What is linux-hardening?

A procedure for securing a Linux server by restricting access, managing user privileges, applying updates, removing unnecessary services, and configuring a firewall. Linux is an operating system commonly used on servers.

Use it to harden SSH access, configure login and password policies, limit sudo access, enable security updates, remove unused services, and set firewall rules.

It reduces common security risks such as password-based attacks, unnecessary network exposure, excessive administrator access, and unpatched software.

linux-hardening — Skill by KxlSys

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/kxlsys/openskill/linux-hardening

Any agent

npx skills add KxlSys/OpenSkill --skill linux-hardening

Clone the repo

git clone --depth 1 https://github.com/KxlSys/OpenSkill

Made for: Claude Code, Codex.

Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 479 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00019	$0.00479
Opus 5	$0.00010	$0.00239
Sonnet 5	$0.00004	$0.00096
Haiku 4.5	$0.00002	$0.00048

Measured 2d ago against content hash 7b65477c20d9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

linux-hardening scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/sysadmin/linux-hardening/SKILL.md · 46 lines

What it actually says

Linux Server Hardening

Cette compétence guide l'administrateur système ou l'agent dans la sécurisation d'un système d'exploitation Linux.

Étapes de Durcissement

Sécurisation des Accès & SSH :
- Désactiver la connexion en tant que root via SSH (PermitRootLogin no).
- Changer le port par défaut si nécessaire et désactiver l'authentification par mot de passe au profit des clés SSH.
- Installer et configurer fail2ban pour bloquer les attaques par force brute.
Gestion des Utilisateurs & Privilèges :
- Supprimer les comptes et groupes par défaut inutilisés.
- Restreindre l'utilisation de sudo aux seuls utilisateurs autorisés.
- Configurer des politiques de mot de passe strictes dans /etc/login.defs et /etc/pam.d/common-password.
Mises à jour & Gestion des Paquets :
- Activer les mises à jour de sécurité automatiques (unattended-upgrades).
- Supprimer les services et logiciels non essentiels (ex: serveurs FTP ou HTTP inutilisés).
Sécurisation du Réseau & Pare-feu :
- Configurer un pare-feu (ufw ou firewalld) avec une politique par défaut de rejet ("default deny").
- N'autoriser que les ports explicitement requis pour les services en cours d'exécution.
Sécurisation du Système de Fichiers & Noyau :
- Configurer les paramètres sysctl pour désactiver l'IP forwarding et bloquer les paquets ICMP suspects.
- Monter les partitions temporaires (/tmp, /var/tmp) avec les options nodev, nosuid et noexec.

Rapport de Durcissement

État Initial & Diagnostic

Mesures Appliquées

Recommandations Post-Durcissement

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 46 lines · 19 tokens per session scan A 7b65477c20d9

Subscribe to this mod's changes

linux-hardening is a skill published in the GitHub repository KxlSys/OpenSkill (2 stars, last pushed 10d ago), licensed MIT. It adds 19 tokens to every session and 479 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Security hardening linux sysadmin

heinzel-fleet-audit

Compare key policies across all servers in memory/servers/ to surface silent drift. Makes no configuration changes; writes one audit-trail line to each host's journal. Probes unattended-upgrades, sshd effective config, firewall posture, MTA, time sync, and auto-reboot behaviour. Use when the user asks to "fleet…

wintermeyer/heinzel · 112 tokens

heinzel-housekeeping

Run a heinzel housekeeping (health) inspection on a server — disk, memory, load, pending updates, firewall, SSL certs, failed systemd units, logs, kernel reboot status, and service-specific checks. Use when the user asks to "run housekeeping", "housekeeping report", "run a health check on ", or "do routine…

wintermeyer/heinzel · 124 tokens

heinzel-security

Run a heinzel security audit on a server — SSH hardening (password auth, weak algos, root login), firewall, user account hygiene, listening services, kernel hardening (ASLR, IP forwarding), file permissions, SUID/SGID audit, fail2ban. Use when the user asks for a "security audit", "security review", "hardening check"…

wintermeyer/heinzel · 137 tokens

linux-hardening