Linux

Standalone sysadmin / network CLI tools. Each subfolder is an independent project with its own README.

Want one command? opskit/ bundles all the tools below behind a single opskit <command> launcher and ships them as an apt-installable .deb.

Tool	Lang	What it does
cpwd/	Python	Multi-threaded password rotation across network devices (Cisco, Fortinet, Palo Alto, …). Dry-run by default, CSPRNG passwords, connection test + verify, auto-rollback.
rcmd/	Bash	Parallel SSH command execution across a host fleet, results to CSV. Smart error classification, legacy-SSH support, Nagios-compatible exit codes.
mlpm/	Python	Cross-distro package upgrader across a host fleet (upgrader.py): apt/dnf/zypper/pacman/apk or local .deb install. Dry-run by default; optional Server Manager GUI via --gui. TXT+JSON reports, Nagios-compatible exit codes.
cvescan/	Python	Agentless, read-only CVE / security-update scanner across a Unix fleet. Uses each host's native package-manager security metadata (dnf/zypper/debsecan). TXT+JSON reports, Nagios-compatible exit codes.
hardaudit/	Python	Agentless, read-only security-hardening / compliance scanner. CIS-style checks (SSH config, file perms, privileged accounts, firewall, insecure services, kernel/policy) with a 0–100 per-host score. TXT+JSON reports, Nagios-compatible exit codes.
sshk/	Python	SSH public-key bootstrap across a host fleet — idempotent ssh-copy-id replacement in pure paramiko. Reads a host file or servers.json. TXT+JSON reports, Nagios-compatible exit codes.
opskit/	sh + deb	Unified opskit <command> launcher over all the tools above, packaged as an apt-installable .deb (dispatcher + debian/ packaging).

All SSH tools accept either a password (interactive prompt) or SSH-key authentication (--key, or agent/default keys); rcmd uses -k/--key.

See each subfolder's README.md for usage and supported platforms.

Status & roadmap

Maturity and verification status of each tool. "Verified" means exercised end-to-end against real hosts/devices; "syntax-checked" means it parses and the CLI/dispatch logic was tested, but it has not yet been run against live targets.

Tool	Version	Status	Verification
cpwd	—	Stable	Dry-run default; --key auth added; vendor command sets need per-firmware verification before --wet-run
rcmd	1.5.0	Stable	Used in practice; -k/--key auth added
mlpm	—	Rewritten	CLI upgrader is new (was a GUI-only server manager); syntax-checked, not yet run against real hosts; GUI retained under --gui
cvescan	—	New	Syntax-checked; not yet run against real RHEL/SUSE/Debian hosts
hardaudit	—	New	Syntax-checked; not yet run against real hosts
sshk	—	New	Syntax-checked; not yet run against real hosts
opskit	1.0.0	New	Dispatcher tested (resolution + arg forwarding for all 6 commands); .deb not yet built on a Debian host

TODO

• mlpm — run the CLI upgrader end-to-end against real Debian/RHEL/SUSE/Arch/Alpine hosts (dry-run and --wet-run); validate the .deb upload/install path and sudo/--ask-become-pass handling.
• sshk — run end-to-end (password bootstrap + --gen); verify idempotency on repeated runs.
• cvescan — run end-to-end against real RHEL/SUSE/Debian/Ubuntu hosts; add unit tests for the per-distro output parsers; consider a --self-test mode using sample fixtures.
• hardaudit — run end-to-end against real hosts; add unit tests for the check evaluators (octal-mode parsing, sshd -T parsing, severity weighting); tune the CHECKS table to a chosen baseline.
• opskit — build the .deb on Debian/Ubuntu (make deb) and clear any lintian findings; add bash completion (debian/opskit.bash-completion); optionally set up a reprepro/aptly apt repo so users can apt install opskit remotely.
• shared code — extract the common SSH layer (ssh_connect, command runner, targets loader, Nagios exit codes) now duplicated across mlpm/sshk/cvescan/hardaudit into a small shared module.
• cpwd — verify each vendor's CLI command sequence against current firmware before any production --wet-run.
• repo — choose and add a top-level LICENSE for the suite (only mlpm/ currently carries one).