{"id":13497565,"url":"https://github.com/trimstray/linux-hardening-checklist","last_synced_at":"2025-04-12T17:36:50.198Z","repository":{"id":34106056,"uuid":"167517482","full_name":"trimstray/linux-hardening-checklist","owner":"trimstray","description":"Simple checklist to help you deploying the most important areas of the GNU/Linux production systems - work in progress.","archived":false,"fork":false,"pushed_at":"2024-11-19T14:00:13.000Z","size":236,"stargazers_count":1523,"open_issues_count":3,"forks_count":191,"subscribers_count":71,"default_branch":"master","last_synced_at":"2025-02-11T12:45:32.966Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/trimstray.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-01-25T09:02:23.000Z","updated_at":"2025-02-10T11:55:07.000Z","dependencies_parsed_at":"2024-12-18T22:31:43.563Z","dependency_job_id":"09d48435-797a-4cbc-a1c7-f7e1dc812569","html_url":"https://github.com/trimstray/linux-hardening-checklist","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trimstray%2Flinux-hardening-checklist","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trimstray%2Flinux-hardening-checklist/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trimstray%2Flinux-hardening-checklist/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trimstray%2Flinux-hardening-checklist/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/trimstray","download_url":"https://codeload.github.com/trimstray/linux-hardening-checklist/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247361700,"owners_count":20926643,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T20:00:33.515Z","updated_at":"2025-04-05T16:12:33.027Z","avatar_url":"https://github.com/trimstray.png","language":null,"funding_links":[],"categories":["GNU/Linux","Others","Security","others"],"sub_categories":["Hardening"],"readme":"\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/trimstray/linux-hardening-checklist\"\u003e\n    \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/linux-hardening-checklist_preview.png\" alt=\"Master\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003cbr\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/trimstray/linux-hardening-checklist/pulls\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/PRs-welcome-brightgreen.svg?longCache=true\" alt=\"Pull Requests\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"LICENSE.md\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/License-MIT-lightgrey.svg?longCache=true\" alt=\"MIT License\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003cbr\u003e\n\n****\n\n# Table of Contents\n\n- **[Introduction](#introduction)**\n  * [Status](#status)\n  * [Todo](#todo)\n  * [Prologue](#prologue)\n  * [Levels of priority](#levels-of-priority)\n  * [OpenSCAP](#openscap)\n- **[Partitioning](#partitioning)**\n  * [Separate partitions](#separate-partitions)\n  * [Restrict mount options](#restrict-mount-options)\n  * [Polyinstantiated directories](#polyinstantiated-directories)\n  * [Shared memory](#shared-memory)\n  * [Encrypt partitions](#encrypt-partitions)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist)\n- **[Physical Access](#physical-access)**\n  * [Password for Single User Mode](#password-for-single-user-mode)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-1)\n- **[Bootloader](#bootloader)**\n  * [Protect bootloader config files](#protect-bootloader-config-files)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-2)\n- **[Linux Kernel](#linux-kernel)**\n  * [Kernel logs](#kernel-logs)\n  * [Kernel pointers](#kernel-pointers)\n  * [ExecShield](#execshield)\n  * [Memory protection](#memory-protection)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-3)\n- **[Logging](#logging)**\n  * [Syslog](#syslog)\n- **[Users and Groups](#users-and-groups)**\n  * [Passwords](#passwords)\n  * [Logon Access](#logon-access)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-4)\n- **[Filesystem](#filesystem)**\n  * [Hardlinks \u0026 Symlinks](#hardlinks--symlinks)\n  * [Dynamic Mounting and Unmounting](#dynamic-mounting-and-unmounting)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-5)\n- **[Permissions](#permissions)**\n- **[SELinux \u0026 Auditd](#selinux--auditd)**\n  * [SELinux Enforcing](#selinux-enforcing)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-6)\n- **[System Updates](#system-updates)**\n- **[Network](#network)**\n  * [TCP/SYN](#tcp-syn)\n  * [Routing](#routing)\n  * [ICMP Protocol](#icmp-protocol)\n  * [Broadcast](#broadcast)\n  * [Summary checklist](#ballot_box_with_check-summary-checklist-7)\n- **[Services](#services)**\n- **[Tools](#tools)**\n\n# Introduction\n\n  \u003e In computing, **hardening** is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. The main goal of systems hardening is to reduce security risk by eliminating potential attack vectors and condensing the system’s attack surface.\n\nThis list contains the most important hardening rules for GNU/Linux systems.\n\n## Status\n\nStill work in progress... :construction_worker:\n\nI also created another repository (in a more detailed way): [the-practical-linux-hardening-guide](https://github.com/trimstray/the-practical-linux-hardening-guide).\n\n## Todo\n\n- [ ] Add rationale (e.g. url's, external resources)\n- [ ] Review levels of priority\n\n## Prologue\n\nI'm not advocating throwing your existing hardening and deployment best practices out the door but I recommend is to always turn a feature from this checklist on in pre-production environments instead of jumping directly into production.\n\n## Levels of priority\n\nAll items in this checklist contains three levels of priority:\n\n* \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e means that the item has a **low** priority.\n* \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e means that the item has a **medium** priority. You shouldn't avoid tackling that item.\n* \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e means that the item has a **high** priority. You can't avoid following that rule and implement the corrections recommended.\n\n## OpenSCAP\n\n\u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/openscap_logo.png\" alt=\"OpenSCAP\" align=\"left\"\u003e\n\n\u003cp align=\"left\"\u003e\u003cb\u003eSCAP\u003c/b\u003e (\u003ci\u003eSecurity Content Automation Protocol\u003c/i\u003e) provides a mechanism to check configurations, vulnerability management and evaluate policy compliance for a variety of systems. One of the most popular implementations of SCAP is \u003cb\u003eOpenSCAP\u003c/b\u003e and it is very helpful for vulnerability assessment and also as hardening helper.\n\nSome of the external audit tools use this standard. For example Nessus has functionality for authenticated SCAP scans.\u003c/p\u003e\n\n  \u003e I tried to make this list compatible with OpenSCAP standard and rules. However, there may be differences.\n\n# Partitioning\n\n## Separate partitions\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Ensure `/boot` located on separate partition.\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Ensure `/home` located on separate partition.\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Ensure `/usr` located on separate partition.\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Ensure `/var` located on separate partition.\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e Ensure `/var/log` and `/var/log/audit` located on separate partitions.\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e Ensure `/tmp` and `/var/tmp` located on separate partitions.\n\n## Restrict mount options\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restrict `/usr` partition mount options.\n\n    **Example:**\n\n    ```bash\n    UUID=\u003c...\u003e  /usr  ext4  defaults,nodev,ro  0 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restrict `/var` partition mount options.\n\n    **Example:**\n\n    ```bash\n    UUID=\u003c...\u003e  /var  ext4  defaults,nosuid  0 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restrict `/var/log` and `/var/log/audit` partitions mount options.\n\n    **Example:**\n\n    ```bash\n    UUID=\u003c...\u003e  /var/log        ext4  defaults,nosuid,noexec,nodev  0 2\n    UUID=\u003c...\u003e  /var/log/audit  ext4  defaults,nosuid,noexec,nodev  0 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restrict `/proc` partition mount options.\n\n    **Example:**\n\n    ```bash\n    proc  /proc  proc  defaults,hidepid=2  0 0\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Restrict `/boot` partition mount options.\n\n    **Example:**\n\n    ```bash\n    LABEL=/boot  /boot  ext2  defaults,nodev,nosuid,noexec,ro  1 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Restrict `/home` partition mount options.\n\n    **Example:**\n\n    ```bash\n    UUID=\u003c...\u003e  /home  ext4  defaults,nodev,nosuid  0 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Restrict `/var` and `/var/tmp` partitions mount options.\n\n    **Example:**\n\n    ```bash\n    mv /var/tmp /var/tmp.old\n    ln -s /tmp /var/tmp\n    cp -prf /var/tmp.old/* /tmp \u0026\u0026 rm -fr /var/tmp.old\n\n    UUID=\u003c...\u003e  /tmp  ext4  defaults,nodev,nosuid,noexec  0 2\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Restrict `/dev/shm` partition mount options.\n\n    **Example:**\n\n    ```bash\n    tmpfs  /dev/shm  tmpfs  rw,nodev,nosuid,noexec,size=1024M,mode=1777 0 0\n    ```\n\n## Polyinstantiated directories\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Setting up polyinstantiated `/var` and `/var/tmp` directories.\n\n    **Example:**\n\n    ```bash\n    # Create new directories:\n    mkdir --mode 000 /tmp-inst\n    mkdir --mode 000 /var/tmp/tmp-inst\n\n    # Edit /etc/security/namespace.conf:\n    /tmp      /tmp-inst/          level  root,adm\n    /var/tmp  /var/tmp/tmp-inst/  level  root,adm\n\n    # Set correct SELinux context:\n    setsebool polyinstantiation_enabled=1\n    chcon --reference=/tmp /tmp-inst\n    chcon --reference=/var/tmp/ /var/tmp/tmp-inst\n    ```\n\n## Shared memory\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Set group for `/dev/shm`.\n\n    **Example:**\n\n    ```bash\n    tmpfs  /dev/shm  tmpfs  rw,nodev,nosuid,noexec,size=1024M,mode=1770,uid=root,gid=shm 0 0\n    ```\n\n## Encrypt partitions\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Encrypt `swap` partition.\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/crypttab:\n    sdb1_crypt /dev/sdb1 /dev/urandom cipher=aes-xts-plain64,size=256,swap,discard\n\n    # Edit /etc/fstab:\n    /dev/mapper/sdb1_crypt none swap sw 0 0\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Separate `/boot` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Separate `/home` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Separate `/usr` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Separate `/var` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Separate `/var/log` and `/var/log/audit` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e | :black_square_button: |\n| Separate `/tmp` and `/var/tmp` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e | :black_square_button: |\n| | | |\n| Restrict `/usr` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Restrict `/var` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Restrict `/var/log` and `/var/log/audit` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Restrict `/proc` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Restrict `/boot` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Restrict `/home` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Restrict `/tmp/` and `/var/tmp` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Restrict `/dev/shm` mount options | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Polyinstantiated `/tmp` and `/var/tmp` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Set group for `/dev/shm` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| | | |\n| Encrypt `swap` | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n\n# Physical Access\n\n## Password for Single User Mode\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Protect Single User Mode with root password.\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/sysconfig/init.\n    SINGLE=/sbin/sulogin\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Protect Single User Mode. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n\n# Bootloader\n\n## Protect bootloader config files\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Ensure bootloader config files are set properly permissions.\n\n    **Example:**\n\n    ```bash\n    # Set the owner and group of /etc/grub.conf to the root user:\n    chown root:root /etc/grub.conf\n    chown -R root:root /etc/grub.d\n\n    # Set permissions on the /etc/grub.conf or /etc/grub.d file to read and write for root only:\n    chmod og-rwx /etc/grub.conf\n    chmod -R og-rwx /etc/grub.d\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Protect bootloader config files | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n\n# Linux Kernel\n\n## Kernel logs\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restricting access to kernel logs.\n\n    **Example:**\n\n    ```bash\n    echo \"kernel.dmesg_restrict = 1\" \u003e /etc/sysctl.d/50-dmesg-restrict.conf\n    ```\n\n## Kernel pointers\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Restricting access to kernel pointers.\n\n    **Example:**\n\n    ```bash\n    echo \"kernel.kptr_restrict = 1\" \u003e /etc/sysctl.d/50-kptr-restrict.conf\n    ```\n\n## ExecShield\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e ExecShield protection.\n\n    **Example:**\n\n    ```bash\n    echo \"kernel.exec-shield = 2\" \u003e /etc/sysctl.d/50-exec-shield.conf\n    ```\n\n## Memory protections\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Randomise memory space.\n\n    ```bash\n    echo \"kernel.randomize_va_space=2\" \u003e /etc/sysctl.d/50-rand-va-space.conf\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Restricting access to kernel logs | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Restricting access to kernel pointers | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| ExecShield protection | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Randomise memory space. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n\n# Logging\n\n## Syslog\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Ensure syslog service is enabled and running.\n\n    **Example:**\n\n    ```bash\n    systemctl enable rsyslog\n    systemctl start rsyslog\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Send syslog data to external server.\n\n    **Example:**\n\n    ```bash\n    # ELK\n    # Logstash\n    # Splunk\n    # ...\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Ensure syslog service is enabled and running. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Ensure syslog service is enabled and running. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n\n# Users and Groups\n\n## Passwords\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Update password policy (PAM).\n\n    **Example:**\n\n    ```bash\n    authconfig --passalgo=sha512 \\\n    --passminlen=14 \\\n    --passminclass=4 \\\n    --passmaxrepeat=2 \\\n    --passmaxclassrepeat=2 \\\n    --enablereqlower \\\n    --enablerequpper \\\n    --enablereqdigit \\\n    --enablereqother \\\n    --update\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Limit password reuse (PAM).\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/pam.d/system-auth\n\n    # For the pam_unix.so case:\n    password sufficient pam_unix.so ... remember=5\n\n    # For the pam_pwhistory.so case:\n    password requisite pam_pwhistory.so ... remember=5\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Secure `/etc/login.defs` password policy.\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/login.defs\n    PASS_MIN_LEN 14\n    PASS_MIN_DAYS 1\n    PASS_MAX_DAYS 60\n    PASS_WARN_AGE 14\n    ```\n\n## Logon Access\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Set auto logout inactive users.\n\n    **Example:**\n\n    ```bash\n    echo \"readonly TMOUT=900\" \u003e\u003e /etc/profile.d/idle-users.sh\n    echo \"readonly HISTFILE\" \u003e\u003e /etc/profile.d/idle-users.sh\n    chmod +x /etc/profile.d/idle-users.sh\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Set last logon/access notification.\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/pam.d/system-auth\n    session required pam_lastlog.so showfailed\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Lock out accounts after a number of incorrect login (PAM).\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/pam.d/system-auth and /etc/pam.d/password-auth\n\n    # Add the following line immediately before the pam_unix.so statement in the AUTH section:\n    auth required pam_faillock.so preauth silent deny=3 unlock_time=never fail_interval=900\n\n    # Add the following line immediately after the pam_unix.so statement in the AUTH section:\n    auth [default=die] pam_faillock.so authfail deny=3 unlock_time=never fail_interval=900\n\n    # Add the following line immediately before the pam_unix.so statement in the ACCOUNT section:\n    account required pam_faillock.so\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Update password policy | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Limit password reuse | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Secure `/etc/login.defs` password policy | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Set auto logout inactive users. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Set last logon/access notification | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Lock out accounts after a number of incorrect login | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n\n# Filesystem\n\n## Hardlinks \u0026 Symlinks\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e Enable hard/soft link protection.\n\n    **Example:**\n\n    ```bash\n    echo \"fs.protected_hardlinks = 1\" \u003e /etc/sysctl.d/50-fs-hardening.conf\n    echo \"fs.protected_symlinks = 1\" \u003e\u003e /etc/sysctl.d/50-fs-hardening.conf\n    ```\n\n## Dynamic Mounting and Unmounting\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Disable uncommon filesystems.\n\n    **Example:**\n\n    ```bash\n    echo \"install cramfs /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install freevxfs /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install jffs2 /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install hfs /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install hfsplus /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install squashfs /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install udf /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install fat /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install vfat /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install nfs /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install nfsv3 /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    echo \"install gfs2 /bin/false\" \u003e /etc/modprobe.d/uncommon-fs.conf\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Enable hard/soft link protection. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/low.png\" alt=\"low\"\u003e | :black_square_button: |\n| Disable uncommon filesystems. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n\n# Permissions\n\n# SELinux \u0026 Auditd\n\n## SELinux Enforcing\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e Set SELinux Enforcing mode.\n\n    **Example:**\n\n    ```bash\n    # Edit /etc/selinux/config.\n    SELINUXTYPE=enforcing\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Set SELinux Enforcing mode. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/high.png\" alt=\"high\"\u003e | :black_square_button: |\n\n# System Updates\n\n# Network\n\n## TCP/SYN\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Enable TCP SYN Cookie protection.\n\n    **Example:**\n\n    ```bash\n    echo \"net.ipv4.tcp_syncookies = 1\" \u003e /etc/sysctl.d/50-net-stack.conf\n    ```\n\n## Routing\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Disable IP source routing.\n\n    **Example:**\n\n    ```bash\n    echo \"net.ipv4.conf.all.accept_source_route = 0\" \u003e /etc/sysctl.d/50-net-stack.conf\n    ```\n\n## ICMP Protocol\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Disable ICMP redirect acceptance.\n\n    **Example:**\n\n    ```bash\n    echo \"net.ipv4.conf.all.accept_redirects = 0\" \u003e /etc/sysctl.d/50-net-stack.conf\n    ```\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Enable ignoring to ICMP requests.\n\n    **Example:**\n\n    ```bash\n    echo \"net.ipv4.icmp_echo_ignore_all = 1\" \u003e /etc/sysctl.d/50-net-stack.conf\n    ```\n\n## Broadcast\n\n- \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e Enable ignoring broadcasts request.\n\n    **Example:**\n\n    ```bash\n    echo \"net.ipv4.icmp_echo_ignore_broadcasts = 1\" \u003e /etc/sysctl.d/50-net-stack.conf\n    ```\n\n## :ballot_box_with_check: Summary checklist\n\n| \u003cb\u003eRule\u003c/b\u003e | \u003cb\u003ePriority\u003c/b\u003e | \u003cb\u003eCheckbox\u003c/b\u003e |\n| :---        | :---:       | :---:        |\n| Enable TCP SYN Cookie protection. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Disable IP source routing. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Disable ICMP redirect acceptance. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| Enable ignoring to ICMP requests. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n| | | |\n| Enable ignoring broadcasts request. | \u003cimg src=\"https://github.com/trimstray/linux-hardening-checklist/blob/master/static/img/medium.png\" alt=\"medium\"\u003e | :black_square_button: |\n\n# Services\n\n# Tools\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrimstray%2Flinux-hardening-checklist","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrimstray%2Flinux-hardening-checklist","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrimstray%2Flinux-hardening-checklist/lists"}