快速入門

From zero to a hardened host in a few minutes. Every step before apply is read-only.

1. Scan

tmaegis scan --auto-detect

--auto-detect identifies the operating system and the installed software, then runs only the rules that apply. To pick a platform yourself, use --target, for example --target linux or --target postgres.

2. Save a report

tmaegis scan --auto-detect --format html --output report.html
tmaegis scan --auto-detect --format sarif --output tmaegis.sarif

3. Preview the fixes

sudo tmaegis apply --auto-detect --dry-run

A dry run shows exactly what would change and touches nothing.

4. Apply

sudo tmaegis apply --auto-detect --deadman-timeout 60

A snapshot is taken before every change. Configuration files are syntax-checked before they replace the live file, for example with sshd -t. With the dead-man's switch, you must confirm within the timeout or everything is rolled back.

5. Roll back

tmaegis rollback --list      # restore points
sudo tmaegis rollback        # latest snapshot
sudo tmaegis rollback --id <snapshot-id>

Cloud accounts

tmaegis scan --target aws                             # read-only, uses your CLI credentials
tmaegis apply --target aws --terraform-out ./proposed  # writes Terraform, never changes the account

Network devices

tmaegis scan --target cisco-ios --device-config r1.cfg

Recommendations that cannot be checked automatically are skipped by default. Add --include-manual to list them with instructions.