{"id":19369898,"url":"https://github.com/captainzero93/disa-stig-cis-linux-hardening-","last_synced_at":"2025-06-13T22:36:10.936Z","repository":{"id":259473516,"uuid":"877980922","full_name":"captainzero93/DISA-STIG-CIS-LINUX-HARDENING-","owner":"captainzero93","description":"security hardening solution for Ubuntu and Debian-based Linux systems, implementing DISA STIG and CIS Compliance standards. ","archived":false,"fork":false,"pushed_at":"2025-04-18T05:28:32.000Z","size":147,"stargazers_count":8,"open_issues_count":0,"forks_count":5,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-23T13:36:04.881Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/captainzero93.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security_config.conf","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-10-24T15:11:56.000Z","updated_at":"2025-04-18T05:28:35.000Z","dependencies_parsed_at":"2024-10-25T20:29:51.396Z","dependency_job_id":"d0bfd54a-743f-4023-b054-2787315976f3","html_url":"https://github.com/captainzero93/DISA-STIG-CIS-LINUX-HARDENING-","commit_stats":null,"previous_names":["captainzero93/disa-stig-cis-linux-hardening-"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/captainzero93/DISA-STIG-CIS-LINUX-HARDENING-","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/captainzero93%2FDISA-STIG-CIS-LINUX-HARDENING-","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/captainzero93%2FDISA-STIG-CIS-LINUX-HARDENING-/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/captainzero93%2FDISA-STIG-CIS-LINUX-HARDENING-/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/captainzero93%2FDISA-STIG-CIS-LINUX-HARDENING-/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/captainzero93","download_url":"https://codeload.github.com/captainzero93/DISA-STIG-CIS-LINUX-HARDENING-/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/captainzero93%2FDISA-STIG-CIS-LINUX-HARDENING-/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259730782,"owners_count":22902909,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T08:13:41.340Z","updated_at":"2025-06-13T22:36:10.913Z","avatar_url":"https://github.com/captainzero93.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Linux Security Hardening Script (Enhanced) \n\n## Overview\nThis project provides a (somewhat) comprehensive security hardening solution for Ubuntu and Debian-based Linux systems, implementing DISA STIG and CIS Compliance standards. V3.1 includes enhanced features, improved error handling, and more configurable security controls.\n\n## Features\n- Comprehensive system hardening aligned with STIG/CIS standards\n- Advanced firewall configuration with network segmentation\n- Intrusion detection and prevention (Fail2Ban, OSSEC)\n- Detailed logging and monitoring\n- Automated backup and recovery\n- USB device control\n- Network isolation and VLAN support\n- Security reporting and compliance checking\n\n## Requirements\n- Ubuntu 18.04+ or Debian 12.0+\n- Minimum 5GB free disk space\n- Root or sudo access\n- Active internet connection\n\n## Quick Start\n\n### Installation\n```bash\n# Clone the repository\ngit clone https://github.com/captainzero93/DISA-STIG-CIS-LINUX-HARDENING-.git\n\n# Change to the script directory\n\ncd DISA-STIG-CIS-LINUX-HARDENING-\n\n# Make the script executable\nchmod +x enhanced-security-script.sh\n```\n\n### Basic Usage\n```bash\n# Run with default settings\nsudo ./enhanced-security-script.sh\n\n# Run with verbose output\nsudo ./enhanced-security-script.sh --verbose\n\n# Test run without making changes\nsudo ./enhanced-security-script.sh --dry-run\n```\n\n## Configuration\nThe script uses a configuration file (`security_config.conf`) for customization. A default configuration file is provided in the repository. However you will want to use less strict settings for a Home machine ( see user_friendly_example.conf in the Repo for an example ).\n\n### Configuration File Setup\nThe configuration file is automatically loaded from the same directory as the script. You can modify the settings before running the script:\n\n```bash\n# Review and modify configuration\nsudo nano security_config.conf\n\n# Secure the configuration file\nsudo chmod 600 security_config.conf\nsudo chown root:root security_config.conf\n```\n\n### Key Configuration Options\n```bash\n# Basic security options\nBACKUP_ENABLED=\"true\"\nFIREWALL_ENABLED=\"true\"\nAUDIT_ENABLED=\"true\"\n\n# Access control\nSELINUX_ENABLED=\"false\"\nAPPARMOR_ENABLED=\"true\"\n\n# Network security\nIPV6_ENABLED=\"false\"\nNETWORK_SEGMENTATION=\"true\"\n\n# Authentication\nPASSWORD_POLICY_STRICT=\"true\"\nACCOUNT_LOCKOUT_THRESHOLD=\"3\"\n\n# Monitoring\nFILE_INTEGRITY_MONITORING=\"true\"\nOSSEC_ENABLED=\"true\"\n```\n\n## Command Line Options\n- `--help`: Display usage information\n- `--version`: Show script version\n- `--verbose`: Enable detailed output\n- `--dry-run`: Preview changes without applying them\n- `--restore`: Restore from backup\n\n## Security Features\n\n### System Hardening\n- Kernel parameter optimization\n- Service hardening\n- File system security\n- Process accounting\n- Secure boot configuration\n\n### Access Control\n- Mandatory Access Control (AppArmor/SELinux)\n- Strong password policies\n- Account lockout protection\n- USB device control\n\n### Network Security\n- Advanced firewall rules\n- Network segmentation\n- DMZ configuration\n- Rate limiting\n- IPv6 security measures\n\n### Monitoring \u0026 Auditing\n- File integrity monitoring (AIDE)\n- System auditing\n- OSSEC HIDS\n- Daily security scans\n- Automated reporting\n\n## Backup and Recovery\nThe script automatically creates backups before making changes:\n\n```bash\n# Restore from backup\nsudo ./enhanced-security-script.sh --restore\n\n# Backup location\n/root/security_backup_YYYYMMDD_HHMMSS/\n```\n\n## Logging\n- Main log: `/var/log/security_hardening.log`\n- Audit log: `/var/log/audit/audit.log`\n- OSSEC logs: `/var/ossec/logs/`\n- Fail2Ban log: `/var/log/fail2ban.log`\n\n## Compliance\n\n### DISA STIG Controls\nImplements critical controls from DISA STIG guidelines including:\n- Account and Authentication Security (V-230234, V-230236)\n- Audit Configuration (V-230445)\n- Network Security (V-230484, V-230485)\n\n### CIS Benchmark Implementation\n- Level 1 Server Controls (Sections 1-6)\n- Automated scoring against CIS profiles\n\n### Daily Compliance Reports\n- Detailed compliance status reports\n- Configuration drift detection\n- Failed control notifications\n\n## Troubleshooting\n\n### Common Issues\n1. Script fails to start:\n   - Check permissions\n   - Verify system requirements\n   - Ensure configuration file exists\n\n2. Network issues:\n   - Verify internet connectivity\n   - Check DNS resolution\n   - Review firewall rules\n\n3. Service failures:\n   - Check service status\n   - Review error logs\n   - Verify dependencies\n\n### Debug Mode\n```bash\n# Enable verbose logging\nsudo ./enhanced-security-script.sh --verbose\n\n# Check logs\ntail -f /var/log/security_hardening.log\n```\n\n## Best Practices\n1. Always run `--dry-run` first ( sudo ./enhanced-security-script.sh --dry-run )\n2. Review configuration before running\n3. Maintain regular backups\n4. Monitor logs after implementation\n5. Regularly update security policies\n\n## License\nSee the LICENSE file for details.\n\n## Acknowledgments\n- DISA STIG Guidelines\n- CIS Benchmarks\n- Debian/Ubuntu Security Team\n- Open Source Security Community\n\n## Version History\n- v 3.1: added crowdsec and fixed a bunch of errors.\n- v3.0: Enhanced security features, improved configuration, STIG/CIS compliance.\n- v2.0: Added network segmentation, improved monitoring.\n- v1.0: Initial release\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcaptainzero93%2Fdisa-stig-cis-linux-hardening-","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcaptainzero93%2Fdisa-stig-cis-linux-hardening-","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcaptainzero93%2Fdisa-stig-cis-linux-hardening-/lists"}