domains / security / linux-hardening / linux-hardening

linux-hardening

Skill card

combined

The second copy is a safety-hardened adaptation of the first. It preserves the same core hardening steps (SSH, users, firewall, kernel, permissions, audit) but adds material constraints the first lacks: a Target and recovery section, explicit warnings against applying default-deny firewall rules before verifying management access, safer sudoers editing via visudo fragments, -xdev on find commands, and a Limitations section. The first copy contains a specific AllowUsers list and a direct sysctl -p command that the second generalizes or qualifies. Because the second copy adds real operational safety steps and the first contains a concrete configuration example, crowning one would hide either the safety constraints or the concrete defaults.

Repositories

Other copies

Combined skill

---
name: linux-hardening
description: Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance requirements.
license: MIT
metadata:
  author: devops-skills
  version: "1.0"
---

# Linux Hardening

Secure Linux servers following CIS benchmarks and security best practices.

## When to Use This Skill

Use this skill when:
- Hardening production servers
- Meeting compliance requirements
- Implementing security baselines
- Configuring secure SSH access

## Target and Recovery

Confirm distribution/version, selected CIS profile, current service config, and user-authorized changes. Keep a known-working access session and out-of-band recovery. Back up affected files privately. Preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall/default-deny rules before verifying management access and IPv4/IPv6 requirements.

## SSH Hardening

```text
# Example sshd configuration; merge with existing policy
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers <confirmed-management-users>
```

## User Security

```bash
# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Set the default for FUTURE accounts: inactivity after password expiry,
# not 30 days since last login; review service-account consequences first.
useradd -D -f 30

# Audit sudo usage
# Edit a reviewed /etc/sudoers.d/ fragment with visudo and validate with visudo -c.
# Do not append blindly to /etc/sudoers.
```

## Firewall Configuration

```bash
# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Alternative iptables changes require an isolated validated ruleset,
# management allow rules, conntrack, DNS/IPv6 decisions and timed rollback.
# Do not set INPUT DROP first on a live remote host.
```

## Kernel Hardening

```text
# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0

# After reviewing a supported value set, apply the exact file separately:
# sudo sysctl -p /etc/sysctl.d/99-security.conf
```

## File Permissions

```bash
# Inspect distro-prescribed owner/group/mode before any authorized repair.
# /etc/shadow group readability may be required; do not blanket chmod it.
# Find world-writable files
find / -xdev -type f -perm -0002 -ls

# Find SUID files
find / -xdev -perm -4000 -type f -ls
```

## Audit Configuration

Package installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.

```bash
# Install auditd
apt install auditd

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec
```

## Best Practices

- Disable unused services
- Keep system updated
- Use fail2ban for intrusion prevention
- Enable SELinux/AppArmor
- Regular security audits
- Monitor log files
- Implement least privilege

## Limitations

- Apply guidance only within authorized scope; test destructive steps in non-production first.
- Docs-only import: upstream scripts and templates not bundled.

## Related Skills

- cis-benchmarks - Compliance scanning
- firewall-config - Firewall rules