Open Source

The tools we maintain in public are the same ones we bring to client engagements. Nothing is held back for a paid tier.

Why We Work in the Open

Compliance and hardening automation is not something you should have to take on trust. If a role claims to implement a CIS Benchmark control, you should be able to read exactly how it does that, see the discussion behind the decision, and change it when your environment needs something different.

That is why our work happens in public. Every control mapping, every safety check, and every design trade-off is visible, reviewable, and open to challenge. It keeps us honest, it means the code is tested against far more environments than any one consultancy could reach, and it means you are never locked into us: the automation we leave behind is yours to run, read, and extend.

Ansible-Lockdown

Ansible-Lockdown is the community's leading open source project delivering audited, security-hardened Ansible roles implementing CIS Benchmarks and DISA STIGs across major Linux and Windows platforms. It is relied upon by security teams across government, defence, and enterprise worldwide.

Krameff are part of the core implementation and design team. We do not just use the project; we shape it. Working alongside our partners at Quantum Sky, we have direct influence over the architecture decisions, control mappings, testing approach, and release cadence.

Commercial support for Ansible-Lockdown is available, contact us for more information.

Community Leading

Hundreds of audited roles covering CIS Benchmarks and DISA STIGs, continuously maintained against the latest framework releases

Widely Trusted

Used by security and compliance professionals in government, defence, and enterprise, reviewed and validated across thousands of real environments

Actively Maintained

Framework updates are tracked and implemented as they are released, so compliance automation stays current without manual intervention

View on GitHub How We Apply It Support Options

Our Own Repositories

Alongside Ansible-Lockdown, we publish and maintain our own projects at github.com/krameff. These come out of real client problems: work that was useful enough to generalise, harden, and give back.

Ansible Collection MIT licensed
ssh key rotation, a Krameff collection

ssh_key_rotation

Rotating SSH keys is easy to get wrong in a way that locks you out of a server. This collection splits the job into three phases so a mistake fails safely instead of leaving a host unreachable: it validates the new key on the control node before touching anything, installs it alongside the old one, then reconnects using the new key to prove it works. Only then is the old key removed. Every sshd_config change is checked with sshd -t and backed up first, changes are applied with a reload rather than a restart so live sessions survive, and the lock-down is re-verified afterwards so a stray drop-in file or Match block cannot quietly leave password login enabled. Post-quantum and hybrid key exchange algorithms are supported as an opt-in. We have written up the full approach and what silently goes wrong.

  • SSH hardening
  • Zero downtime
  • Post-quantum
View on GitHub
Go Apache 2.0 licensed
Syver, a Krameff Solutions project

syver

Syver is a YAML-based tool for validating a server's configuration: a fast, small alternative to heavier testing frameworks, shipping as a single self-contained binary that can generate a spec from a running host, run it, wait on it, or serve it as a health endpoint. Hardening applies a control; a spec is how you show six months later that it held. It is the renamed continuation of our krameff/goss fork of goss-org/goss by @aelsabbahy, now diverged and driven by client requirements rather than tracking upstream; all original work remains under Apache 2.0 and full credit goes to the original author. Existing gossfiles, GOSS_* variables and wrapper scripts keep working. We have written up what it does and what the rename changed, and the full documentation is at syver.readthedocs.io.

  • Server validation
  • Health endpoints
  • Compliance evidence
View on GitHub Read About Syver

Contributing

Issues and pull requests are welcome on any of our repositories. If you have hit a bug, found a control mapping that does not hold up in your environment, or want a platform supported that is not yet covered, open an issue, because that feedback is exactly what keeps these projects honest.

Found a security issue? Please report it privately to security@krameff.com rather than opening a public issue, and we will work with you on a fix and disclosure timeline.

If you are running any of this in production and want ongoing support behind it, get in touch. We offer support and maintenance arrangements for our own projects, ssh_key_rotation and Syver. Commercial support for Ansible-Lockdown is also available, contact us for more information.

Open Source Questions

Yes. ssh_key_rotation is MIT licensed and Syver is Apache 2.0 licensed, and both are free to use commercially with no strings. They stay that way. Ansible-Lockdown is a community project under its own open source licensing.

It has been archived. Syver is its renamed continuation, and existing gossfiles, GOSS_* environment variables and the dgoss, dcgoss and kgoss wrappers all keep working. What the rename changed, and what deliberately did not, is written up in full on our Syver page.

Yes. For our own projects, ssh_key_rotation and Syver, we offer paid support and maintenance arrangements: someone to call when an upgrade needs planning or something does not fit your environment. Commercial support for Ansible-Lockdown is available, contact us for more information. The projects themselves stay free and open source either way.

Privately, to security@krameff.com, rather than by opening a public issue. We will work with you on a fix and a disclosure timeline.

Issues and pull requests are welcome on any of our repositories at github.com/krameff. Bug reports and control mappings that do not hold up in your environment are particularly useful, as is asking for a platform that is not yet supported.

Want This Running in Your Environment?

These projects are free to use and always will be. If you would rather have them assessed, tailored, and rolled out by the people who maintain them, that is what we do, along with ongoing support for ssh_key_rotation and Syver. Commercial support for Ansible-Lockdown is also available, contact us for more information.

Talk to Us About Support