{"id":29405686,"url":"https://github.com/swipswaps/fedora-security-hardening-toolkit","last_synced_at":"2026-05-08T04:04:50.870Z","repository":{"id":303495991,"uuid":"1015688918","full_name":"swipswaps/fedora-security-hardening-toolkit","owner":"swipswaps","description":"Comprehensive security hardening toolkit for Fedora Linux systems with enterprise-grade UX and cross-platform compatibility","archived":false,"fork":false,"pushed_at":"2025-07-08T01:21:26.000Z","size":84,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-08T01:25:23.432Z","etag":null,"topics":["automation","cis-controls","cybersecurity","devops","fedora","hardening","linux","nist","security","sysadmin"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/swipswaps.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security_audit.py","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-07T22:26:32.000Z","updated_at":"2025-07-08T01:21:29.000Z","dependencies_parsed_at":"2025-07-08T01:25:36.099Z","dependency_job_id":"a910dadb-f05a-44a5-baaf-0239919ea1a4","html_url":"https://github.com/swipswaps/fedora-security-hardening-toolkit","commit_stats":null,"previous_names":["swipswaps/fedora-security-hardening-toolkit"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/swipswaps/fedora-security-hardening-toolkit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swipswaps%2Ffedora-security-hardening-toolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swipswaps%2Ffedora-security-hardening-toolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swipswaps%2Ffedora-security-hardening-toolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swipswaps%2Ffedora-security-hardening-toolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/swipswaps","download_url":"https://codeload.github.com/swipswaps/fedora-security-hardening-toolkit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/swipswaps%2Ffedora-security-hardening-toolkit/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266682625,"owners_count":23967837,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-23T02:00:09.312Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["automation","cis-controls","cybersecurity","devops","fedora","hardening","linux","nist","security","sysadmin"],"created_at":"2025-07-10T22:46:45.066Z","updated_at":"2026-05-08T04:04:50.820Z","avatar_url":"https://github.com/swipswaps.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Fedora Security Hardening Toolkit\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)\n[![Bash](https://img.shields.io/badge/shell-bash-green.svg)](https://www.gnu.org/software/bash/)\n[![CIS Controls](https://img.shields.io/badge/compliance-CIS%20Controls%20v8-blue.svg)](https://www.cisecurity.org/controls/)\n[![NIST CSF](https://img.shields.io/badge/compliance-NIST%20CSF-blue.svg)](https://www.nist.gov/cyberframework)\n\nA comprehensive, research-based security hardening toolkit for Fedora Linux systems. Built with enterprise-grade UX principles, transparent security implementation, and cross-platform compatibility.\n\n## Security\n\nThis toolkit provides comprehensive security hardening for Fedora Linux systems with enterprise-grade UX principles and transparent implementation.\n\n## 🎯 **What This Toolkit Does**\n\nThis toolkit provides **three complementary tools** that work together to secure your Fedora system:\n\n### **1. Security Audit Script** (`security_audit.py`)\n- **What**: Comprehensive security assessment and compliance checking\n- **Why**: Know your current security posture before making changes\n- **When**: Run first to establish baseline, then periodically for monitoring\n\n### **2. Security Hardening Script** (`security_hardening.sh`)\n- **What**: Implements industry-standard security controls with user transparency\n- **Why**: Apply proven security measures based on official documentation\n- **When**: Run after audit to implement recommended security controls\n\n### **3. Security Validation Script** (`security_validation.sh`)\n- **What**: Validates that security controls are working correctly\n- **Why**: Confirm your security implementation is effective\n- **When**: Run after hardening to verify everything works as expected\n\n## 🏗️ **Architecture \u0026 Design Philosophy**\n\n### **Cross-Platform Compatibility**\n- ✅ **Hardware Agnostic**: Works on any x86_64, ARM64, or other architectures\n- ✅ **Distribution Support**: Fedora (primary), RHEL, CentOS Stream, Rocky Linux\n- ✅ **Environment Flexible**: Physical machines, VMs, containers, cloud instances\n\n### **Enterprise-Grade UX Principles**\n- 🔍 **Transparency**: Always show current state before making changes\n- 🎯 **User Agency**: Interactive confirmations with preview options\n- 🛡️ **Safety First**: Comprehensive backups with auto-rollback capabilities\n- 📊 **Risk Communication**: Color-coded, prioritized security assessments\n- ✅ **Verification**: Confirm changes worked as expected\n- 📚 **Education**: Provide commands for ongoing management\n\n### **Compliance Framework Integration**\n- **CIS Controls v8**: Specific control mapping and implementation\n- **NIST Cybersecurity Framework**: Identify, Protect, Detect, Respond, Recover\n- **Industry Standards**: Based on official documentation and best practices\n\n## Usage\n\nThis toolkit provides three main scripts for comprehensive security management:\n\n1. **Security Audit**: `sudo python3 security_audit.py` - Assess current security posture\n2. **Security Hardening**: `sudo ./security_hardening.sh` - Apply security controls\n3. **Security Validation**: `sudo ./security_validation.sh` - Verify implementation\n\nSee the Quick Start Guide below for detailed instructions.\n\n## 🚀 **Quick Start Guide**\n\n### **Prerequisites**\n```bash\n# Ensure you have required tools (Fedora/RHEL/CentOS)\nsudo dnf install -y python3 python3-pip bash curl wget\n\n# For Debian/Ubuntu systems\nsudo apt update \u0026\u0026 sudo apt install -y python3 python3-pip bash curl wget\n```\n\n## Installation\n```bash\n# Clone the repository\ngit clone https://github.com/your-org/fedora-security-hardening-toolkit.git\ncd fedora-security-hardening-toolkit\n\n# Make scripts executable\nchmod +x security_audit.py security_hardening.sh security_validation.sh\n\n# Optional: Install development dependencies\nmake install-dev\n```\n\n### **Step 1: Security Assessment** (5 minutes)\n```bash\n# Run comprehensive security audit\nsudo python3 security_audit.py\n\n# For verbose output with detailed logging\nsudo python3 security_audit.py --verbose\n\n# Review the generated report\ncat security_audit_report_*.json\n```\n\n**What you'll see:**\n- Current security score (0-100%)\n- Specific vulnerabilities identified\n- Compliance gaps with CIS/NIST frameworks\n- Prioritized recommendations\n\n### **Step 2: Security Hardening** (15-20 minutes)\n```bash\n# Apply security hardening with interactive confirmation\nchmod +x security_hardening.sh\nsudo ./security_hardening.sh\n\n# The script will:\n# 1. Show current configuration analysis\n# 2. Preview proposed changes\n# 3. Ask for your confirmation\n# 4. Create comprehensive backups\n# 5. Apply security controls\n# 6. Verify implementation\n```\n\n**What gets hardened:**\n- **Fail2ban**: Intrusion prevention with SSH protection\n- **Firewalld**: Zone-based network security\n- **SSH**: Key-based authentication and protocol hardening\n- **Kernel**: Network security parameters\n- **Audit**: Comprehensive security event logging\n\n### **Step 3: Security Validation** (5 minutes)\n```bash\n# Validate security implementation\nchmod +x security_validation.sh\nsudo ./security_validation.sh\n\n# Review validation results\n# Security score should now be 90%+ if hardening was successful\n```\n\n## 📊 **Understanding Security Scores**\n\n### **Scoring System**\n- **90-100%**: 🟢 **Excellent** - Enterprise-grade security posture\n- **75-89%**: 🟡 **Good** - Minor improvements recommended\n- **50-74%**: 🟠 **Moderate** - Several issues need attention\n- **Below 50%**: 🔴 **Critical** - Immediate action required\n\n### **Score Components**\n| Component | Weight | What It Measures |\n|-----------|--------|------------------|\n| **Intrusion Prevention** | 30% | Fail2ban configuration and effectiveness |\n| **Network Security** | 25% | Firewall rules and network hardening |\n| **Access Control** | 25% | SSH security and authentication |\n| **System Hardening** | 20% | Kernel parameters and audit logging |\n\n## 🔧 **Detailed Component Explanations**\n\n### **Fail2ban (Intrusion Prevention)**\n**What it does:**\n- Monitors log files for malicious activity patterns\n- Automatically bans IP addresses that show suspicious behavior\n- Protects against brute force attacks, DDoS attempts, and repeat offenders\n\n**Why it matters:**\n- Prevents 99%+ of automated attacks\n- Reduces server load from malicious traffic\n- Provides early warning of attack attempts\n\n**How our implementation works:**\n```bash\n# SSH Protection Jail\n[sshd]\nmaxretry = 3        # Only 3 failed attempts allowed\nbantime = 1h        # 1 hour ban for violations\nfindtime = 10m      # Detection window\n\n# DDoS Protection Jail  \n[sshd-ddos]\nmaxretry = 2        # Only 2 rapid connections allowed\nbantime = 2h        # 2 hour ban for DDoS attempts\n\n# Repeat Offender Jail\n[recidive]\nmaxretry = 5        # 5 separate bans triggers this\nbantime = 1w        # 1 week ban for persistent attackers\n```\n\n### **Firewalld (Network Security)**\n**What it does:**\n- Controls network traffic with zone-based rules\n- Blocks unnecessary services and ports\n- Logs security events for monitoring\n\n**Why it matters:**\n- Reduces attack surface by blocking unused services\n- Provides network-level protection\n- Enables traffic monitoring and analysis\n\n**How our implementation works:**\n```bash\n# Zone Configuration\nDefault Zone: drop          # Most restrictive - deny by default\nTrusted Zone: 192.168.1.0/24  # Local network access\nPublic Zone: SSH only        # Minimal external access\n\n# Service Controls\nSSH: Allowed with rate limiting\nHTTP/HTTPS: Only if web server detected\nFTP/Telnet: Blocked (insecure protocols)\n```\n\n### **SSH Hardening (Access Control)**\n**What it does:**\n- Enforces strong authentication methods\n- Limits connection attempts and sessions\n- Uses modern cryptographic standards\n\n**Why it matters:**\n- SSH is the primary remote access method\n- Weak SSH = complete system compromise\n- Proper SSH config prevents 95% of remote attacks\n\n**How our implementation works:**\n```bash\n# Authentication Security\nPasswordAuthentication no    # Key-based auth only\nPermitRootLogin no          # No direct root access\nMaxAuthTries 3              # Limit brute force attempts\n\n# Protocol Security\nProtocol 2                  # Modern SSH protocol only\nCiphers: ChaCha20, AES-256  # Strong encryption\nMACs: SHA-256, SHA-512      # Secure message authentication\n```\n\n## 🛡️ **Safety Features \u0026 Rollback**\n\n### **Comprehensive Backup System**\nEvery change creates timestamped backups:\n```bash\n/root/security_backups_YYYYMMDD_HHMMSS/\n├── fail2ban_backup/\n│   ├── jail.local.backup\n│   └── restore_fail2ban.sh     # Auto-generated rollback script\n├── firewall_backup/\n│   ├── firewall_rules.backup\n│   └── restore_firewall.sh\n└── ssh_backup/\n    ├── sshd_config.backup\n    └── restore_ssh.sh\n```\n\n### **Emergency Rollback**\nIf something goes wrong:\n```bash\n# Find your backup directory\nls /root/security_backups_*\n\n# Run the appropriate rollback script\nsudo /root/security_backups_YYYYMMDD_HHMMSS/restore_fail2ban.sh\nsudo /root/security_backups_YYYYMMDD_HHMMSS/restore_firewall.sh\nsudo /root/security_backups_YYYYMMDD_HHMMSS/restore_ssh.sh\n```\n\n## 📈 **Monitoring \u0026 Maintenance**\n\n### **Daily Monitoring Commands**\n```bash\n# Check fail2ban status and banned IPs\nsudo fail2ban-client status\nsudo fail2ban-client status sshd\n\n# Review firewall logs\nsudo journalctl -u firewalld -n 50\n\n# Check SSH authentication attempts\nsudo journalctl -u sshd -n 50 | grep -i failed\n\n# Monitor system security events\nsudo ausearch -m avc -ts recent\n```\n\n### **Weekly Maintenance Tasks**\n```bash\n# Re-run security validation\nsudo ./security_validation.sh\n\n# Update security software\nsudo dnf update fail2ban firewalld openssh-server\n\n# Review and rotate logs\nsudo logrotate -f /etc/logrotate.conf\n\n# Check for security updates\nsudo dnf check-update --security\n```\n\n### **Monthly Security Reviews**\n```bash\n# Full security re-assessment\nsudo python3 security_audit.py\n\n# Review banned IP patterns\nsudo fail2ban-client status | grep \"Currently banned\"\n\n# Analyze attack patterns\nsudo grep \"Ban \" /var/log/fail2ban.log | tail -50\n\n# Update security configurations if needed\nsudo ./security_hardening.sh\n```\n\n## 🔍 **Troubleshooting Guide**\n\n### **Common Issues \u0026 Solutions**\n\n#### **Issue: SSH Access Denied After Hardening**\n```bash\n# Symptoms: Can't SSH to server\n# Cause: SSH keys not properly configured\n\n# Solution 1: Use console/physical access\nsudo systemctl status sshd\nsudo journalctl -u sshd -n 20\n\n# Solution 2: Rollback SSH configuration\nsudo /root/security_backups_*/restore_ssh.sh\n\n# Solution 3: Temporarily allow password auth\nsudo sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config\nsudo systemctl restart sshd\n```\n\n#### **Issue: Fail2ban Not Starting**\n```bash\n# Check configuration syntax\nsudo fail2ban-client --test\n\n# Check log files exist\nls -la /var/log/secure /var/log/auth.log\n\n# Review fail2ban logs\nsudo journalctl -u fail2ban -n 50\n\n# Rollback if needed\nsudo /root/security_backups_*/restore_fail2ban.sh\n```\n\n#### **Issue: Firewall Blocking Required Services**\n```bash\n# Check current rules\nsudo firewall-cmd --list-all\n\n# Temporarily allow service\nsudo firewall-cmd --add-service=http --timeout=300\n\n# Make permanent if needed\nsudo firewall-cmd --add-service=http --permanent\nsudo firewall-cmd --reload\n```\n\n## 📚 **Learning Resources**\n\n### **Understanding the Security Controls**\n- [CIS Controls v8 Documentation](https://www.cisecurity.org/controls/)\n- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)\n- [Fedora Security Guide](https://docs.fedoraproject.org/en-US/quick-docs/securing-fedora/)\n\n### **Advanced Configuration**\n- [Fail2ban Official Documentation](https://github.com/fail2ban/fail2ban)\n- [Firewalld Documentation](https://firewalld.org/documentation/)\n- [OpenSSH Security Best Practices](https://www.ssh.com/academy/ssh/sshd_config)\n\n### **Security Monitoring**\n- [Linux Security Monitoring](https://www.cyberciti.biz/tips/linux-security.html)\n- [Log Analysis Techniques](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html)\n\n## 🤝 **Contributing**\n\nWe welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 📄 **License**\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 **Acknowledgments**\n\n- [How To Secure A Linux Server](https://github.com/imthenachoman/How-To-Secure-A-Linux-Server) - Comprehensive security guide\n- [CIS Controls](https://www.cisecurity.org/controls/) - Industry security standards\n- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) - Government security guidelines\n- Fedora Security Team - Official distribution security guidance\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswipswaps%2Ffedora-security-hardening-toolkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fswipswaps%2Ffedora-security-hardening-toolkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fswipswaps%2Ffedora-security-hardening-toolkit/lists"}