Open Source

The tools we maintain in public are the same ones we bring to client engagements. Nothing is held back for a paid tier.

Why We Work in the Open

Compliance and hardening automation is not something you should have to take on trust. If a role claims to implement a CIS Benchmark control, you should be able to read exactly how it does that, see the discussion behind the decision, and change it when your environment needs something different.

That is why our work happens in public. Every control mapping, every safety check, and every design trade-off is visible, reviewable, and open to challenge. It keeps us honest, it means the code is tested against far more environments than any one consultancy could reach, and it means you are never locked into us: the automation we leave behind is yours to run, read, and extend.

Ansible-Lockdown

Ansible-Lockdown is the community's leading open source project delivering audited, security-hardened Ansible roles implementing CIS Benchmarks and DISA STIGs across major Linux and Windows platforms. It is relied upon by security teams across government, defence, and enterprise worldwide.

Krameff are part of the core implementation and design team. We do not just use the project; we shape it. Working alongside our partners at Tyto Athene, we have direct influence over the architecture decisions, control mappings, testing approach, and release cadence.

Community Leading

Hundreds of audited roles covering CIS Benchmarks and DISA STIGs, continuously maintained against the latest framework releases

Widely Trusted

Used by security and compliance professionals in government, defence, and enterprise, reviewed and validated across thousands of real environments

Actively Maintained

Framework updates are tracked and implemented as they are released, so compliance automation stays current without manual intervention

View on GitHub How We Apply It

Our Own Repositories

Alongside Ansible-Lockdown, we publish and maintain our own projects at github.com/krameff. These come out of real client problems: work that was useful enough to generalise, harden, and give back.

Ansible Collection MIT licensed

ssh_key_rotation

Rotating SSH keys is easy to get wrong in a way that locks you out of a server. This collection splits the job into three phases so a mistake fails safely instead of leaving a host unreachable: it validates the new key on the control node before touching anything, installs it alongside the old one, then reconnects using the new key to prove it works. Only then is the old key removed. Every sshd_config change is checked with sshd -t and backed up first, changes are applied with a reload rather than a restart so live sessions survive, and the lock-down is re-verified afterwards so a stray drop-in file or Match block cannot quietly leave password login enabled. Post-quantum and hybrid key exchange algorithms are supported as an opt-in. We have written up the full approach and what silently goes wrong.

SSH hardening
Zero downtime
Post-quantum

View on GitHub

Go Apache 2.0 licensed

goss

Goss is a YAML-based tool for validating a server's configuration: a fast, small alternative to heavier testing frameworks, shipping as a single self-contained binary that can run a suite, wait on it, or serve it as a health endpoint. Our fork extends it with CIS Benchmark and STIG compliance checks, so the same tooling that proves a build is healthy can also evidence that it is compliant. It is a fork of goss-org/goss by @aelsabbahy, maintained to keep newer features and fixes moving; all original work remains under Apache 2.0 and full credit goes to the original author.

Server validation
CIS Benchmarks
STIG

View on GitHub

Contributing

Issues and pull requests are welcome on any of our repositories. If you have hit a bug, found a control mapping that does not hold up in your environment, or want a platform supported that is not yet covered, open an issue, because that feedback is exactly what keeps these projects honest.

Found a security issue? Please report it privately to security@krameff.com rather than opening a public issue, and we will work with you on a fix and disclosure timeline.

If you are running any of this in production and want ongoing support behind it (someone to call when a benchmark update lands, a control does not fit, or an upgrade needs planning), get in touch. We offer support and maintenance arrangements for all of the projects on this page.

Want This Running in Your Environment?

These projects are free to use and always will be. If you would rather have them assessed, tailored, and rolled out by the people who maintain them, or want ongoing support once they are in place, that is what we do.

Talk to Us About Support