Effective sshd
sshd state comes from sshd -T, so a drop-in in sshd_config.d that overrides the main file is reflected, not missed.
RHEL 9 fleet tooling · over SSH
linux-drift
Harden once, then know the moment anything moves. Capture a baseline, check against it, report what changed. Read-only.
$ git clone https://github.com/vikozs/linux-drift
linux-drift check -H hosts.txt --baseline drift_baseline.json web01.localhost.loc 6 drift item(s) 2 pkg 2 port db01.localhost.loc 0 drift item(s) 0 pkg 0 port Report: drift_report.json Excel: drift_report.xlsx Totals: 1 host with drift, 5 items, 2 pkg, 2 port
How it works
01
capture
snapshot the watched state
02
check
diff current against baseline, was -> now
What it does
Seven categories
sshd, sysctl, files (mode/owner/hash), packages, ports, users, groups. Narrow with --watch.
Self-contained
Each host is diffed against its own baseline. --golden holds a whole fleet to one reference host.
Read-only
Writes only local baseline and report files. A missing tool on a host yields an empty category, never an error.
Output
A report you can hand to anyone
A formatted Excel workbook plus a machine-readable JSON plan. Sheets:
SummaryDrifted ItemsPackage ChangesPort ChangesErrorsAbout
Safety
GUARDED
Read-only on every target. File contents are never collected, only a hash.
The rest of the family