26. Hardening: fix plans, executions and rollback

Hardening changes the configuration of a managed host so that failed compliance controls pass. It is the only part of the compliance area that changes hosts, so every live run is held for approval and every step that has a rollback script can be reversed.

The life of a hardening run:

scan -> Fix plan (choose fixes, one host) -> run "Pending approval"
     -> Approve & Execute (four-eyes) -> agent runs each step -> Completed / Partially completed / Failed
     -> optional Rollback (four-eyes) -> Rolled back

Permissions:

26.1 What the Hardening page shows#

Path: Hardening.

• A warning: "Hardening changes live system configuration. Dry-run executions preview what would happen without queuing real commands. Approve non-dry-run executions only after reviewing all steps and confirming the target agent."
• "N failed steps across all executions" with View in review queue, when steps failed.
• Recovery / break-glass panel (26.5).
• Tiles: Total, Running, Done, Dry OK, Partial, Failed, Pending.
• Filters: Search ID or framework... and a status list (Pending approval, Approved, Executing, Completed, Dry run complete, Partially completed, Failed, Rolled back, Cancelled).
• Table: Mode (live or dry run), Status, Frameworks, Steps, Created. Details opens a run.

The run drawer shows the header ("Live execution - scan #N" or "Dry-run preview - no real commands were queued"), Status, Mode, Requested by, Approved by, the Step summary (each step with its output), View failed steps in Review Queue, and the Actions that apply to the run's status.

26.2 Procedure: approve and execute a run#

Before you start: the run was created from a scan (chapter 22). If any selected control can lock you out of the host, issue its recovery artifact first (26.5).

Risk: the commands run with the agent's privileges and change live system configuration. A wrong fix can stop a service or block remote access. Rollback: Rollback (26.3) reverses each step that has a rollback script. Steps without one must be reverted by hand.

1. Open Hardening and press Details on the run with status Pending approval.
2. Read every step in Step summary and check the target agent.
3. Press Approve & Execute. The confirmation says: "This queues N remediation command(s) for execution on agent #ID" and warns that only steps with a rollback script can be reversed.
4. Press Confirm and execute.
5. Four-eyes: type a reason and press Send for approval (20.4). A second person approves in Approvals; you then press Execute now in Approvals > My requests within the execution window.

What you see: "Execution approved - remediation commands queued." The status moves to Executing, then Completed, Partially completed or Failed. The agent receives the commands on its next check-in.

6. Run the compliance scan again to confirm the controls now pass.

If it fails:

26.3 Procedure: roll back a run#

Rollback is offered for runs that are Approved, Executing, Completed, Partially completed or Failed.

Risk: rollback also changes the host; it restores the previous settings of the reversible steps. Rollback of the rollback: none - re-run hardening if needed.

1. Open the run with Details and press Rollback.
2. Read the note: "Rollback queues reversal commands on the agent. Only steps with a rollback script will be reversed. Validate system state after rollback and re-run a compliance scan to confirm restoration."
3. Press Confirm rollback, then complete the four-eyes request as in 26.2 step 5.

What you see: the status becomes Rolled back when the agent has reported.

If it fails: "Rollback failed: ..." names the reason. Steps without a rollback script are not reversed; revert them by hand.

26.4 Procedure: cancel a run#

Cancel is offered while a run is Pending approval, Approved or Executing. No four-eyes.

1. Open the run and press Cancel.
2. Read: "Cancel this execution? Steps already queued on the agent may continue until the agent receives the cancellation on next check-in."
3. Press Confirm cancel. You see "Execution cancelled."

A step that already ran is not undone by Cancel. Use Rollback for that.

26.5 Recovery and break-glass#

Before you apply a control that can lock you out - key-only SSH, firewall lockdown, disabling the built-in administrator, disk encryption - issue the matching recovery artifact, so there is always one authorised way back in.

Procedure: issue and download a recovery artifact#

Permission: Run hardening. Four-eyes: yes for both issue and download.

1. Open Hardening and expand Recovery / break-glass.
2. Choose the host in Select a host... and the kind.
3. Type the reason in Reason (audited) and press Issue. Complete the four-eyes request.
4. When the artifact is ready, press Download once. Complete the four-eyes request.
5. Store the secret offline, in your organisation's safe.

Each secret can be downloaded once, then it is purged. If the download fails ("Download failed (already used, or not ready).") issue a new artifact.

Lock-out-risky controls in the Fix plan#

If Start hardening answers "One or more selected controls can lock you out of this host. Issue the recovery artifact(s) below, then retry with accept_lockout_risk=true.", the run was not created. The console's Fix plan does not send that confirmation. Untick those controls and start hardening for the rest; apply the risky controls in a planned window, after issuing the recovery artifact, by your own change procedure.