52 lines
2.9 KiB
Python
52 lines
2.9 KiB
Python
"""Explicit real-host validation. Run manually on an authorized Windows Server only."""
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
import platform
|
|
import sys
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
|
from samsara.collectors.windows import collect_local_windows
|
|
from samsara.analyzers.assessment import assess
|
|
from samsara.reporting.export import export_html, export_json
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description='Perform local read-only Windows inventory and save validation evidence. No remote connections.')
|
|
parser.add_argument('--output-dir', required=True, help='A NEW directory for sensitive host inventory and reports')
|
|
args = parser.parse_args()
|
|
if platform.system() != 'Windows':
|
|
parser.error('Real-host validation requires an authorized local Windows Server execution host.')
|
|
destination = Path(args.output_dir)
|
|
if destination.exists():
|
|
parser.error('Choose a new output directory; existing evidence will not be overwritten.')
|
|
try:
|
|
data = collect_local_windows(stage=lambda stage: print(stage, flush=True))
|
|
# collect_local_windows already enforces the supported Server identity and schema.
|
|
if data['synthetic']:
|
|
raise ValueError('A synthetic result cannot be used for real-host validation.')
|
|
destination.mkdir(parents=True, exist_ok=False)
|
|
assessment = assess(data)
|
|
export_json(destination / 'windows-assessment.json', data, assessment)
|
|
export_html(destination / 'windows-assessment.html', data, assessment)
|
|
summary = {
|
|
'real_inventory_collected': True, 'synthetic': False, 'collected_at': data['collected_at'],
|
|
'server_release': data['server']['os_version'], 'os_build': data['server']['os_build'],
|
|
'product_type': data['server']['product_type'],
|
|
'schema_validation': 'passed',
|
|
'checks': {name: {'status': check['status'], 'error_codes': [e['code'] for e in check['errors']],
|
|
'permission_limitations_reported': bool(check['permission_limitations'])}
|
|
for name, check in data['checks'].items()},
|
|
'counts': {name: len(rows) for name, rows in data['inventory'].items()},
|
|
'review_required': True,
|
|
}
|
|
(destination / 'validation-summary.json').write_text(json.dumps(summary, indent=2), encoding='utf-8')
|
|
print(json.dumps(summary, indent=2))
|
|
print('Review partial/failed checks. Keep full inventory/reports private; validation-summary.json omits hostnames, accounts, IPs, paths and certificate identifiers.')
|
|
except (OSError, ValueError, RuntimeError):
|
|
parser.exit(1, 'Validation did not finish. Check supported local Server OS, 64-bit Python, script policy, read permissions and a new writable destination. Raw command diagnostics are excluded.\n')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|