61. Scheduled hardening: a saved plan that runs in its window
This guide describes Lawliet 1.6.3.b (the current release, a beta: earlier releases are beta. The first stable release will be 2.0.0). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
A schedule is a hardening batch (chapter 57) saved with a weekly window - for example "every Sunday 02:00-05:00, Europe/Berlin". It is approved once; from then on it runs in every window by itself, until someone edits it. Every run goes through exactly what a batch goes through: the planner and access guards, the lockout and dependency checks, the executor's own re-check and the checks at dispatch, the validation and the rollback records.
| Task | Permission | Four-eyes |
|---|---|---|
| Save a schedule, change it, pause, resume, skip the next run, delete it | Run hardening | no - a schedule never runs before it is approved |
| Approve a schedule | Run hardening | as a batch: yes when dual control is on for "Execute remediation"; with a lockout risk accepted, never the person who saved it |
| See schedules and their runs | View hardening | - |
61.1 What one approval covers#
- The approval names the schedule's revision, its exact hosts (by id), its number of controls and the lockout-risk controls accepted. It covers every run of that revision.
- Any change - controls, hosts, profile, risks, name or window - makes a new revision: the schedule shows edited - approve again and does not run until it is approved again. A change made while a window is open stops the rest of that run (what was already started keeps going).
- A host group is resolved when the schedule is approved and frozen: if its listed members change afterwards (one added, removed or swapped), the schedule shows why ("the host group changed since its approval") and does not run until it is approved again. Only the group's listed members count (never tags).
- The approval also lasts only while the person who saved the schedule and the person who approved it are both active and still hold Run hardening. If one is disabled or loses the permission, runs stop and the schedule says why: approve it again (or, for the creator, save it again as someone else).
- No risk is ever accepted automatically on a run, even with
HARDENING_AUTO_ACCEPT_RISKSon (as for Under Attack): a lockout-risk control runs only if it was accepted, per control, when the schedule was saved. A control that becomes lockout-risky later is refused on each run, with the reason; the other controls still run. The runs' hardening work carries this with it: anything that continues it later (its approval, a guard re-check) also never accepts a risk automatically. - Pause, Resume and Skip next run change no plan and keep the approval.
61.2 Procedure: save a schedule#
- Build the selection as for a batch: Hardening > Planner > Plan N hosts, or a completed scan's Fix plan (57.2, 57.3).
- Press Save as schedule (next to the batch buttons).
- Give it a Name, choose the days, the Start time, the length in Minutes (15 to 1440) and the Time zone (an IANA name such as
Europe/BerlinorUTC; your browser's is filled in). - Press Save schedule. If a selected control can lock you out, or changes how Lawliet reaches a host, you are asked to accept that first, exactly as for a batch - also when the server accepts risks automatically for other hardening. The accepted lockout controls are listed on the schedule and are part of what the approver signs; an accepted lockout risk needs a second administrator to approve.
- The schedule is saved waiting for approval, under Hardening > Schedules.
The window is shown as its start and length, for example Sat 23:00 for 4 h (Europe/Berlin). A window may cross midnight (Saturday 23:00 for 4 hours ends Sunday 03:00). On the night the clocks change, the start is the wall-clock time of the first occurrence and the length is real minutes.
61.3 Procedure: approve a schedule (four-eyes)#
- Open Hardening, section Schedules.
- Press Approve schedule: N controls on M hosts.
- With dual control on, the request is held for a second officer (Approvals); the summary names the revision, the host ids, the accepted lockout controls and the counts, and that it then runs every week until edited. If the schedule changed after you opened the page, the approval is refused: reload and approve what is there now.
61.4 What a run does#
While the window is open, every minute:
| Host | What happens |
|---|---|
| Online, nothing else hardening it | hardened: a batch of origin "schedule" is created and dispatched at once, approved by the schedule's approver (Hardening > Batches) |
| Offline | waiting until it reports, while the window lasts |
| Another hardening run (any batch, single run or schedule) is live on it, or a hardening rollback is in progress | waiting: a schedule never starts on a host that is being hardened or rolled back. (A person can still start a batch on a host a schedule is hardening; the planner's own checks then refuse the same or conflicting controls.) |
| A guard refuses it, or a risk the schedule did not accept appears | refused, with the reason |
| Nothing selected fails or applies there | nothing to run, with the reasons |
No host is started in the last 5 minutes of the window. When the window ends:
- a change that was not yet delivered to its host is withdrawn (its step reads "Not delivered before the maintenance window ended"); validations keep running;
- a host never reached is missed, with why (offline, busy);
- the run is closed, written to the audit log, and its summary - per host, with the batch numbers - is posted to the review queue (medium when a host was missed or refused, low otherwise). Results keep arriving in Batches after the window.
Every run is recorded in the audit log when it starts, when it dispatches, when it is skipped or not approved, and when it closes.
61.5 Procedure: skip the next run, pause, change, delete#
- Skip next run: the next window that opens is recorded skipped and nothing runs; the one after runs as usual. Press Do not skip the next run to undo.
- Pause / Resume: no run starts while paused (a run in an open window starts no more hosts).
- Change name or window: a new revision - it stops running until approved again (61.1). To change the controls or hosts, save the new selection as a new schedule and delete the old one.
- Run history: the last 20 runs with their summaries.
- Delete: no more runs. What earlier runs changed on hosts stays; roll it back from Batches (57.6).
61.6 Notes#
- Sandbox schedules are shown with their sample runs but never run.
- The schedule carries its own weekly window, separate from any other window setting.