mcpField
L
linux-hardening

linux-hardening

github.com/bagelholeSecurity1.2k781 installsUpdated 23w ago
Repository

About linux-hardening

A Linux server security hardening skill for administrators applying CIS benchmarks and security baselines or preparing for compliance. It provides configuration guidance across SSH, accounts, firewalls, kernel settings, permissions, and auditing.

Key features

  1. 01SSH access hardening
  2. 02Password policy configuration
  3. 03Firewall rule setup
  4. 04Kernel security settings
  5. 05File permission checks
  6. 06Audit rule configuration

Use cases

  1. 01Hardening production servers
  2. 02Applying security baselines
  3. 03Preparing for compliance requirements
  4. 04Securing SSH access

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill linux-hardening

After installing, type/linux-hardeningin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

assets/
ssh-hardening.conf
sysctl-hardening.conf
references/
cis-checklist.md
scripts/
audit-system.sh
harden-system.sh

Details

From the project README

Linux Hardening

Secure Linux servers following CIS benchmarks and security best practices.

When to Use This Skill

Use this skill when:

  • Hardening production servers
  • Meeting compliance requirements
  • Implementing security baselines
  • Configuring secure SSH access

SSH Hardening

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Protocol 2

User Security

# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Lock inactive accounts
useradd -D -f 30

# Audit sudo usage
echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers

Firewall Configuration

# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Or iptables
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Kernel Hardening

# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0

# Apply
sysctl -p

File Permissions

# Critical files
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 700 /root
chmod 600 /etc/ssh/sshd_config

# Find world-writable files
find / -type f -perm -0002 -ls

# Find SUID files
find / -perm -4000 -type f -ls

Audit Configuration

# Install auditd
apt install auditd

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec

Best Practices

  • Disable unused services
  • Keep system updated
  • Use fail2ban for intrusion prevention
  • Enable SELinux/AppArmor
  • Regular security audits
  • Monitor log files
  • Implement least privilege

Related Skills

Comments

Markdown supported