===== WARESITES SSH EXECUTION WRAPPER =====
DATE=Wed Jul  8 16:35:06 -03 2026
SSH_ALIAS=YEFFAI
REMOTE_YEFFAI_MUTATION=NO
YEFFAI_INSTALLATION_COMMAND_EXECUTED=NO
INSTALLATION_STARTED=NO
LOCAL_OUTPUT=/home/yeff/public_html/devon/_backup/yeffai_readonly_discovery_ssh_output_20260708_163504.txt

===== YEFF AI READ-ONLY DISCOVERY AUDIT =====
DATE=Wed Jul  8 21:35:07 CEST 2026
HOSTNAME=vmi2858754
REMOTE_YEFFAI_MUTATION=NO
YEFFAI_READONLY_DISCOVERY_COMMANDS_EXECUTED=YES
YEFFAI_INSTALLATION_COMMAND_EXECUTED=NO
INSTALLATION_STARTED=NO
PACKAGE_ID=yeffai_readonly_discovery_audit_commands
OPERATOR_PACKET_ID=yeffai_readonly_discovery_audit_operator_packet

===== COMMAND_001 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=HOST_IDENTITY_READ
PURPOSE=Ler identidade básica do host YEFF AI sem mutação.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
hostname=vmi2858754
kernel=Linux vmi2858754 5.15.0-185-generic #195-Ubuntu SMP Fri Jun 19 17:11:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
os_release=PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_002 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=TIME_AND_UPTIME_READ
PURPOSE=Ler horário, uptime e carga do host.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
2026-07-08T21:35:07+02:00
 21:35:07 up 8 days,  3:59,  1 user,  load average: 0.29, 0.13, 0.07
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_003 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=PROCESS_READ
PURPOSE=Ler processos ativos para evidência de runtime/observer/serviços.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     1174387  0.0  0.0 170656  5144 ?        S    21:31   0:00 (sd-pam)
root         122  0.0  0.0      0     0 ?        I<   Jun30   0:00 [acpi_thermal_pm]
root         699  0.0  0.0   6220  1092 ttyS0    Ss+  Jun30   0:00 /sbin/agetty -o -p -- \u --keep-baud 115200,57600,38400,9600 ttyS0 vt220
root         716  0.0  0.0   6176  1108 tty1     Ss+  Jun30   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root         108  0.0  0.0      0     0 ?        I<   Jun30   0:00 [ata_sff]
root     1174447  0.0  0.0   9152  5228 pts/0    Ss+  21:31   0:00 -bash
root     1174883  0.0  0.0   7764  3284 ?        Ss   21:35   0:00 bash -s
root         105  0.0  0.0      0     0 ?        I<   Jun30   0:00 [blkcg_punt_bio]
root         155  0.0  0.0      0     0 ?        I<   Jun30   0:00 [charger_manager]
root      179098  0.3  0.3 2088808 47036 ?       Ssl  Jul01  36:31 /usr/bin/containerd
root          18  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/0]
root          19  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/1]
root          25  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/2]
root          31  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/3]
root          37  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/4]
root          43  0.0  0.0      0     0 ?        S    Jun30   0:00 [cpuhp/5]
root         666  0.0  0.0   7288  2884 ?        Ss   Jun30   0:03 /usr/sbin/cron -f -P
root         206  0.0  0.0      0     0 ?        I<   Jun30   0:00 [cryptd]
message+     667  0.2  0.0   8908  5032 ?        Ss   Jun30  34:41 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root         111  0.0  0.0      0     0 ?        I<   Jun30   0:00 [devfreq_wq]
root      179410  0.0  0.6 2203500 77864 ?       Ssl  Jul01   2:54 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
root         119  0.0  0.0      0     0 ?        S    Jun30   0:00 [ecryptfs-kthrea]
root         110  0.0  0.0      0     0 ?        I<   Jun30   0:00 [edac-poller]
root         343  0.0  0.0      0     0 ?        I<   Jun30   0:00 [ext4-rsv-conver]
root     1174893  0.0  0.0   6204  1092 ?        S    21:35   0:00 head -n 200
root          16  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/0]
root          20  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/1]
root          26  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/2]
root          32  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/3]
root          38  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/4]
root          44  0.0  0.0      0     0 ?        S    Jun30   0:00 [idle_inject/5]
root          50  0.0  0.0      0     0 ?        I<   Jun30   0:00 [inet_frag_wq]
root         132  0.0  0.0      0     0 ?        I<   Jun30   0:00 [ipv6_addrconf]
root         674  0.0  0.0  82776  3904 ?        Ssl  Jun30   0:42 /usr/sbin/irqbalance --foreground
root         342  0.0  0.0      0     0 ?        S    Jun30   1:08 [jbd2/sda1-8]
root         442  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kaluad]
root          51  0.0  0.0      0     0 ?        S    Jun30   0:00 [kauditd]
root         104  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kblockd]
root          55  0.0  0.0      0     0 ?        S    Jun30   1:35 [kcompactd0]
root          49  0.0  0.0      0     0 ?        S    Jun30   0:00 [kdevtmpfs]
root          57  0.0  0.0      0     0 ?        SN   Jun30   0:00 [khugepaged]
root          52  0.0  0.0      0     0 ?        S    Jun30   0:00 [khungtaskd]
root         103  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kintegrityd]
root         450  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kmpath_handlerd]
root         447  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kmpath_rdacd]
root         449  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kmpathd]
root          56  0.0  0.0      0     0 ?        SN   Jun30   0:00 [ksmd]
root          13  0.0  0.0      0     0 ?        S    Jun30   0:15 [ksoftirqd/0]
root          22  0.0  0.0      0     0 ?        S    Jun30   0:14 [ksoftirqd/1]
root          28  0.0  0.0      0     0 ?        S    Jun30   0:22 [ksoftirqd/2]
root          34  0.0  0.0      0     0 ?        S    Jun30   0:16 [ksoftirqd/3]
root          40  0.0  0.0      0     0 ?        S    Jun30   0:20 [ksoftirqd/4]
root          46  0.0  0.0      0     0 ?        S    Jun30   0:17 [ksoftirqd/5]
root         146  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kstrp]
root         118  0.0  0.0      0     0 ?        S    Jun30   0:00 [kswapd0]
root           2  0.0  0.0      0     0 ?        S    Jun30   0:08 [kthreadd]
root         121  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kthrotld]
root     1174376  0.0  0.0      0     0 ?        I    21:31   0:00 [kworker/0:0-mm_percpu_wq]
root           8  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/0:0H-events_highpri]
root         239  0.0  0.0      0     0 ?        I<   Jun30   0:16 [kworker/0:1H-kblockd]
root     1173721  0.0  0.0      0     0 ?        I    21:24   0:00 [kworker/0:2-cgroup_release]
root     1172750  0.0  0.0      0     0 ?        I    21:14   0:00 [kworker/0:3-cgroup_free]
root     1171059  0.0  0.0      0     0 ?        I    20:58   0:00 [kworker/1:0-events]
root          24  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/1:0H-events_highpri]
root     1173803  0.0  0.0      0     0 ?        I    21:25   0:00 [kworker/1:1-cgroup_release]
root         193  0.0  0.0      0     0 ?        I<   Jun30   0:16 [kworker/1:1H-kblockd]
root     1173233  0.0  0.0      0     0 ?        I    21:19   0:00 [kworker/1:2-mm_percpu_wq]
root     1174293  0.0  0.0      0     0 ?        I    21:30   0:00 [kworker/1:3-events]
root     1171278  0.0  0.0      0     0 ?        I    21:00   0:00 [kworker/2:0-mm_percpu_wq]
root          30  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/2:0H-events_highpri]
root     1174089  0.0  0.0      0     0 ?        I    21:28   0:00 [kworker/2:1-cgroup_free]
root         115  0.0  0.0      0     0 ?        I<   Jun30   0:16 [kworker/2:1H-kblockd]
root          36  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/3:0H-events_highpri]
root     1173430  0.0  0.0      0     0 ?        I    21:21   0:00 [kworker/3:1-mm_percpu_wq]
root         131  0.0  0.0      0     0 ?        I<   Jun30   0:18 [kworker/3:1H-kblockd]
root     1173904  0.0  0.0      0     0 ?        I    21:26   0:00 [kworker/3:2-cgroup_free]
root     1174291  0.0  0.0      0     0 ?        I    21:30   0:00 [kworker/4:0-events]
root          42  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/4:0H-kblockd]
root     1173042  0.0  0.0      0     0 ?        I    21:17   0:00 [kworker/4:1-mm_percpu_wq]
root         137  0.0  0.0      0     0 ?        I<   Jun30   0:12 [kworker/4:1H-kblockd]
root     1170930  0.0  0.0      0     0 ?        I    20:56   0:00 [kworker/4:3-events]
root     1174003  0.0  0.0      0     0 ?        I    21:28   0:00 [kworker/5:0-events]
root          48  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/5:0H-events_highpri]
root     1173523  0.0  0.0      0     0 ?        I    21:22   0:00 [kworker/5:1-mm_percpu_wq]
root         236  0.0  0.0      0     0 ?        I<   Jun30   0:17 [kworker/5:1H-kblockd]
root     1173801  0.0  0.0      0     0 ?        I    21:25   0:00 [kworker/u12:0-flush-8:0]
root     1173047  0.0  0.0      0     0 ?        I    21:17   0:00 [kworker/u12:1-writeback]
root     1161166  0.0  0.0      0     0 ?        I    19:25   0:02 [kworker/u12:2-events_power_efficient]
root     1174299  0.0  0.0      0     0 ?        I    21:30   0:00 [kworker/u12:3-events_unbound]
root         150  0.0  0.0      0     0 ?        I<   Jun30   0:00 [kworker/u13:0]
root         109  0.0  0.0      0     0 ?        I<   Jun30   0:00 [md]
root          15  0.0  0.0      0     0 ?        S    Jun30   0:07 [migration/0]
root          21  0.0  0.0      0     0 ?        S    Jun30   0:08 [migration/1]
root          27  0.0  0.0      0     0 ?        S    Jun30   0:08 [migration/2]
root          33  0.0  0.0      0     0 ?        S    Jun30   0:08 [migration/3]
root          39  0.0  0.0      0     0 ?        S    Jun30   0:08 [migration/4]
root          45  0.0  0.0      0     0 ?        S    Jun30   0:08 [migration/5]
root         130  0.0  0.0      0     0 ?        I<   Jun30   0:00 [mld]
root          10  0.0  0.0      0     0 ?        I<   Jun30   0:00 [mm_percpu_wq]
root         451  0.0  0.2 289352 27100 ?        SLsl Jun30   2:12 /sbin/multipathd -d -s
root           6  0.0  0.0      0     0 ?        I<   Jun30   0:00 [netns]
root         675  0.0  0.1  33076 19056 ?        Ss   Jun30   0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
root      179637  0.0  0.0  55244 12016 ?        S    Jul01   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data  179639  0.0  0.0  55880  5504 ?        S    Jul01   0:04 nginx: worker process
www-data  179640  0.0  0.0  55880  5504 ?        S    Jul01   0:00 nginx: worker process
www-data  179641  0.0  0.0  55880  5504 ?        S    Jul01   0:00 nginx: worker process
www-data  179642  0.0  0.0  55880  5504 ?        S    Jul01   0:00 nginx: worker process
www-data  179643  0.0  0.0  55880  5504 ?        S    Jul01   0:00 nginx: worker process
www-data  179644  0.0  0.0  55880  5504 ?        S    Jul01   0:00 nginx: worker process
root          53  0.0  0.0      0     0 ?        S    Jun30   0:00 [oom_reaper]
root       33592  0.0  0.1 296024 20336 ?        Ssl  Jun30   5:18 /usr/libexec/packagekitd
root       33596  0.0  0.0 234512  7616 ?        Ssl  Jun30   9:31 /usr/libexec/polkitd --no-debug
root     1174892  0.0  0.0  10624  3248 ?        R    21:35   0:00 ps aux --sort=comm
root         295  0.0  0.0      0     0 ?        I<   Jun30   0:00 [raid5wq]
root           3  0.0  0.0      0     0 ?        I<   Jun30   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   Jun30   0:00 [rcu_par_gp]
root          14  0.2  0.0      0     0 ?        I    Jun30  30:04 [rcu_sched]
root          11  0.0  0.0      0     0 ?        S    Jun30   0:00 [rcu_tasks_rude_]
root          12  0.0  0.0      0     0 ?        S    Jun30   0:00 [rcu_tasks_trace]
syslog       676  0.0  0.0 222404  6376 ?        Ssl  Jun30   8:36 /usr/sbin/rsyslogd -n -iNONE
root         124  0.0  0.0      0     0 ?        S    Jun30   0:00 [scsi_eh_0]
root         126  0.0  0.0      0     0 ?        S    Jun30   0:00 [scsi_eh_1]
root         200  0.0  0.0      0     0 ?        S    Jun30   0:00 [scsi_eh_2]
root         125  0.0  0.0      0     0 ?        I<   Jun30   0:00 [scsi_tmf_0]
root         127  0.0  0.0      0     0 ?        I<   Jun30   0:00 [scsi_tmf_1]
root         201  0.0  0.0      0     0 ?        I<   Jun30   0:00 [scsi_tmf_2]
root           5  0.0  0.0      0     0 ?        I<   Jun30   0:00 [slub_flushwq]
root      323247  0.0  0.3 2147268 40528 ?       Ssl  Jul03   3:01 /snap/snapd/current/usr/lib/snapd/snapd
root         708  0.0  0.0  15440  9412 ?        Ss   Jun30   5:06 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root     1174383  0.0  0.0  17200 11076 ?        Ss   21:31   0:00 sshd: root@pts/0
root     1174837  8.0  0.0  17208 11188 ?        Ss   21:35   0:00 sshd: root@notty
root           1  0.3  0.1 167744 12956 ?        Ss   Jun30  44:48 /sbin/init
root     1174386  0.0  0.0  17064  9756 ?        Ss   21:31   0:00 /lib/systemd/systemd --user
root         417  0.2  2.3 376216 282944 ?       S<s  Jun30  24:22 /lib/systemd/systemd-journald
root         683  0.1  0.0  15660  7980 ?        Ss   Jun30  16:48 /lib/systemd/systemd-logind
systemd+     623  0.0  0.0  16132  7920 ?        Ss   Jun30   0:21 /lib/systemd/systemd-networkd
systemd+     625  0.0  0.1  25680 12752 ?        Ss   Jun30   0:03 /lib/systemd/systemd-resolved
systemd+     605  0.0  0.0  89364  6620 ?        Ssl  Jun30   0:11 /lib/systemd/systemd-timesyncd
root         454  0.0  0.0  11492  6152 ?        Ss   Jun30   0:02 /lib/systemd/systemd-udevd
root         107  0.0  0.0      0     0 ?        I<   Jun30   0:00 [tpm_dev_wq]
root         743  0.0  0.1 110152 21424 ?        Ssl  Jun30   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root         129  0.0  0.0      0     0 ?        I<   Jun30   0:00 [vfio-irqfd-clea]
root         112  0.0  0.0      0     0 ?        S    Jun30   0:00 [watchdogd]
root          54  0.0  0.0      0     0 ?        I<   Jun30   0:00 [writeback]
root         149  0.0  0.0      0     0 ?        I<   Jun30   0:00 [zswap-shrink]
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_004 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=SYSTEMD_SERVICE_READ
PURPOSE=Ler serviços systemd sem iniciar, parar ou reiniciar nada.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
  UNIT                                           LOAD      ACTIVE   SUB     DESCRIPTION
  apparmor.service                               loaded    active   exited  Load AppArmor profiles
  apport-autoreport.service                      loaded    inactive dead    Process error reports when automatic reporting is enabled
  apport.service                                 loaded    active   exited  LSB: automatic crash report generation
  apt-daily-upgrade.service                      loaded    inactive dead    Daily apt upgrade and clean activities
  apt-daily.service                              loaded    inactive dead    Daily apt download activities
● auditd.service                                 not-found inactive dead    auditd.service
  blk-availability.service                       loaded    active   exited  Availability of block devices
  cloud-config.service                           loaded    active   exited  Cloud-init: Config Stage
  cloud-final.service                            loaded    active   exited  Cloud-init: Final Stage
  cloud-init-hotplugd.service                    loaded    inactive dead    Cloud-init: Hotplug Hook
  cloud-init-local.service                       loaded    active   exited  Cloud-init: Local Stage (pre-network)
● cloud-init.service                             loaded    failed   failed  Cloud-init: Network Stage
● connman.service                                not-found inactive dead    connman.service
● console-screen.service                         not-found inactive dead    console-screen.service
  console-setup.service                          loaded    active   exited  Set console font and keymap
  containerd.service                             loaded    active   running containerd container runtime
  cron.service                                   loaded    active   running Regular background program processing daemon
  dbus.service                                   loaded    active   running D-Bus System Message Bus
● display-manager.service                        not-found inactive dead    display-manager.service
  dm-event.service                               loaded    inactive dead    Device-mapper event daemon
  dmesg.service                                  loaded    inactive dead    Save initial kernel messages after boot
  docker.service                                 loaded    active   running Docker Application Container Engine
  dpkg-db-backup.service                         loaded    inactive dead    Daily dpkg database backup service
  e2scrub_all.service                            loaded    inactive dead    Online ext4 Metadata Check for All Filesystems
  e2scrub_reap.service                           loaded    inactive dead    Remove Stale Online ext4 Metadata Check Snapshots
  emergency.service                              loaded    inactive dead    Emergency Shell
● fcoe.service                                   not-found inactive dead    fcoe.service
  finalrd.service                                loaded    active   exited  Create final runtime dir for shutdown pivot root
● firewalld.service                              not-found inactive dead    firewalld.service
  fstrim.service                                 loaded    inactive dead    Discard unused blocks on filesystems from /etc/fstab
  getty-static.service                           loaded    inactive dead    getty on tty2-tty6 if dbus and logind are not available
  getty@tty1.service                             loaded    active   running Getty on tty1
  grub-common.service                            loaded    inactive dead    Record successful boot for GRUB
  grub-initrd-fallback.service                   loaded    inactive dead    GRUB failed boot detection
● hv_kvp_daemon.service                          not-found inactive dead    hv_kvp_daemon.service
  irqbalance.service                             loaded    active   running irqbalance daemon
● iscsi-shutdown.service                         not-found inactive dead    iscsi-shutdown.service
  iscsid.service                                 loaded    inactive dead    iSCSI initiator daemon (iscsid)
● kbd.service                                    not-found inactive dead    kbd.service
  keyboard-setup.service                         loaded    active   exited  Set the console keyboard layout
  kmod-static-nodes.service                      loaded    active   exited  Create List of Static Device Nodes
  logrotate.service                              loaded    inactive dead    Rotate log files
● lvm2-activation-early.service                  not-found inactive dead    lvm2-activation-early.service
● lvm2-activation.service                        not-found inactive dead    lvm2-activation.service
  lvm2-lvmpolld.service                          loaded    inactive dead    LVM2 poll daemon
  lvm2-monitor.service                           loaded    active   exited  Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling
● lxc.service                                    not-found inactive dead    lxc.service
  lxd-agent.service                              loaded    inactive dead    LXD - agent
  man-db.service                                 loaded    inactive dead    Daily man-db regeneration
  modprobe@configfs.service                      loaded    inactive dead    Load Kernel Module configfs
  modprobe@drm.service                           loaded    inactive dead    Load Kernel Module drm
  modprobe@efi_pstore.service                    loaded    inactive dead    Load Kernel Module efi_pstore
  modprobe@fuse.service                          loaded    inactive dead    Load Kernel Module fuse
  motd-news.service                              loaded    inactive dead    Message of the Day
  multipathd.service                             loaded    active   running Device-Mapper Multipath Device Controller
  netplan-ovs-cleanup.service                    loaded    inactive dead    OpenVSwitch configuration for cleanup
  networkd-dispatcher.service                    loaded    active   running Dispatcher daemon for systemd-networkd
● networking.service                             not-found inactive dead    networking.service
● NetworkManager.service                         not-found inactive dead    NetworkManager.service
  nginx.service                                  loaded    active   running A high performance web server and a reverse proxy server
  open-iscsi.service                             loaded    inactive dead    Login to default iSCSI targets
  open-vm-tools.service                          loaded    inactive dead    Service for virtual machines hosted on VMware
● ovsdb-server.service                           not-found inactive dead    ovsdb-server.service
  packagekit.service                             loaded    active   running PackageKit Daemon
  plymouth-quit-wait.service                     loaded    active   exited  Hold until boot process finishes up
  plymouth-quit.service                          loaded    active   exited  Terminate Plymouth Boot Screen
  plymouth-read-write.service                    loaded    active   exited  Tell Plymouth To Write Out Runtime Data
  plymouth-start.service                         loaded    inactive dead    Show Plymouth Boot Screen
  polkit.service                                 loaded    active   running Authorization Manager
  pollinate.service                              loaded    inactive dead    Pollinate to seed the pseudo random number generator
● rbdmap.service                                 not-found inactive dead    rbdmap.service
  rc-local.service                               loaded    inactive dead    /etc/rc.local Compatibility
  rescue.service                                 loaded    inactive dead    Rescue Shell
  rsyslog.service                                loaded    active   running System Logging Service
  secureboot-db.service                          loaded    inactive dead    Secure Boot updates for DB and DBX
  serial-getty@ttyS0.service                     loaded    active   running Serial Getty on ttyS0
  setvtrgb.service                               loaded    active   exited  Set console scheme
  snap.lxd.activate.service                      loaded    inactive dead    Service for snap application lxd.activate
  snap.lxd.daemon.service                        loaded    inactive dead    Service for snap application lxd.daemon
  snap.lxd.user-daemon.service                   loaded    inactive dead    Service for snap application lxd.user-daemon
  snapd.apparmor.service                         loaded    active   exited  Load AppArmor profiles managed internally by snapd
  snapd.autoimport.service                       loaded    inactive dead    Auto import assertions from block devices
  snapd.core-fixup.service                       loaded    inactive dead    Automatically repair incorrect owner/permissions on core devices
  snapd.failure.service                          loaded    inactive dead    Failure handling of the snapd snap
  snapd.recovery-chooser-trigger.service         loaded    inactive dead    Wait for the Ubuntu Core chooser trigger
  snapd.seeded.service                           loaded    active   exited  Wait until snapd is fully seeded
  snapd.service                                  loaded    active   running Snap Daemon
  snapd.snap-repair.service                      loaded    inactive dead    Automatically fetch and run repair assertions
  ssh.service                                    loaded    active   running OpenBSD Secure Shell server
● sshd-keygen.service                            not-found inactive dead    sshd-keygen.service
  systemd-ask-password-console.service           loaded    inactive dead    Dispatch Password Requests to Console
  systemd-ask-password-plymouth.service          loaded    inactive dead    Forward Password Requests to Plymouth
  systemd-ask-password-wall.service              loaded    inactive dead    Forward Password Requests to Wall
  systemd-binfmt.service                         loaded    active   exited  Set Up Additional Binary Formats
  systemd-boot-system-token.service              loaded    inactive dead    Store a System Token in an EFI Variable
  systemd-fsck-root.service                      loaded    inactive dead    File System Check on Root Device
  systemd-fsck@dev-disk-by\x2dlabel-UEFI.service loaded    active   exited  File System Check on /dev/disk/by-label/UEFI
  systemd-fsckd.service                          loaded    inactive dead    File System Check Daemon to report status
● systemd-hwdb-update.service                    not-found inactive dead    systemd-hwdb-update.service
  systemd-initctl.service                        loaded    inactive dead    initctl Compatibility Daemon
  systemd-journal-flush.service                  loaded    active   exited  Flush Journal to Persistent Storage
  systemd-journald.service                       loaded    active   running Journal Service
  systemd-logind.service                         loaded    active   running User Login Management
  systemd-machine-id-commit.service              loaded    inactive dead    Commit a transient machine-id on disk
  systemd-modules-load.service                   loaded    active   exited  Load Kernel Modules
  systemd-networkd-wait-online.service           loaded    active   exited  Wait for Network to be Configured
  systemd-networkd.service                       loaded    active   running Network Configuration
  systemd-pstore.service                         loaded    inactive dead    Platform Persistent Storage Archival
  systemd-quotacheck.service                     loaded    inactive dead    File System Quota Check
  systemd-random-seed.service                    loaded    active   exited  Load/Save Random Seed
  systemd-remount-fs.service                     loaded    active   exited  Remount Root and Kernel File Systems
  systemd-resolved.service                       loaded    active   running Network Name Resolution
  systemd-rfkill.service                         loaded    inactive dead    Load/Save RF Kill Switch Status
  systemd-sysctl.service                         loaded    active   exited  Apply Kernel Variables
  systemd-sysusers.service                       loaded    active   exited  Create System Users
  systemd-timesyncd.service                      loaded    active   running Network Time Synchronization
  systemd-tmpfiles-clean.service                 loaded    inactive dead    Cleanup of Temporary Directories
  systemd-tmpfiles-setup-dev.service             loaded    active   exited  Create Static Device Nodes in /dev
  systemd-tmpfiles-setup.service                 loaded    active   exited  Create Volatile Files and Directories
  systemd-udev-trigger.service                   loaded    active   exited  Coldplug All udev Devices
  systemd-udevd.service                          loaded    active   running Rule-based Manager for Device Events and Files
● systemd-update-done.service                    not-found inactive dead    systemd-update-done.service
  systemd-update-utmp-runlevel.service           loaded    inactive dead    Record Runlevel Change in UTMP
  systemd-update-utmp.service                    loaded    active   exited  Record System Boot/Shutdown in UTMP
  systemd-user-sessions.service                  loaded    active   exited  Permit User Sessions
● systemd-vconsole-setup.service                 not-found inactive dead    systemd-vconsole-setup.service
● ua-auto-attach.service                         not-found inactive dead    ua-auto-attach.service
  ua-reboot-cmds.service                         loaded    inactive dead    Ubuntu Pro reboot cmds
  ua-timer.service                               loaded    inactive dead    Ubuntu Pro Timer for running repeated jobs
● ubuntu-advantage-cloud-id-shim.service         not-found inactive dead    ubuntu-advantage-cloud-id-shim.service
  ubuntu-advantage.service                       loaded    inactive dead    Ubuntu Pro Background Auto Attach
  ubuntu-fan.service                             loaded    active   exited  Ubuntu FAN network setup
  ufw.service                                    loaded    active   exited  Uncomplicated firewall
  unattended-upgrades.service                    loaded    active   running Unattended Upgrades Shutdown
  update-notifier-download.service               loaded    inactive dead    Download data for packages that failed at package install time
  update-notifier-motd.service                   loaded    inactive dead    Check to see whether there is a new version of Ubuntu available
  user-runtime-dir@0.service                     loaded    active   exited  User Runtime Directory /run/user/0
  user@0.service                                 loaded    active   running User Manager for UID 0
  uuidd.service                                  loaded    inactive dead    Daemon for generating UUIDs
  vgauth.service                                 loaded    inactive dead    Authentication service for virtual machines hosted on VMware
● zfs-mount.service                              not-found inactive dead    zfs-mount.service

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
141 loaded units listed.
To show all installed unit files use 'systemctl list-unit-files'.
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_005 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=LISTENING_PORTS_READ
PURPOSE=Ler portas em escuta e processos associados.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess                                                                                                                                                                                       
udp   UNCONN 0      0      127.0.0.53%lo:53         0.0.0.0:*    users:(("systemd-resolve",pid=625,fd=13))                                                                                                                                                    
tcp   LISTEN 0      511          0.0.0.0:80         0.0.0.0:*    users:(("nginx",pid=179644,fd=6),("nginx",pid=179643,fd=6),("nginx",pid=179642,fd=6),("nginx",pid=179641,fd=6),("nginx",pid=179640,fd=6),("nginx",pid=179639,fd=6),("nginx",pid=179637,fd=6))
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=708,fd=3))                                                                                                                                                                
tcp   LISTEN 0      4096   127.0.0.53%lo:53         0.0.0.0:*    users:(("systemd-resolve",pid=625,fd=14))                                                                                                                                                    
tcp   LISTEN 0      4096       127.0.0.1:36051      0.0.0.0:*    users:(("containerd",pid=179098,fd=15))                                                                                                                                                      
tcp   LISTEN 0      511             [::]:80            [::]:*    users:(("nginx",pid=179644,fd=7),("nginx",pid=179643,fd=7),("nginx",pid=179642,fd=7),("nginx",pid=179641,fd=7),("nginx",pid=179640,fd=7),("nginx",pid=179639,fd=7),("nginx",pid=179637,fd=7))
tcp   LISTEN 0      128             [::]:22            [::]:*    users:(("sshd",pid=708,fd=4))                                                                                                                                                                
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_006 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=DISK_AND_MOUNTS_READ
PURPOSE=Ler discos, mounts e espaço sem alterar arquivos.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
Filesystem     Type   Size  Used Avail Use% Mounted on
tmpfs          tmpfs  1.2G  1.1M  1.2G   1% /run
/dev/sda1      ext4    97G  7.1G   90G   8% /
tmpfs          tmpfs  5.9G     0  5.9G   0% /dev/shm
tmpfs          tmpfs  5.0M     0  5.0M   0% /run/lock
/dev/sda15     vfat   105M  6.1M   99M   6% /boot/efi
tmpfs          tmpfs  1.2G  4.0K  1.2G   1% /run/user/0

--- mounts ---
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=6100888k,nr_inodes=1525222,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1224380k,mode=755,inode64)
/dev/sda1 on / type ext4 (rw,relatime,discard,errors=remount-ro)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k,inode64)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=29,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16698)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
none on /run/credentials/systemd-sysusers.service type ramfs (ro,nosuid,nodev,noexec,relatime,mode=700)
/var/lib/snapd/snaps/core20_2866.snap on /snap/core20/2866 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/var/lib/snapd/snaps/core20_2717.snap on /snap/core20/2717 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/var/lib/snapd/snaps/lxd_38800.snap on /snap/lxd/38800 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/var/lib/snapd/snaps/snapd_26865.snap on /snap/snapd/26865 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/dev/sda15 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1224380k,mode=755,inode64)
/var/lib/snapd/snaps/snapd_27406.snap on /snap/snapd/27406 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/var/lib/snapd/snaps/core22_2411.snap on /snap/core22/2411 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
/var/lib/snapd/snaps/lxd_40115.snap on /snap/lxd/40115 type squashfs (ro,nodev,relatime,errors=continue,x-gdu.hide)
nsfs on /run/snapd/ns/lxd.mnt type nsfs (rw)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,size=1224376k,nr_inodes=306094,mode=700,inode64)
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_007 =====
SCOPE=BASE
GROUP_ID=BASE
COMMAND_ID=TOP_LEVEL_TREE_READ
PURPOSE=Ler estrutura de diretórios prováveis sem conteúdo sensível.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
/home
/home/yeff
/home/yeff/public_html
/home/yeff/public_html/devon
/opt
/opt/containerd
/opt/containerd/bin
/opt/containerd/lib
/opt/yeffai
/opt/yeffai/backup
/opt/yeffai/backup/step001_20260701_213316
/opt/yeffai/contracts
/opt/yeffai/evidence
/opt/yeffai/logs
/opt/yeffai/runtime
/opt/yeffai/state
/srv
/var/www
/var/www/html
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_008 =====
SCOPE=GROUP
GROUP_ID=RUNTIME_OBSERVABILITY
COMMAND_ID=RUNTIME_LOG_PATHS_READ
PURPOSE=Descobrir caminhos de logs e runtime state sem ler segredo.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
/opt/yeffai/logs
/opt/yeffai/runtime
/run/cloud-init/cloud-init-generator.log
/run/cloud-init/ds-identify.log
/run/cloud-init/status.json
/run/containerd/io.containerd.runtime.v2.task
/run/initramfs/fsck.log
/run/initramfs/overlayroot.log
/run/log
/run/systemd/journal/dev-log
/run/systemd/journal/syslog
/run/systemd/propagate/logrotate.service
/run/systemd/propagate/systemd-logind.service
/run/systemd/show-status
/run/systemd/units/invocation:rsyslog.service
/run/systemd/units/invocation:systemd-logind.service
/run/systemd/units/invocation:user-runtime-dir@0.service
/var/log
/var/log/alternatives.log
/var/log/alternatives.log.1
/var/log/apt/eipp.log.xz
/var/log/apt/history.log
/var/log/apt/history.log.1.gz
/var/log/apt/term.log
/var/log/apt/term.log.1.gz
/var/log/auth.log
/var/log/auth.log.1
/var/log/auth.log.2.gz
/var/log/auth.log.3.gz
/var/log/cloud-init-output.log
/var/log/cloud-init.log
/var/log/dpkg.log
/var/log/dpkg.log.1
/var/log/kern.log
/var/log/kern.log.1
/var/log/kern.log.2.gz
/var/log/kern.log.3.gz
/var/log/landscape/sysinfo.log
/var/log/lastlog
/var/log/nginx/access.log
/var/log/nginx/access.log.1
/var/log/nginx/access.log.2.gz
/var/log/nginx/access.log.3.gz
/var/log/nginx/access.log.4.gz
/var/log/nginx/access.log.5.gz
/var/log/nginx/access.log.6.gz
/var/log/nginx/error.log
/var/log/nginx/error.log.1
/var/log/nginx/error.log.2.gz
/var/log/syslog
/var/log/syslog.1
/var/log/syslog.2.gz
/var/log/syslog.3.gz
/var/log/ubuntu-advantage.log
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1.gz
/var/log/unattended-upgrades/unattended-upgrades-shutdown.log
/var/log/unattended-upgrades/unattended-upgrades.log
/var/log/unattended-upgrades/unattended-upgrades.log.1.gz
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_009 =====
SCOPE=GROUP
GROUP_ID=RUNTIME_OBSERVABILITY
COMMAND_ID=RECENT_LOG_METADATA_READ
PURPOSE=Ler metadados de logs recentes sem truncar ou modificar.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
2026-06-14 01:04 0 /var/log/unattended-upgrades/unattended-upgrades-shutdown.log
2026-06-14 01:04 50289 /var/log/dmesg.0
2026-06-14 01:05 0 /var/log/ubuntu-advantage.log
2026-06-14 01:15 0 /var/log/landscape/sysinfo.log
2026-06-14 07:42 16777216 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000000001-0006542a9cb83529.journal
2026-06-15 19:38 75497472 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000003235-000654302df933d4.journal
2026-06-16 10:32 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000012be0-0006544e4a93682a.journal
2026-06-17 03:24 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000025b91-0006545ac6ffb7ac.journal
2026-06-17 18:08 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000039872-00065468ea3c4820.journal
2026-06-18 10:10 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000004ceef-0006547543acf448.journal
2026-06-18 23:19 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000608e6-00065482b4d02a37.journal
2026-06-19 13:56 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000733cf-0006548dba69d94e.journal
2026-06-20 01:07 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000008677c-00065499fd608e6d.journal
2026-06-20 16:35 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000989c7-000654a359dd7afa.journal
2026-06-20 23:17 18243 /var/log/kern.log.3.gz
2026-06-21 00:00 1749619 /var/log/syslog.3.gz
2026-06-21 00:00 3480300 /var/log/auth.log.3.gz
2026-06-21 09:07 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000abe49-000654b050a9ca27.journal
2026-06-21 19:46 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000bfb00-000654be2eacc010.journal
2026-06-22 03:34 83886080 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000d222e-000654c71bb5f31e.journal
2026-06-22 18:34 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000e42d7-000654cda32b37e2.journal
2026-06-23 12:23 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000000f789d-000654da35e982d1.journal
2026-06-24 01:06 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000010b975-000654e926475dfb.journal
2026-06-24 15:19 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000011e84d-000654f3ce442990.journal
2026-06-25 04:18 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000131c45-000654ffb844b1ae.journal
2026-06-25 17:53 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000144c75-0006550a9ac415e5.journal
2026-06-26 05:08 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000157fe7-00065515fd42162e.journal
2026-06-26 15:12 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000016ae1c-0006551f6d16c051.journal
2026-06-26 22:27 83886080 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000017d543-00065527dbb5b183.journal
2026-06-27 06:31 16189 /var/log/alternatives.log.1
2026-06-27 09:53 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000018f23a-0006552df0d808d9.journal
2026-06-27 20:23 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001a1cf4-0006553784375e6e.journal
2026-06-27 23:17 2770 /var/log/kern.log.2.gz
2026-06-28 00:00 2316695 /var/log/syslog.2.gz
2026-06-28 00:00 5632469 /var/log/auth.log.2.gz
2026-06-28 08:40 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001b43e7-0006554050db527c.journal
2026-06-28 19:05 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001c7210-0006554a9cde54d9.journal
2026-06-29 07:55 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001d970e-000655535863d711.journal
2026-06-29 22:12 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001ec210-0006555e1a2b516b.journal
2026-06-30 06:05 1534 /var/log/unattended-upgrades/unattended-upgrades.log.1.gz
2026-06-30 06:05 1925 /var/log/apt/history.log.1.gz
2026-06-30 06:05 2161 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1.gz
2026-06-30 06:05 4497 /var/log/apt/term.log.1.gz
2026-06-30 06:05 84284 /var/log/dpkg.log.1
2026-06-30 17:36 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000001ff55b-0006556a13d41c76.journal
2026-06-30 17:36 172266 /var/log/cloud-init.log
2026-06-30 17:36 48108 /var/log/cloud-init-output.log
2026-06-30 17:36 50320 /var/log/dmesg
2026-07-01 00:00 128470272 /var/log/btmp.1
2026-07-01 10:57 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000212b50-0006557a55d5b13c.journal
2026-07-01 23:33 95 /var/log/nginx/error.log.2.gz
2026-07-02 01:36 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000226748-00065588e012dfc3.journal
2026-07-02 17:37 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000239c72-00065595279d6b27.journal
2026-07-02 23:56 14163 /var/log/nginx/access.log.6.gz
2026-07-03 09:21 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000024d786-000655a2950ae703.journal
2026-07-03 23:46 12012 /var/log/nginx/access.log.5.gz
2026-07-04 02:51 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000260f40-000655afc468f21d.journal
2026-07-04 19:46 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000274fbf-000655be702095c5.journal
2026-07-04 23:17 82583 /var/log/kern.log.1
2026-07-04 23:25 12559 /var/log/nginx/access.log.4.gz
2026-07-05 00:00 41289681 /var/log/syslog.1
2026-07-05 00:00 41290776 /var/log/auth.log.1
2026-07-05 13:15 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-0000000000288cbb-000655cc9e10c7bc.journal
2026-07-05 23:59 14383 /var/log/nginx/access.log.3.gz
2026-07-06 02:02 100663296 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-000000000029cc88-000655db47bd392f.journal
2026-07-06 12:35 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000002afa19-000655e5fc344277.journal
2026-07-06 23:46 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000002c20ac-000655eed3bbe54b.journal
2026-07-06 23:53 12586 /var/log/nginx/access.log.2.gz
2026-07-07 08:59 193 /var/log/nginx/error.log.1
2026-07-07 10:15 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000002d49b4-000655f833457e61.journal
2026-07-07 22:17 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000002e71d9-00065600fd9fadc2.journal
2026-07-07 23:53 109282 /var/log/nginx/access.log.1
2026-07-08 00:00 0 /var/log/nginx/error.log
2026-07-08 06:03 15802 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log
2026-07-08 06:03 20589 /var/log/apt/term.log
2026-07-08 06:03 23676 /var/log/apt/eipp.log.xz
2026-07-08 06:03 35277 /var/log/dpkg.log
2026-07-08 06:03 4186 /var/log/apt/history.log
2026-07-08 06:03 6854 /var/log/alternatives.log
2026-07-08 06:03 6959 /var/log/unattended-upgrades/unattended-upgrades.log
2026-07-08 10:11 92274688 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system@64f6a90e8ad4444aa3c64ac8cb5fbcf8-00000000002f9f93-0006560b131bf9cb.journal
2026-07-08 21:17 16659 /var/log/kern.log
2026-07-08 21:31 292000 /var/log/lastlog
2026-07-08 21:31 7680 /var/log/wtmp
2026-07-08 21:34 53302272 /var/log/btmp
2026-07-08 21:34 68903 /var/log/nginx/access.log
2026-07-08 21:35 24039446 /var/log/syslog
2026-07-08 21:35 33849745 /var/log/auth.log
2026-07-08 21:35 83886080 /var/log/journal/fb94e4ddaee24ab99aceb80801fb5ca7/system.journal
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_010 =====
SCOPE=GROUP
GROUP_ID=SECURITY_BASELINE
COMMAND_ID=UFW_STATUS_READ
PURPOSE=Ler status do UFW sem habilitar firewall.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
Status: inactive
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_011 =====
SCOPE=GROUP
GROUP_ID=SECURITY_BASELINE
COMMAND_ID=SSH_CONFIG_READ
PURPOSE=Ler configuração SSH efetiva e arquivos principais sem editar.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
port 22
permitrootlogin yes
pubkeyauthentication yes
passwordauthentication yes

--- sshd_config ---
/etc/ssh/sshd_config:33:PermitRootLogin yes
/etc/ssh/sshd_config.d/50-cloud-init.conf:1:PasswordAuthentication yes
/etc/ssh/sshd_config.d/99-yeffai-root-key-auth.conf:1:PubkeyAuthentication yes
/etc/ssh/sshd_config.d/99-yeffai-root-key-auth.conf:3:PermitRootLogin yes
/etc/ssh/sshd_config.d/99-yeffai-root-key-auth.conf:4:PasswordAuthentication yes
/etc/ssh/sshd_config.d/60-cloudimg-settings.conf:1:PasswordAuthentication no
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_012 =====
SCOPE=GROUP
GROUP_ID=SECURITY_BASELINE
COMMAND_ID=SECURITY_PACKAGES_STATUS_READ
PURPOSE=Ler presença/status de fail2ban, auditd e inotify-tools sem instalar.
MUTATES_SYSTEM=NO
COMMAND_BEGIN

--- services ---
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_013 =====
SCOPE=GROUP
GROUP_ID=SECURITY_BASELINE
COMMAND_ID=PERMISSIONS_SECURITY_READ
PURPOSE=Ler permissões de arquivos/diretórios críticos sem alterar.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
drwxr-xr-x  4 root root   4096 Jun 30 17:36 /etc/ssh
drwxr-xr-x  3 root root   4096 Jun 30 00:41 /home
drwxr-xr-x  4 root root   4096 Jul  1 23:33 /opt
drwx------ 13 root root   4096 Jul  3 10:22 /root
drwxr-xr-x  2 root root   4096 Mar 20 12:01 /srv
drwxrwxr-x  9 root syslog 4096 Jul  5 00:00 /var/log
drwxr-xr-x  3 root root   4096 Jul  1 23:33 /var/www
600 root root /etc/ssh/ssh_host_ecdsa_key
600 root root /etc/ssh/ssh_host_ed25519_key
600 root root /etc/ssh/ssh_host_rsa_key
600 root root /etc/ssh/sshd_config.d/50-cloud-init.conf
644 root root /etc/ssh/moduli
644 root root /etc/ssh/ssh_config
644 root root /etc/ssh/ssh_host_ecdsa_key.pub
644 root root /etc/ssh/ssh_host_ed25519_key.pub
644 root root /etc/ssh/ssh_host_rsa_key.pub
644 root root /etc/ssh/ssh_import_id
644 root root /etc/ssh/sshd_config
644 root root /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
644 root root /etc/ssh/sshd_config.d/99-yeffai-root-key-auth.conf
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_014 =====
SCOPE=GROUP
GROUP_ID=BACKUP_RECOVERY
COMMAND_ID=BACKUP_PATHS_DISCOVERY_READ
PURPOSE=Descobrir diretórios e manifests de backup sem executar backup ou restore.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
/home/yeff/public_html/devon/_backup
/opt/yeffai/backup
/var/backups
COMMAND_EXIT_STATUS=0
COMMAND_END

===== COMMAND_015 =====
SCOPE=GROUP
GROUP_ID=BACKUP_RECOVERY
COMMAND_ID=BACKUP_METADATA_READ
PURPOSE=Ler metadados de arquivos de backup sem copiar, deletar ou restaurar.
MUTATES_SYSTEM=NO
COMMAND_BEGIN
2026-07-01 23:33 232 /opt/yeffai/backup/step001_20260701_213316/pre_state.txt
2026-07-03 10:22 30879 /opt/yeffai/evidence/latest_state.json
COMMAND_EXIT_STATUS=0
COMMAND_END

===== FINAL =====
STATUS=PASS
CAUSE=read-only discovery audit executed on YEFF AI target via Waresites SSH without requested mutation
REMOTE_YEFFAI_MUTATION=NO
YEFFAI_INSTALLATION_COMMAND_EXECUTED=NO
INSTALLATION_STARTED=NO

===== WARESITES SSH EXECUTION FINAL =====
SSH_EXEC_STATUS=0
STATUS=PASS
CAUSE=read-only YEFF AI discovery executed via SSH and captured locally