← ClaudeAtlas

hostwarden-fleet-auditlisted

Compare key policies across all servers in memory/machines/ to surface silent drift. Makes no configuration changes; writes one audit-trail line to each host's journal. Probes unattended-upgrades, sshd effective config and SSH CA trust, firewall posture, MTA, network stack and resolver, time sync, auto-reboot behaviour, mesh VPNs and their SSH servers, accounts and sudo rules, Ubuntu Pro/ESM coverage and needrestart mode, and the records of DNS resolvers that should answer alike. Use when the user asks to "fleet audit", "vergleiche alle server", "policy drift check", "are my servers configured the same?", or after a fix on one host to find which others carry the same bug.
hostwarden/hostwarden · ★ 2 · AI & Automation · score 61
Install: claude install-skill hostwarden/hostwarden
# hostwarden-fleet-audit Cross-machine policy audit. Hostwarden knows every host individually but has nothing that holds hosts against each other. This skill closes that gap by probing the same set of settings on every server in `memory/machines/` and rendering a side-by-side comparison so silent drift becomes visible. **No configuration changes.** The audit never alters any host's configuration. The only write is a single audit-trail line to each host's system journal (step 6 below). Acting on findings is a separate step (hostwarden-housekeeping for per-host fixes, or manual edits with explicit user approval). **Never run automatically** — only on explicit user request. ## When to use - "Run a fleet audit" - "Vergleiche die Policies auf allen Servern" - "Drift check across the fleet" - After fixing a config bug on one host: "which other hosts have the same problem?" Do NOT auto-invoke for generic phrases like "check my servers" — that maps to single-host housekeeping. A host with an `Appliance:` line in memory is compared only with hosts of the same appliance, and only where that appliance file's `## Housekeeping and Audits` section says how. Otherwise it goes on a "skipped: appliance not yet supported" list, decided from memory before any probe runs. Hosts are compared only within the same role and platform as well (`Role:` and `Platform:` in memory): a cell the platform file prescribes, such as WSL's firewall, never differs from a native host's as drift. The `##