49. Under Attack: what BASELINE does on a host
This guide describes Lawliet 1.5.14.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
Chapter 48 covers plans, drills, starting and ending; chapter 51 the console. This chapter covers what a BASELINE activation puts on each host in its scope: every hardening control the planner says is safe on that host, applied at once - without the audit stage and without waiting for a second approval - each with its exact rollback. The business keeps running: a control predicted to break something the host uses is not applied.
Every change below is one row in the activation's change list (the ledger). A change that could not be made is a row too, marked refused with its reason (49.2) - nothing is skipped silently, and a drill shows exactly the same rows without sending anything.
What a host needs:
| Need | Why | Without it |
|---|---|---|
| A Windows or Linux agent | the controls run through the hardening executor on the host | refused: unsupported_platform (macOS) |
| A compliance scan with failing controls | the planner builds the host's plan from it | no hardening is applied to that host |
| An approved do-not-disrupt baseline (42) and hardening telemetry | breakage prediction, the guards | controls without a high-confidence prediction are marked "applied without evidence" |
49.1 The safe hardening set, at once#
For each host the planner builds its plan (41) and the activation applies, without waiting for a second administrator and without the audit stage, every failing control that:
- passes every guard (Lawliet's own access, the do-not-disrupt baseline, domain controller safety, ...), its order and its prerequisites;
- is not already being enforced, and does not conflict with another control applied now;
- is not predicted to break clients seen using what it removes;
- is not a lockout-risk control (those need a recovery artifact first) and not a domain-wide Group Policy change (it would reach beyond the activation's scope).
A control the host's own script refuses (it saw the setting in use) changes nothing and is shown as refused by the host's guard, not as a failure.
A control applied without a high-confidence "no use seen" prediction - for example one with no telemetry - is marked "applied without evidence".
The work runs through the hardening executor as usual, so each control appears on the Hardening page as an execution, with its backup and rollback. Controls whose scripts change the same configuration file (or the Ubuntu firewall family) form one execution and are rolled back together; every other control is its own execution.
A control whose remediation fails on the host is rolled back at once, in case it changed part of the host. A control that is still waiting for the host when the activation ends is withdrawn and never runs.
49.2 Reading a refused change#
| Reason | Meaning | What to do |
|---|---|---|
never_touch_absolute | the Lawliet server or the operator's never-touch list | nothing; by design |
never_touch_protected | a domain controller or tier-0 host the plan does not include | include the category in the plan if it should be hardened |
unsupported_platform | macOS: the hardening catalog has no macOS content | none |
out_of_scope, sandbox_mismatch | the host is not in this activation | none |
49.3 At the end#
Ending (chapter 48) rolls back every change unless an administrator chose to keep it:
- a hardening control can be kept. If it was applied together with other controls (same configuration file) and one of them is kept, rolling the others back is refused - the file holds both changes - and the refusal goes to the review queue naming the kept control;
- a rollback the host reports as failed is shown as failed and goes to the review queue, never as rolled back.