Fixing findings

Solution paths, the fix script – and why NODE64 runs nothing itself.

Every finding comes with the commands that fix it. Not as an extra, but as the standard: advice without a way to act on it is homework.

Several paths #

For many problems there is more than one sensible fix. An open SSH port can be protected with fail2ban, with an nftables rule, or with a firewall in front. NODE64 shows all fitting paths with their commands; one is marked as recommended.

Which one suits you, you know better: someone already running nftables does not want ufw on top.

The fix script #

The device view offers Upgrade plan as a script. That is an sh file bundling all open findings of this device – one block per finding with rating, title, rationale as a comment and the commands of the recommended path.

#!/bin/sh
#
# NODE64 – suggested remediation for my-server
#
# AT YOUR OWN RISK. This script changes your system. Read every line,
# understand what it does, and make a backup or snapshot first.
#
# NODE64 never runs anything on your machine – you do.

The notice at the top is meant seriously. The script is a working draft, not a button. Read it, cut what does not fit, then run it.

Why NODE64 runs nothing itself #

Because an agent that accepts commands from outside is exactly the thing it is supposed to protect you from. A compromised monitoring server would have access to every connected system – across all customers at once. That door does not exist here: the agent has no command channel, and that is verifiable in the open source code.

The price is that you have to type. The value is that nobody else can.

After fixing #

Nothing else to do. On the next run NODE64 checks the condition again:

No longer met → the finding is closed as fixed, with a timestamp.
Still met → it stays open. Most common reason: a service was not reloaded, or a reboot is pending.

If you do not want to wait for the next interval:

node64-agent once

If you do not want to fix it #

That is an answer too – see Understanding findings, section "What you can do with a finding".