# Planned Features

This document tracks planned features and enhancements for the Bash Script Generator.

## CMMC Compliance Server Configuration

### Overview
Add comprehensive CMMC (Cybersecurity Maturity Model Certification) compliance features to ensure servers meet DoD cybersecurity requirements for handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

### Goals
- Automate CMMC Level 1-3 compliance configuration
- Implement required security controls
- Generate compliance reports
- Support for FCI/CUI data handling requirements
- Ensure audit trail and logging compliance

### Proposed Implementation

#### CMMC Control Domains to Implement:

1. **Access Control (AC)**
   - Role-based access control (RBAC)
   - Least privilege principle
   - Account management (creation, modification, disabling)
   - Session management and timeout
   - Remote access controls
   - External connection management
   - Access review and recertification

2. **Identification and Authentication (IA)**
   - Multi-factor authentication (MFA/2FA)
   - Strong password policies
   - Account lockout policies
   - Password complexity requirements
   - Session management
   - Public key infrastructure (PKI)
   - Certificate-based authentication

3. **Media Protection (MP)**
   - Encryption at rest
   - Secure media disposal
   - Media sanitization procedures
   - Encrypted backups
   - Removable media controls

4. **System and Communications Protection (SC)**
   - Network segmentation
   - Firewall configuration
   - Encryption in transit (TLS/SSL)
   - VPN setup (FIPS-compliant)
   - Denial of service protection
   - Boundary protection
   - Cryptographic key management

5. **System and Information Integrity (SI)**
   - Malware protection (antivirus, EDR)
   - Security monitoring
   - Intrusion detection/prevention
   - File integrity monitoring
   - Spam protection
   - System alerts and notifications

6. **Audit and Accountability (AU)**
   - Comprehensive logging
   - Log retention policies
   - Time synchronization (NTP)
   - Audit log protection
   - Log review and analysis
   - Centralized logging (SIEM)

7. **Configuration Management (CM)**
   - Security configuration baselines
   - Change management
   - Configuration monitoring
   - Software inventory
   - Least functionality principle

8. **Incident Response (IR)**
   - Incident response plan implementation
   - Incident tracking
   - Incident reporting procedures
   - Backup and recovery procedures

9. **Maintenance (MA)**
   - Maintenance tools management
   - Non-local maintenance controls
   - Maintenance personnel controls

10. **Risk Management (RM)**
    - Risk assessment procedures
    - Vulnerability scanning
    - Risk mitigation

11. **Security Assessment (CA)**
    - Security control assessments
    - Penetration testing support
    - Compliance scanning

### Features to Include:

1. **Access Control Implementation**
   - Configure sudoers with least privilege
   - Set up user groups and permissions
   - Implement session timeouts
   - Configure SSH access controls
   - Set up account expiration policies

2. **Authentication Hardening**
   - Enforce strong password policies (PAM)
   - Configure password complexity
   - Set account lockout thresholds
   - Enable MFA/2FA (Google Authenticator)
   - Configure SSH key-only authentication option

3. **Encryption Configuration**
   - Full disk encryption (LUKS)
   - Encrypted swap
   - TLS/SSL configuration
   - Encrypted backups
   - Database encryption

4. **Logging and Monitoring**
   - Comprehensive audit logging (auditd)
   - Centralized syslog configuration
   - Log rotation and retention
   - Time synchronization (NTP/Chrony)
   - Security event monitoring

5. **Network Security**
   - Firewall configuration (UFW/iptables)
   - Network segmentation
   - VPN setup (FIPS-compliant)
   - Intrusion detection (Fail2ban)
   - Network monitoring

6. **Malware Protection**
   - Antivirus installation (ClamAV)
   - EDR agent installation
   - File integrity monitoring (AIDE, Tripwire)
   - Real-time scanning configuration

7. **System Hardening**
   - Disable unnecessary services
   - Remove unnecessary packages
   - Secure kernel parameters
   - File system permissions
   - SELinux/AppArmor configuration

8. **Compliance Reporting**
   - CMMC compliance checklist
   - Security configuration reports
   - Audit log summaries
   - Vulnerability assessment reports
   - Compliance status dashboard

### UI Integration

Add to the web form:
- [ ] Enable CMMC compliance mode
- [ ] Select CMMC Level (1, 2, or 3)
- [ ] Configure access control requirements
- [ ] Set up authentication policies (MFA, password complexity)
- [ ] Enable encryption (disk, network, backups)
- [ ] Configure comprehensive logging
- [ ] Set up malware protection
- [ ] Configure network security controls
- [ ] Enable file integrity monitoring
- [ ] Set up compliance reporting

### Technical Considerations

#### Tools to Integrate:
- `auditd` - Comprehensive audit logging
- `aide` / `tripwire` - File integrity monitoring
- `clamav` - Antivirus/antimalware
- `fail2ban` - Intrusion prevention (already included)
- `pam` modules - Authentication policies
- `selinux` / `apparmor` - Mandatory access control
- `cryptsetup` - Disk encryption
- `rsyslog` / `syslog-ng` - Centralized logging
- `chrony` / `ntpd` - Time synchronization

#### CMMC Level Requirements:
- **Level 1:** Basic cyber hygiene (17 controls)
- **Level 2:** Intermediate cyber hygiene (110 controls)
- **Level 3:** Good cyber hygiene (110+ controls, advanced)

#### Script Structure:
```bash
# Proposed function structure
configure_cmmc_access_control()
setup_cmmc_authentication()
configure_cmmc_encryption()
setup_cmmc_logging()
configure_cmmc_network_security()
install_cmmc_malware_protection()
harden_system_cmmc()
generate_cmmc_compliance_report()
```

### Security Considerations

- Follow CMMC control requirements precisely
- Ensure FIPS 140-2 compliance where required
- Implement defense in depth
- Regular compliance audits
- Maintain audit trails
- Secure configuration management
- Incident response capabilities

### Compliance Frameworks

- CMMC Level 1 (Basic)
- CMMC Level 2 (Intermediate) - Most common
- CMMC Level 3 (Advanced)
- NIST SP 800-171 alignment
- DFARS 252.204-7012 compliance

### Status
**Status:** Planned for future release  
**Priority:** High (for DoD contractors)  
**Estimated Complexity:** Very High

---

## Automated Security Patching Based on CVE Databases

### Overview
Add automated security patching functionality that monitors CVE (Common Vulnerabilities and Exposures) databases and applies security patches based on reliable CVE reports.

### Goals
- Automate security patch management
- Integrate with reliable CVE databases (NVD, Ubuntu Security Notices, etc.)
- Provide scheduled patching options
- Generate reports on applied patches
- Support for different patch urgency levels (Critical, High, Medium, Low)

### Proposed Implementation

#### Features to Include:
1. **CVE Database Integration**
   - NVD (National Vulnerability Database)
   - Ubuntu Security Notices (USN)
   - Debian Security Advisories (DSA)
   - Package-specific CVE tracking

2. **Patch Management Script**
   - Automated vulnerability scanning
   - Patch availability checking
   - Selective patching (by severity level)
   - Dry-run mode for testing
   - Rollback capabilities

3. **Scheduling Options**
   - Daily automated security updates
   - Weekly patch review and application
   - Manual trigger option
   - Maintenance window scheduling

4. **Reporting**
   - CVE reports (affected packages, severity)
   - Patch application logs
   - System compliance status
   - Email/notification support

5. **Configuration Options**
   - Severity thresholds (Critical/High only, or all)
   - Exclude specific packages from auto-patching
   - Whitelist/blacklist packages
   - Reboot requirements handling

### Technical Considerations

#### Tools to Integrate:
- `apt-listchanges` - View changelogs
- `unattended-upgrades` - Already included, enhance configuration
- `apt-audit` or similar - CVE scanning
- `debsums` - Verify package integrity
- Custom CVE API integration

#### Script Structure:
```bash
# Proposed function structure
scan_cve_vulnerabilities()
apply_security_patches()
generate_cve_report()
schedule_automatic_patching()
```

### UI Integration

Add to the web form:
- [ ] Enable automated CVE-based patching
- [ ] Select severity levels (Critical, High, Medium, Low)
- [ ] Configure update schedule (Daily, Weekly, Manual)
- [ ] Set maintenance window
- [ ] Configure email notifications
- [ ] Package exclusion list

### Security Considerations

- Ensure patches are from official repositories only
- Verify package signatures
- Test patches in staging before production
- Maintain audit logs
- Support for air-gapped systems

### Future Enhancements

- Integration with vulnerability scanners (OpenVAS, Nessus)
- Compliance reporting (CIS Benchmarks, STIG)
- Multi-server management
- Patch testing in containers before applying
- Integration with SIEM systems

### Status
**Status:** Planned for future release  
**Priority:** High  
**Estimated Complexity:** Medium-High

---

## VPN Connection Setup for Organizations

### Overview
Add functionality to configure and set up VPN connections for organizational use, supporting multiple VPN protocols and centralized management.

### Goals
- Automate VPN server setup (WireGuard, OpenVPN, IPSec)
- Configure VPN client connections
- Support for site-to-site and remote access VPNs
- Centralized VPN management
- Integration with authentication systems (LDAP, RADIUS)

### Proposed Implementation

#### VPN Server Options:
1. **IPSec/IKEv2** ⭐ **FIPS 140-2 Compliant**
   - **Best FIPS compliance** - Can use FIPS 140-2 validated cryptographic modules
   - Native OS support
   - Fast reconnection
   - Good for mobile devices
   - Strong security
   - Recommended for government/enterprise requiring FIPS compliance
   - Use strongSwan or other FIPS-validated implementations

2. **OpenVPN** ⚠️ **FIPS Compatible (with configuration)**
   - Can support FIPS 140-2 when using FIPS-validated OpenSSL libraries
   - Requires careful configuration and FIPS mode enablement
   - Mature and widely supported
   - Flexible configuration
   - Strong encryption (AES-256, SHA-256)
   - Cross-platform support
   - **Note:** Must use FIPS-validated OpenSSL and enable FIPS mode

3. **WireGuard** ❌ **Not FIPS 140-2 Validated**
   - Modern, fast, secure VPN protocol
   - Uses modern cryptography (ChaCha20, Curve25519) - not yet FIPS-validated
   - Simple configuration
   - Low overhead
   - Built-in key management
   - **Note:** Not suitable for environments requiring FIPS 140-2 compliance

#### Features to Include:
1. **Server Configuration**
   - VPN server installation and setup
   - Network interface configuration
   - Firewall rules (UFW/iptables)
   - Routing configuration
   - DNS configuration for VPN clients

2. **Client Management**
   - Generate client configuration files
   - QR code generation for mobile setup
   - Client certificate/key management
   - User access control
   - Bandwidth limiting per user

3. **Security Features**
   - Strong encryption (AES-256, ChaCha20)
   - **FIPS 140-2 compliance option** (for IPSec/OpenVPN)
   - Perfect Forward Secrecy
   - Kill switch (block non-VPN traffic)
   - DNS leak protection
   - Split tunneling options
   - FIPS-validated cryptographic modules (when required)

4. **Monitoring & Logging**
   - Connection logs
   - Bandwidth usage tracking
   - Active connections monitoring
   - Connection statistics

5. **Integration Options**
   - LDAP/Active Directory authentication
   - RADIUS integration
   - OAuth/2FA support
   - Certificate-based authentication

### UI Integration

Add to the web form:
- [ ] Enable VPN server setup
- [ ] Select VPN protocol (WireGuard, OpenVPN, IPSec)
- [ ] **Enable FIPS 140-2 compliance mode** (for IPSec/OpenVPN)
- [ ] Configure VPN network (subnet, IP range)
- [ ] Set up authentication method
- [ ] Configure DNS servers for VPN clients
- [ ] Enable kill switch
- [ ] Set bandwidth limits
- [ ] Configure client access rules

### Technical Considerations

#### Tools to Integrate:
- `wireguard` / `wireguard-tools`
- `openvpn` / `easy-rsa`
- `strongswan` (for IPSec) - **Supports FIPS 140-2**
- `openssl` (FIPS-validated version for OpenVPN FIPS mode)
- `ufw` / `iptables` (firewall rules)
- `qrencode` (QR code generation)

#### FIPS 140-2 Requirements:
- **IPSec**: Use strongSwan with FIPS-validated cryptographic libraries
- **OpenVPN**: Requires FIPS-validated OpenSSL library and FIPS mode configuration
- **WireGuard**: Currently not FIPS-validated (use IPSec/OpenVPN for FIPS requirements)
- System must have FIPS mode enabled: `/proc/sys/crypto/fips_enabled`
- Use only FIPS-approved algorithms (AES-256, SHA-256, RSA, ECDSA)

#### Script Structure:
```bash
# Proposed function structure
install_vpn_server()
configure_vpn_network()
setup_vpn_firewall()
generate_client_config()
setup_vpn_authentication()
monitor_vpn_connections()
```

### Security Considerations

- Use strong encryption algorithms
- **For FIPS compliance**: Use IPSec with strongSwan or OpenVPN with FIPS-validated OpenSSL
- Implement proper key rotation
- Secure key storage
- Network isolation
- Regular security audits
- Access control and user management
- **FIPS 140-2**: Ensure system crypto modules are FIPS-validated
- Use only FIPS-approved cryptographic algorithms when FIPS mode is enabled

### Status
**Status:** Planned for future release  
**Priority:** Medium-High  
**Estimated Complexity:** High

---

## Central SIEM Server Setup

### Overview
Add functionality to set up and configure a centralized Security Information and Event Management (SIEM) server for collecting, analyzing, and correlating security events across the organization.

### Goals
- Centralized log collection from multiple servers
- Real-time security event monitoring
- Threat detection and alerting
- Compliance reporting
- Integration with security tools

### Proposed Implementation

#### SIEM Solutions:
1. **ELK Stack (Elasticsearch, Logstash, Kibana)**
   - Open-source and flexible
   - Powerful search and analytics
   - Customizable dashboards
   - Large community support

2. **Wazuh**
   - Open-source SIEM/XDR
   - Built-in security monitoring
   - Compliance management
   - File integrity monitoring

3. **Graylog**
   - User-friendly interface
   - Good performance
   - Alerting capabilities
   - Stream processing

4. **Splunk (Enterprise)**
   - Industry standard
   - Powerful analytics
   - Extensive integrations
   - (Note: Commercial license required)

#### Features to Include:
1. **Log Collection**
   - Syslog server setup (rsyslog, syslog-ng)
   - Log forwarding configuration
   - Multiple log sources (servers, network devices, applications)
   - Log parsing and normalization
   - Log retention policies

2. **Event Processing**
   - Real-time log ingestion
   - Log parsing and enrichment
   - Event correlation rules
   - Threat intelligence integration
   - Custom rule creation

3. **Security Monitoring**
   - Intrusion detection alerts
   - Failed login attempts tracking
   - Unusual activity detection
   - Network anomaly detection
   - File integrity monitoring

4. **Alerting & Notifications**
   - Email alerts
   - Slack/Teams integration
   - PagerDuty integration
   - Custom webhook support
   - Alert severity levels

5. **Dashboards & Reporting**
   - Security dashboards
   - Compliance reports
   - Threat intelligence feeds
   - Custom visualizations
   - Scheduled reports

6. **Integration Capabilities**
   - Firewall log integration
   - IDS/IPS integration
   - Endpoint detection (EDR)
   - Cloud service logs (AWS CloudTrail, Azure Monitor)
   - Application logs

### UI Integration

Add to the web form:
- [ ] Enable SIEM server setup
- [ ] Select SIEM solution (ELK, Wazuh, Graylog)
- [ ] Configure log storage (size, retention)
- [ ] Set up log sources (servers to monitor)
- [ ] Configure alerting (email, webhooks)
- [ ] Set up compliance reporting
- [ ] Configure threat intelligence feeds
- [ ] Set alert thresholds

### Technical Considerations

#### Tools to Integrate:
- `elasticsearch`, `logstash`, `kibana` (ELK Stack)
- `wazuh-manager`, `wazuh-agent`
- `graylog-server`
- `rsyslog` / `syslog-ng`
- `filebeat` / `logstash` (log shippers)
- `nginx` / `apache` (reverse proxy)

#### Infrastructure Requirements:
- High storage capacity (logs can be large)
- Sufficient RAM for indexing
- Network bandwidth for log collection
- Backup strategy for log data

#### Script Structure:
```bash
# Proposed function structure
install_siem_server()
configure_log_collection()
setup_log_forwarding()
configure_alerting()
setup_dashboards()
configure_threat_intelligence()
setup_compliance_reporting()
```

### Security Considerations

- Encrypt log transmission (TLS)
- Secure SIEM server access
- Role-based access control
- Log integrity verification
- Regular backups
- Network segmentation
- SIEM server hardening

### Compliance & Reporting

- Support for compliance frameworks:
  - PCI DSS
  - HIPAA
  - GDPR
  - SOC 2
  - ISO 27001
- Automated compliance reports
- Audit trail maintenance
- Data retention policies

### Status
**Status:** Planned for future release  
**Priority:** High  
**Estimated Complexity:** Very High

---

## FIPS-Hardened Docker Images

### Overview
Add support for using FIPS 140-2 validated Docker images and configuring Docker to run in FIPS-compliant mode for environments requiring cryptographic compliance.

### Goals
- Configure Docker to use FIPS-validated cryptographic libraries
- Support for FIPS-hardened base images
- Ensure container runtime uses FIPS-compliant crypto
- Validate Docker daemon FIPS compliance
- Support for FIPS-validated container registries

### Proposed Implementation

#### Features to Include:
1. **Docker FIPS Configuration**
   - Enable FIPS mode in Docker daemon
   - Configure FIPS-validated cryptographic libraries
   - Verify Docker engine FIPS compliance
   - Set up FIPS-compliant TLS for Docker API

2. **FIPS-Hardened Base Images**
   - Support for Red Hat UBI (Universal Base Image) FIPS images
   - Support for FIPS-validated base images
   - Image scanning for FIPS compliance
   - Custom FIPS-hardened image building

3. **Container Runtime Security**
   - Ensure containers use FIPS-validated crypto
   - Configure containerd/runc for FIPS mode
   - Validate container image signatures
   - Enforce FIPS-approved algorithms only

4. **Image Registry Integration**
   - Support for FIPS-compliant registries
   - Image signing and verification
   - FIPS compliance scanning
   - Secure image pull/push

5. **Compliance Validation**
   - Docker FIPS compliance checks
   - Container image FIPS validation
   - Runtime FIPS mode verification
   - Compliance reporting

### UI Integration

Add to the web form:
- [ ] Enable FIPS-hardened Docker mode
- [ ] Select FIPS-validated base images
- [ ] Configure FIPS-compliant image registry
- [ ] Enable FIPS compliance scanning
- [ ] Set up image signing/verification
- [ ] Configure FIPS-validated TLS for Docker API

### Technical Considerations

#### Tools to Integrate:
- `docker` with FIPS-validated libraries
- `containerd` / `runc` (FIPS-compliant versions)
- Red Hat UBI FIPS images
- Image scanning tools (Trivy, Clair)
- Image signing tools (cosign, Notary)

#### FIPS Requirements:
- System must have FIPS mode enabled
- Docker daemon must use FIPS-validated OpenSSL
- Container runtime must use FIPS crypto modules
- Base images must be FIPS-validated (e.g., Red Hat UBI FIPS)
- Only FIPS-approved algorithms (AES-256, SHA-256, RSA, ECDSA)

#### Script Structure:
```bash
# Proposed function structure
enable_docker_fips_mode()
configure_fips_docker_daemon()
setup_fips_hardened_images()
validate_docker_fips_compliance()
configure_fips_image_registry()
scan_images_fips_compliance()
```

### Security Considerations

- Use only FIPS-validated cryptographic libraries
- Verify Docker daemon FIPS compliance
- Scan all container images for FIPS compliance
- Use signed and verified images only
- Enforce FIPS mode at container runtime
- Regular FIPS compliance audits

### FIPS-Validated Image Sources

- **Red Hat UBI FIPS** - FIPS-validated Universal Base Images
- **RHEL FIPS images** - Red Hat Enterprise Linux FIPS containers
- **Custom FIPS images** - Build from FIPS-validated base images
- **Third-party FIPS images** - From FIPS-compliant vendors

### Status
**Status:** Planned for future release  
**Priority:** High (for FIPS-required environments)  
**Estimated Complexity:** High

---

## Other Planned Features

### Additional server setup options
- [ ] SELinux/AppArmor configuration
- [ ] Log rotation and centralized logging (rsyslog, syslog-ng)
- [ ] Backup automation (rsync, rclone, cloud storage)
- [ ] SSL/TLS certificate management (Let's Encrypt automation)
- [ ] Database server setup (PostgreSQL, MySQL, MongoDB)
- [ ] Web server configuration (Nginx, Apache)
- [ ] Load balancer setup (HAProxy, Nginx)
- [ ] Monitoring stack (Prometheus, Grafana, AlertManager)
- [ ] Container orchestration (Kubernetes, Docker Swarm)

### UI Enhancements
- [ ] Profile presets (Safe remote server, Console access, Lab/dev box)
- [ ] Script preview before download
- [ ] Save/load configurations
- [ ] Multi-language support
- [ ] Dark mode

### Script Generator Improvements
- [ ] Support for other Linux distributions (CentOS/RHEL, Debian, Alpine)
- [ ] Cloud provider specific optimizations (AWS, Azure, GCP)
- [ ] Idempotency improvements
- [ ] Better error handling and rollback
- [ ] Script validation and testing

---

**Last Updated:** 2026-01-27  
**Maintainer:** Avni Ademi (@avni.ademi)