linux-hardening

What the source does

• FilesystemDeclared4 observations
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 991c9cfc7d35 · 21 Oct 2026Report an issue or request a re-scan

• Publisherbagelhole GitHub userOwner of the repository this skill is read from
• Source folderbagelhole/devops-security-agent-skills/security/hardening/linux-hardeningThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict991c9cfc7d35A new audit runs when the source changes
• Repository statusNot archivedLast push 151 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance…

---
name: linux-hardening
description: Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance requirements.
license: MIT
metadata:
  author: devops-skills
  version: "1.0"
---

# Linux Hardening

Secure Linux servers following CIS benchmarks and security best practices.

## When to Use This Skill

Use this skill when:
- Hardening production servers
- Meeting compliance requirements
- Implementing security baselines
- Configuring secure SSH access

## SSH Hardening

```bash
# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Protocol 2
```

## User Security

```bash
# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Lock inactive accounts
useradd -D -f 30

# Audit sudo usage
echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers
```

## Firewall Configuration

```bash
# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Or iptables
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
```

## Kernel Hardening

```bash
# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0

# Apply
sysctl -p
```

## File Permissions

```bash
# Critical files
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 700 /root
chmod 600 /etc/ssh/sshd_config

# Find world-writable files
find / -type f -perm -0002 -ls

# Find SUID files
find / -perm -4000 -type f -ls
```

## Audit Configuration

```bash
# Install auditd
apt install auditd

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec
```

## Best Practices

- Disable unused services
- Keep system updated
- Use fail2ban for intrusion prevention
- Enable SELinux/AppArmor
- Regular security audits
- Monitor log files
- Implement least privilege

## Related Skills

- [cis-benchmarks](../cis-benchmarks/) - Compliance scanning
- [firewall-config](../../network/firewall-config/) - Firewall rules

Excerpt, first 2,644 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/bagelhole/devops-security-agent-skills
git -C devops-security-agent-skills checkout 991c9cfc7d35

Works in

1. 2026-10-21
   ✓SAFE B 89 / 100

   first audit · source 991c9cfc7d35

Questions about linux-hardening

• github.com/bagelhole/devops-security-agent-skills/tree/main/secu — the audited source at commit 991c9cfc7d35 and every finding aboveObserved · 21 Oct 2026

Spotted something wrong? Report a correction · Methodology