RHEL 9 fleet tooling · over SSH
Linux Fleet Toolkit
Small, sharp command-line tools for running a RHEL 9 fleet over SSH. Each does one job, writes a report you can hand to anyone, and changes nothing on a host without asking first.
The tools
Staged dnf patching with live re-validation and opt-in serialized reboots.
Audit accounts, sudoers and keys; lock or expire stale accounts. Never deletes.
Diff firewalld against a declarative policy and reconcile it, with an SSH guard.
Reclaim disk space safely: logs, journald, old kernels, behind approval gates.
One executor: turn any tool's plan into actions and run them, re-validating live.
Shared foundation
linux-fleet-common
Every tool is built on the same building blocks: a password/key SSH
transport with staged sudo escalation (ssh_exec.py), a
formula-injection-safe Excel writer (xlsx_safe.py), and the
plan/report JSON schema conventions. Fix a transport quirk once, and it
propagates.
What they have in common
Discover, then apply
Read state and write a plan first. Nothing changes until you review it and confirm, per host.
Re-validate live
Before acting, each tool re-checks the host, so a stale plan never forces a change that no longer applies.
A report to hand over
Formatted Excel plus a machine-readable JSON plan. Run artifacts stay out of version control.