'not installed', 'label_ssh_root' => 'SSH root login', 'label_ssh_password' => 'SSH password login', 'label_auto_updates' => 'Automatic updates', // ── HardeningService: modal titles (per direction) ─────────────────── 'title_ssh_root_enable' => 'Allow SSH root login', 'title_ssh_root_disable' => 'Disable SSH root login', 'title_ssh_password_enable' => 'Allow SSH password login', 'title_ssh_password_disable' => 'Disable SSH password login', 'title_fail2ban_enable' => 'Enable fail2ban', 'title_fail2ban_disable' => 'Disable fail2ban', 'title_firewall_enable' => 'Enable firewall', 'title_firewall_disable' => 'Disable firewall', 'title_unattended_enable' => 'Enable automatic updates', 'title_unattended_disable' => 'Disable automatic updates', // ── HardeningService: modal descriptions (per direction) ───────────── 'desc_ssh_root_enable' => 'Re-allows direct root login over SSH (PermitRootLogin yes) and reloads the SSH service.', 'desc_ssh_root_disable' => 'Blocks direct root login over SSH (PermitRootLogin no) and reloads the SSH service.', 'desc_ssh_password_enable' => 'Re-allows password login (PasswordAuthentication yes).', 'desc_ssh_password_disable' => 'Login via SSH key only (PasswordAuthentication no). Only possible if a key is in place.', 'desc_fail2ban_enable' => 'Installs fail2ban (if needed) and starts the service. Repeated failed logins get banned.', 'desc_fail2ban_disable' => 'Stops fail2ban and disables autostart.', 'desc_firewall_enable' => 'Installs the firewall (if needed), opens SSH + 80/443 first, then enables it.', 'desc_firewall_disable' => 'Disables the server firewall.', 'desc_unattended_enable' => 'Installs (if needed) and enables the system\'s automatic security updates.', 'desc_unattended_disable' => 'Turns off automatic updates.', // ── HardeningService: errors + guards ──────────────────────────────── 'hardening_status_read_failed' => 'Could not read hardening status.', 'ssh_probe_no_exec' => 'SSH login succeeded, but commands could not be executed.', 'ssh_password_self_lockout' => 'Clusev connects itself via password — password login cannot be disabled, otherwise Clusev loses access. Set up SSH key access first.', 'ssh_password_no_key' => 'No SSH key in place — password login cannot be disabled (lockout risk).', // ── FirewallService: guards / reasons / errors ─────────────────────── 'firewalld_read_only' => 'Rule management for firewalld is read-only in this version — please configure it on the server.', 'invalid_port' => 'Invalid port (1–65535).', 'invalid_source' => 'Invalid source — IP address or CIDR expected.', 'port_or_source_required' => 'Port or source is required.', 'deny_without_port_blocks_ssh' => 'A :action rule without a port would also block SSH access and is not allowed. Use fail2ban to block individual IPs from SSH access.', 'deny_on_ssh_port_blocks_ssh' => 'A :action rule on the SSH port (:port) is not allowed (lockout risk). Use fail2ban to block individual IPs from SSH access.', 'firewalld_port_required' => 'firewalld: Please specify a port.', 'firewall_status_read_failed' => 'Could not read firewall status — rule not removed.', 'rule_gone' => 'Rule no longer exists.', 'ssh_rule_guard' => 'This rule keeps SSH access (port :port) open and cannot be removed — otherwise Clusev locks itself out. Disable the whole firewall if needed.', // ── Fail2banService: guards / reasons / errors ─────────────────────── 'ip_belongs_to_clusev' => 'This IP belongs to Clusev\'s access and cannot be banned (lockout risk).', 'already_whitelisted' => 'Already on the whitelist.', 'not_on_whitelist' => 'Not on the whitelist.', 'loopback_stays_whitelisted' => 'Loopback always stays on the whitelist.', 'invalid_input' => 'Invalid input.', 'invalid_ip_or_cidr' => 'Invalid IP address or CIDR.', 'fail2ban_config_read_failed' => 'Could not read fail2ban configuration.', // ── OsProfile: family labels ───────────────────────────────────────── 'family_debian' => 'Debian/Ubuntu', 'family_rhel' => 'RHEL/Fedora', 'family_suse' => 'openSUSE/SLES', 'family_arch' => 'Arch Linux', 'family_alpine' => 'Alpine Linux', 'family_unknown' => 'Unknown system', // ── OsProfile: firewall labels ─────────────────────────────────────── 'firewall_label_ufw' => 'Firewall (UFW)', 'firewall_label_firewalld' => 'Firewall (firewalld)', 'firewall_label_generic' => 'Firewall', // ── OsProfile: supports() reasons (:family = familyLabel()) ────────── 'support_ssh' => 'SSH hardening requires systemd, which was not detected on :family.', 'support_services' => 'Service control requires systemd, which was not detected here.', 'support_updates' => 'Package updates via Clusev are not yet supported on :family.', 'support_fail2ban' => 'fail2ban is not yet supported on :family via Clusev.', 'support_firewall' => 'No supported firewall (UFW or firewalld) was found on :family.', 'support_auto_updates' => 'Automatic updates are not yet supported on :family via Clusev.', // ── FleetService: SFTP / file-manager / journal errors ─────────────── 'authorized_keys_unreadable' => 'authorized_keys is empty or unreadable.', 'delete_failed_perms' => 'Delete failed (permissions?).', 'file_too_large_download' => 'File too large to download (>50 MB).', 'save_failed_perms' => 'Save failed (permissions?).', 'upload_failed_perms' => 'Upload failed (permissions?).', 'journal_needs_privileges' => 'The system journal requires elevated privileges (group adm/systemd-journal) or sudo.', // ── CredentialVault: SSH credential guards (:server = name) ────────── 'no_ssh_credential' => 'No SSH credential stored for server :server.', 'ssh_access_locked' => 'SSH access for :server is locked.', // ── HardeningService: invalid action invariant (:action) ───────────── 'unknown_hardening' => 'Unknown hardening action: :action', // ── SshKeyProvisioner ───────────────────────────────────────────────── 'ssh_key_verify_failed' => 'Key login could not be verified (:error) — password login stays enabled.', ];