Skip to content

Benchmark-aligned · CIS, ANSSI & STIG

Harden Linux, one domain at a time.

A complete, benchmark-aligned map of Linux server and workstation hardening — from SSH and the kernel to auditing and compliance. Pick a domain and work through it.

hardening domains
12
in-depth guides
12
tools indexed
35

/etc/hardening.d

The hardening map

Twelve domains that together cover the attack surface of a Linux system. Start anywhere — each links to focused, copy-pasteable guides.

~/guides

Latest guides

View all guides
Audit Linux against a CIS Benchmark: run Lynis for a hardening index, score CIS/STIG/ANSSI with OpenSCAP, then remediate and track it.
Detect breaches early with file integrity monitoring (AIDE), brute-force protection (fail2ban), and rootkit scanners as part of defense in depth.
Harden the Linux boot chain against console access, stolen disks and evil-maid attacks with GRUB passwords, LUKS encryption and Secure Boot.
Keep Linux patched automatically with unattended-upgrades and dnf-automatic, trusted repositories, and a reduced package surface.
Build a tamper-resistant logging baseline on Linux with persistent journald, the auditd framework, sensitive-file watches, and off-host log shipping.
Add Mandatory Access Control to Linux with SELinux and AppArmor. Keep SELinux enforcing, read denials, and fix policy instead of disabling it.