Linux Hardening

Secure Linux servers following CIS benchmarks and security best practices.

When to Use This Skill

Use this skill when:

• Hardening production servers
• Meeting compliance requirements
• Implementing security baselines
• Configuring secure SSH access

Target and recovery

Confirm distribution/version, selected CIS profile, current service config and user-authorized changes. Keep a known-working access session and out-of-band recovery, back up affected files privately, preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall/default-deny rules before verifying management access and IPv4/IPv6 requirements.

SSH Hardening

# Example sshd configuration; merge with existing policy
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers <confirmed-management-users>

User Security

# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Set the default for FUTURE accounts: inactivity after password expiry,
# not 30 days since last login; review service-account consequences first.
useradd -D -f 30

# Audit sudo usage
# Edit a reviewed /etc/sudoers.d/ fragment with visudo and validate with visudo -c.
# Do not append blindly to /etc/sudoers.

Firewall Configuration

# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Alternative iptables changes require an isolated validated ruleset,
# management allow rules, conntrack, DNS/IPv6 decisions and timed rollback.
# Do not set INPUT DROP first on a live remote host.

Kernel Hardening

# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0

# After reviewing a supported value set, apply the exact file separately:
# sudo sysctl -p /etc/sysctl.d/99-security.conf

File Permissions

# Inspect distro-prescribed owner/group/mode before any authorized repair.
# /etc/shadow group readability may be required; do not blanket chmod it.
# Find world-writable files
find / -xdev -type f -perm -0002 -ls

# Find SUID files
find / -xdev -perm -4000 -type f -ls

Audit Configuration

Package installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.

# Install auditd
apt install auditd

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec

Best Practices

• Disable unused services
• Keep system updated
• Use fail2ban for intrusion prevention
• Enable SELinux/AppArmor
• Regular security audits
• Monitor log files
• Implement least privilege

Related Skills

• cis-benchmarks (cis-benchmarks) - Compliance scanning
• firewall-config (firewall-config) - Firewall rules

Limitations

• Apply guidance only within authorized scope; test destructive steps in non-production first.
• Docs-only import: upstream scripts and templates not bundled.

Example

# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20

Adapted from BagelHole/DevOps-Security-Agent-Skills (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.