themis
Debian Hardening, Automated
v0.0.1 · July 2026Audit findings tell you what is wrong. themis fixes it, and remembers how to undo the fix.
themis wraps audit findings with a check, plan, apply, rollback workflow. It maps flagged findings to concrete fixes, applies them idempotently, and saves rollback metadata on every run. Lynis is the first audit source, more are on the way to harmonize under one workflow.
Features
Actionable Findings Only
By default, findings with no themis fix and no solution hint print de-emphasized instead of cluttering a full table row. --all promotes them back.
Idempotent Fixes
Each registered fix knows how to detect its own satisfied state before applying anything. Re-running apply never double-applies a fix.
Rollback Metadata
Saved automatically on every apply, so a bad hardening run can be undone with one command.
Machine-Readable Output
themis api check returns findings merged with themis fixes as JSON, for scripting or CI gates.
Zero Runtime Dependencies
Single static binary. The fix registry doesn't care where a finding came from, so audit sources stay swappable.
Audit Sources
themis doesn't run its own audit, it consumes findings and turns them into fixes. Lynis is the source today. More are planned, harmonized under the same check, plan, apply, rollback workflow, with source selection controllable as a profile.
Security auditing tool for Unix-based systems. themis shells out to it, reads its report, and maps findings to registered fixes.
Commands
| themis check | Run an audit and list actionable findings |
| themis check --all | Also show findings with no themis fix and no solution hint |
| themis plan | Show which registered fixes would be applied |
| themis apply | Apply all unsatisfied registered fixes and save rollback state |
| themis rollback | Revert the fixes applied by the last apply |
| themis api check | Return findings merged with themis fixes as JSON |
| themis version | Print version, git commit, and build date |
Install
curl
curl -sSL https://codeberg.org/Elysium_Labs/themis/raw/branch/main/install.sh \
-o install.sh
sudo bash install.shwget
wget \
https://codeberg.org/Elysium_Labs/themis/raw/branch/main/install.sh
sudo bash install.shRequires Lynis on PATH, themis shells out to it for the audit.