server-hardening

Server Hardening Skill

This skill provides comprehensive workflows, checklists, and automated scripts for hardening Linux servers according to industry best practices and CIS Benchmarks.

When to Use This Skill

Use this skill when:

• Setting up new production servers
• Improving security posture of existing servers
• Implementing CIS Benchmark compliance
• Preparing for security audits
• Responding to security incidents
• Establishing security baselines
• Configuring security monitoring

Core Principles

1. Defense in Depth

Multiple layers of security:

• Network security (firewall, IDS/IPS)
• Host security (hardening, patching)
• Application security (WAF, input validation)
• Access control (authentication, authorization)
• Monitoring (logging, alerting)

2. Principle of Least Privilege

Always apply:

• Minimal user permissions
• Minimal service permissions
• Minimal network access
• Minimal file system access

3. Zero Trust

Assume breach:

• Never trust, always verify
• Verify every request
• Log every action
• Monitor continuously

Hardening Workflow

Phase 1: Pre-Hardening Assessment

┌─────────────────────────────────────────────────────────────┐
│ Pre-Hardening Checklist                                     │
├─────────────────────────────────────────────────────────────┤
│ □ Document current configuration                            │
│ □ Create full system backup                                 │
│ □ Document running services                                 │
│ □ Document network connections                              │
│ □ Document user accounts                                    │
│ □ Identify compliance requirements                          │
│ □ Schedule maintenance window                               │
│ □ Prepare rollback plan                                     │
└─────────────────────────────────────────────────────────────┘

Phase 2: Security Baseline

Establish baseline before hardening:

#!/bin/bash
# Security baseline assessment

# System information
echo "=== System Information ==="
uname -a
hostnamectl
cat /etc/os-release

# Running services
echo -e "\n=== Running Services ==="
systemctl list-units --type=service --state=running

# Open ports
echo -e "\n=== Open Ports ==="
ss -tulpn

# User accounts
echo -e "\n=== User Accounts ==="
cat /etc/passwd | grep -v nologin

# Sudo users
echo -e "\n=== Sudo Users ==="
getent group sudo

# Installed packages
echo -e "\n=== Security Packages ==="
dpkg -l | grep -E "(fail2ban|ufw|rkhunter|chkrootkit)" || echo "Not installed"

# Last logins
echo -e "\n=== Last Logins ==="
last -10

# Failed logins
echo -e "\n=== Failed Logins ==="
grep "Failed password" /var/log/auth.log | tail -10 || echo "No failed logins"

# Disk usage
echo -e "\n=== Disk Usage ==="
df -h

# Pending updates
echo -e "\n=== Pending Updates ==="
apt list --upgradable 2>/dev/null | head -20 || yum check-update