Lab 30 — Control Evidence Collector

A Python security automation tool that collects system evidence, checks it against NIST SP 800-53 controls, and detects configuration drift between runs.

Environment

Field	Detail
Platform	Kali Linux 2025 (VMware Workstation)
Language	Python 3.11.9
Editor	GNU nano 8.1
Evidence Sources	/etc/passwd, /etc/ssh/sshd_config, /etc/sudoers
Output Format	Timestamped JSON
Scripts	collect.py, check.py
Working Directory	~/lab30

Script 1 — Evidence Collector

collect.py reads three system sources and saves the findings to a timestamped JSON file. Each run produces a new snapshot that can be compared against previous runs for drift detection.

Evidence collected per run:

Interactive user accounts from /etc/passwd (uid ≥ 1000)
SSH configuration from /etc/ssh/sshd_config
Sudo rights from /etc/sudoers

Step 1 — collect.py output showing timestamped JSON evidence — Step 1 — collect.py — timestamped JSON evidence file saved successfully

Step 2 — collect.py output with SSH config and sudo rights added — Step 2 — collect.py expanded — SSH config and sudo rights now included in evidence

Script 2 — Baseline Checker and Drift Detector

check.py loads the two most recent evidence snapshots. It runs each finding through a set of NIST SP 800-53 rules and flags any change between runs as configuration drift.

Step 3 — baseline check output showing FAIL, WARN, and PASS results — Step 3 — check.py — baseline check results mapped to NIST 800-53 controls

NIST SP 800-53 Control Mapping

Control	Description	Check	Result
AC-17	Remote Access	PermitRootLogin must be set to no	FAIL → PASS
AC-6	Least Privilege	Flags broad sudo access (ALL:ALL)	WARN
IA-2	User Accounts	Flags unexpected interactive users	PASS

Self-Test — Drift Detection Validated

To validate drift detection, PermitRootLogin no was deliberately added to /etc/ssh/sshd_config. A new evidence snapshot was collected and check.py was run against it.

Results confirmed:

AC-17 status changed from FAIL to PASS
Drift detection flagged: SSH CONFIG CHANGE — was: {} | now: {'PermitRootLogin': 'no'}

Step 4 — self-test output showing FAIL becoming PASS and drift detected — Step 4 — self-test — PermitRootLogin set to no; AC-17 flips from FAIL to PASS; drift detected

Detection Engineering Insights

This lab demonstrates the core loop of any configuration monitoring system: collect a snapshot, compare it to a baseline, flag what changed. The same pattern underlies enterprise tools like AWS Config, Azure Policy, and Qualys Policy Compliance — this tool implements that logic from scratch in Python.

Key engineering decisions made during the build:

Evidence is stored as timestamped JSON so every run is independently auditable
The sudoers file requires elevated privileges to read — the tool handles PermissionError gracefully and flags it rather than crashing
Drift is detected by comparing Python sets, which handles ordering differences between runs cleanly
FAIL vs WARN distinction mirrors real SOC alert severity: FAIL means a specific requirement is unmet; WARN means something exists that warrants human review

Outcome

▸ collect.py — user accounts, SSH config, and sudo rights collected to timestamped JSON
▸ check.py — NIST SP 800-53 baseline check implemented across 3 controls
▸ Drift detection confirmed — SSH config change caught between runs
▸ AC-17 status changed from FAIL to PASS after PermitRootLogin no was set
▸ Lab 30 confirmed — all scripts functional on Kali Linux