Proactive Hardening Change Types

Proactive hardening change types run scheduled, read-first operations that enforce baseline security posture across the fleet. Audit-only types (IAM baseline, privileged account audit) make no changes — they produce findings and proposed remediation CRs for operator review. The SSH CA rotation type does make changes and supports full rollback.

---

SSH CA Rotation

Change type: ssh_ca_rotation

Generates a new SSH certificate authority keypair, distributes the new trusted CA public key to all hosts in scope, verifies acceptance, then revokes the old CA. During the distribute phase both old and new CA keys are trusted simultaneously, ensuring no host loses SSH access mid-rotation.

Phases:

1. Preflight — enumerate hosts in scope, verify SSH connectivity to each, check existing TrustedUserCAKeys configuration
2. Snapshot — capture the current TrustedUserCAKeys file on every host
3. Generate — generate a new CA keypair of the configured type on the CA host
4. Distribute — push the new CA public key to TrustedUserCAKeys on every host alongside the existing CA
5. Verify — confirm every host reports the new CA public key in its TrustedUserCAKeys file
6. Revoke — remove the old CA public key from TrustedUserCAKeys on every host
7. Report — emit per-host results and record the new CA key fingerprint

Parameters:

Parameter	Type	Default	Description
key_type	string	ed25519	CA key algorithm (ed25519 or rsa)
ca_key_path	string	/etc/ssh/nexplane_ca	Path where the CA private key is stored on the CA host
trusted_user_ca_keys_path	string	/etc/ssh/trusted_user_ca_keys	Path to the TrustedUserCAKeys file on managed hosts
ca_host_asset_id	string	—	Asset ID of the host that holds the CA private key; if omitted, the platform generates and holds the key

Rollback: Restores the original TrustedUserCAKeys file on all hosts from the snapshots captured in phase 2.

Connector: Nexplane Agent

---

AWS IAM Role Baseline

Change type: aws_iam_role_baseline

Scans AWS IAM roles for stale usage and overprivileged permissions. This is a read-only audit — no IAM changes are made during execution. When generate_remediations is enabled, the executor produces a batch of proposed iam_role_remediate CRs for operator review.

Phases:

1. Preflight — verify AWS connector credentials and required IAM read permissions
2. Scan — enumerate all IAM roles, retrieve last-used timestamps and attached policies
3. Analyze — flag roles with no usage beyond stale_threshold_days and roles with wildcard permissions on sensitive service namespaces
4. Report — emit findings list; if generate_remediations is true, create draft remediation CRs for each finding

Read-only — no IAM changes made

This change type does not modify any IAM policies or roles. Remediation CRs generated by this type are separate change requests that require independent approval before execution.

Parameters:

Parameter	Type	Default	Description
stale_threshold_days	int	90	Roles with no usage in this many days are flagged as stale
generate_remediations	bool	true	Whether to create draft remediation CRs for each finding

Rollback: Not applicable — this change type is read-only and makes no changes.

Connector: Nexplane Agent

---

Privileged Account Audit

Change type: privileged_account_audit

Queries Active Directory for members of Domain Admins, Enterprise Admins, and Schema Admins. Each account is evaluated for MFA registration, days since last interactive logon, and whether service accounts hold admin rights. Findings are emitted as a report. When generate_remediations is enabled, the executor produces a batch of proposed remediation CRs.

Phases:

1. Preflight — verify Active Directory connector credentials and LDAP connectivity
2. Query — enumerate members of Domain Admins, Enterprise Admins, and Schema Admins via LDAP; retrieve lastLogonTimestamp, pwdLastSet, userAccountControl, and MFA registration attributes for each account
3. Analyze — flag accounts with no MFA, accounts with lastLogonTimestamp older than stale_threshold_days, and service accounts (accounts whose name matches a service account naming pattern or whose description contains "service") with admin group membership
4. Report — emit findings list; if generate_remediations is true, create draft remediation CRs for each finding

Read-only — no Active Directory changes made

This change type does not modify any AD accounts, groups, or attributes. Remediation CRs generated by this type are separate change requests that require independent approval before execution.

Parameters:

Parameter	Type	Default	Description
stale_threshold_days	int	90	Accounts with no logon in this many days are flagged as stale
generate_remediations	bool	true	Whether to create draft remediation CRs for each finding

Rollback: Not applicable — this change type is read-only and makes no changes to Active Directory.

Connector: Active Directory