['FAIL', 'INFO']
        elif args.remediate_info:
            statuses = ['INFO']
        else:
            statuses = ['FAIL']
        
        audit.interactive_remediation(statuses)
    
    # Final summary
    total = len(audit.results)
    passed = len([r for r in audit.results if r['Status'] == 'PASS'])
    failed = len([r for r in audit.results if r['Status'] == 'FAIL'])
    
    print("\n" + "=" * 80)
    print("AUDIT COMPLETE")
    print("=" * 80)
    print(f"Total Checks: {total}")
    print(f"Passed: {passed}")
    print(f"Failed: {failed}")
    if total > 0:
        print(f"Overall Compliance: {(passed/total*100):.1f}%")
    print("=" * 80)

if __name__ == "__main__":
    main()