Authentication - Passwords

CUPS

• UK NCSC - Password administration for system owners
• NIST SP 800-63 Digital Identity Guidelines
• OWASP Password Storage Cheat Sheet
• ANSSI - Recommendations on multi-factor authentication and passwords
• ANSSI - Recommendations on multi-factor authentication and passwords
• ANSSI - Recommendations on multi-factor authentication and passwords

Cloud

CUPS

• NSA Info Sheet: Cloud Security Basics (August 2018)
• DISA DoD Cloud Computing Security
• asecure.cloud - Build a Secure Cloud - A free repository of customizable AWS security configurations and best practices
• NSA Info Sheet: Cloud Security Basics (August 2018)

Containers - Docker - Kubernetes

Firewalls

• How To Harden Your Docker Containers
• CIS Docker Benchmarks - registration required
• NIST SP 800-190 - Application Container Security Guide
• A Practical Introduction to Container Security
• ANSSI - Recommandations de sécurité relatives au déploiement de conteneurs Docker
• Kubernetes Security Checklist
• Kubernetes Role Based Access Control Good Practices
• Kubernetes Multi-tenancy
• Kubernetes blog - A Closer Look at NSA/CISA Kubernetes Hardening Guidance
• ReynardSec - Docker Security – Step-by-Step Hardening (Docker Hardening)
• ANSSI - Recommandations de sécurité relatives au déploiement de conteneurs Docker
• ANSSI - Recommandations de sécurité relatives au déploiement de conteneurs Docker

GNU/Linux

CentOS

• Lisenet - CentOS 7 Server Hardening Guide
• HighOn.Coffee - Security Harden CentOS 7

Red Hat Enterprise Linux - RHEL

• Red Hat - A Guide to Securing Red Hat Enterprise Linux 7
• DISA STIGs - Red Hat Enterprise Linux 7
• CIS Benchmark for Red Hat Linux
• nixCraft - How to set up a firewall using FirewallD on RHEL 8
• Red Hat - A Guide to Securing Red Hat Enterprise Linux 7

SUSE

• SUSE Linux Enterprise Server 12 Security and Hardening Guide
• SUSE Linux Enterprise Server 12 SP4 Security Guide

Ubuntu

• Ubuntu wiki - Security Hardening Features
• Ubuntu documentation - Security

• ANSSI - Configuration recommendations of a GNU/Linux system
• CIS Benchmark for Distribution Independent Linux
• nixCraft - 40 Linux Server Hardening Security Tips (2019 edition)
• nixCraft - Tips To Protect Linux Servers Physical Console Access
• TecMint - 4 Ways to Disable Root Account in Linux
• ERNW - IPv6 Hardening Guide for Linux Servers
• CIRCL TR-83 - Linux Boot Hardening HOWTO - How to secure the boot sequence of your Linux based distribution (2024)
• ANSSI - Configuration recommendations of a GNU/Linux system
• trimstray - The Practical Linux Hardening Guide - practical step-by-step instructions for building your own hardened systems and services. Tested on CentOS 7 and RHEL 7.
• trimstray - Linux Hardening Checklist - most important hardening rules for GNU/Linux systems (summarized version of The Practical Linux Hardening Guide)
• How To Secure A Linux Server - for a single Linux server at home
• Neo23x0/auditd - Best Practice Auditd Configuration
• CIS Benchmark for Distribution Independent Linux
• ANSSI - Configuration recommendations of a GNU/Linux system
• CIS Benchmark for Distribution Independent Linux - 2019, archived
• CIS Benchmark for Distribution Independent Linux - 2019, archived

Hardening Guide Collections

• ANSSI Best Practices
• NSA Cybersecurity Resources for Cybersecurity Professionals
• US DoD DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)
• OpenSCAP Security Policies
• Australian Cyber Security Center Publications
• FIRST Best Practice Guide Library (BPGL)
• Harden the World - a collection of hardening guidelines for devices, applications and OSs (mostly Apple for now).
• Harden the World - a collection of hardening guidelines for devices, applications and OSs (mostly Apple for now).
• NSA Cybersecurity Advisories & Guidance
• ANSSI Guides
• CIS Benchmarks

Hardware - CPU - BIOS - UEFI

CUPS

• ANSSI - Hardware security requirements for x86 platforms - recommendations for security features and configuration options applying to hardware devices (CPU, BIOS, UEFI, etc) (Nov 2019)
• NSA Info Sheet: UEFI Lockdown Quick Guidance (March 2018)
• NSA Tech Report: UEFI Defensive Practices Guidance (July 2017)
• ANSSI - Hardware security requirements for x86 platforms - recommendations for security features and configuration options applying to hardware devices (CPU, BIOS, UEFI, etc) (Nov 2019)
• NSA - Hardware and Firmware Security Guidance - Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance.
• NSA Info Sheet: UEFI Lockdown Quick Guidance (March 2018)
• NSA Tech Report: UEFI Defensive Practices Guidance (July 2017)
• ANSSI - Hardware security requirements for x86 platforms - recommendations for security features and configuration options applying to hardware devices (CPU, BIOS, UEFI, etc) (Nov 2019)

macOS

Ubuntu

• ERNW - IPv6 Hardening Guide for OS-X

Network Devices

Firewalls

• NIST SP 800-41 Rev 1 - Guidelines on Firewalls and Firewall Policy
• trimstray - Iptables Essentials: Common Firewall Rules and Commands

IPv6

• NSA - IPv6 Security Guidance
• Part 1 - an-enterprise-ipv6-security-strategy-part-2-network-isolation-on-the-routing-layer/), Part 3, Part 4 - Network Isolation on the Routing Layer, Traffic Filtering in IPv6 Networks

Routers

• NSA - A Guide to Border Gateway Protocol (BGP) Best Practices
• NSA - A Guide to Border Gateway Protocol (BGP) Best Practices

Switches

• DISA - Layer 2 Switch SRG v2r1

Ubuntu

• NSA - Harden Network Devices - very short but good summary

Other Awesome Security Lists

Cloud

• Awesome Security - A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
• Android Security Awesome - A collection of android security related resources.
• Awesome CTF - A curated list of CTF frameworks, libraries, resources and software.
• Awesome Hacking - A curated list of awesome Hacking tutorials, tools and resources.
• Awesome Honeypots - An awesome list of honeypot resources.
• Awesome Malware Analysis - A curated list of awesome malware analysis tools and resources.
• Awesome PCAP Tools - A collection of tools developed by other researchers in the Computer Science area to process network traces.
• Awesome Linux Containers - A curated list of awesome Linux Containers frameworks, libraries and software.
• Awesome Incident Response - A curated list of resources for incident response.
• Awesome Crypto Papers - A curated list of cryptography papers, articles, tutorials and howtos.
• Awesome Cyber Skills - A curated list of hacking environments where you can train your cyber skills legally and safely.
• Awesome Pentest - A collection of awesome penetration testing resources, tools and other shiny things.
• Awesome Web Hacking - This list is for anyone wishing to learn about web application security but do not have a starting point.
• Awesome Threat Intelligence - A curated list of threat intelligence resources.
• Awesome Pentest Cheat Sheets - Collection of the cheat sheets useful for pentesting
• Awesome Industrial Control System Security - A curated list of resources related to Industrial Control System (ICS) security.
• Awesome YARA - A curated list of awesome YARA rules, tools, and people.
• Awesome Threat Detection and Hunting - A curated list of awesome threat detection and hunting resources.
• Awesome Container Security - A curated list of awesome resources related to container building and runtime security
• Awesome Industrial Control System Security - A curated list of resources related to Industrial Control System (ICS) security.

Password Generators

Cloud

• How-To Geek - 10 Ways to Generate a Random Password from the Linux Command Line
• Vitux - 8 Ways to Generate a Random Password on Linux Shell
• SS64 - Password security and a comparison of Password Generators
• Awesome Cybersecurity Blue Team - A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

Services

Active Directory

• Microsoft - Best Practices for Securing Active Directory
• ANSSI CERT-FR - Active Directory Security Assessment Checklist - other version with changelog - 2022 (English and French versions)
• "Admin Free" Active Directory and Windows, Part 1- Understanding Privileged Groups in AD
• "Admin Free" Active Directory and Windows, Part 2- Protected Accounts and Groups in Active Directory
• "Admin Free" Active Directory and Windows, Part 1- Understanding Privileged Groups in AD
• ASD - Detecting and mitigating Active Directory compromises - 2024

ADFS

• adsecurity.org - Securing Microsoft Active Directory Federation Server (ADFS)
• Microsoft - Best practices for securing Active Directory Federation Services

CUPS

• CUPS Server Security

Database Servers

• Netwrix - MS SQL Server Hardening Best Practices
• Netwrix - MS SQL Server Hardening Best Practices
• Netwrix - MS SQL Server Hardening Best Practices

DNS

• CIS - BIND DNS Server 9.9 Benchmark
• DISA STIGs - BIND 9.x
• NIST SP 800-81-2 - Secure Domain Name System (DNS) Deployment Guide
• CMU SEI - Six Best Practices for Securing a Robust Domain Name System (DNS) Infrastructure

FTP Servers

• JSCAPE - Guide for securing FTP - Generic recommandations but based on JSCAPE MFT Server

Kerberos

• CIS MIT Kerberos 1.10 Benchmark - 2012

LDAP

• OpenLDAP Software 2.4 Administrator's Guide - OpenLDAP Security Considerations
• Best Practices in LDAP Security
• LDAP: Hardening Server Security (so administrators can sleep at night)
• LDAP Authentication Best Practices - retrieved from web.archive.org
• Hardening OpenLDAP on Linux with AppArmor and systemd - slides
• zytrax LDAP for Rocket Scientists - LDAP Security
• How To Encrypt OpenLDAP Connections Using STARTTLS
• LDAP Authentication Best Practices - retrieved from web.archive.org

Mail Servers

• MDaemon - 15 Best Practices for Protecting Your Email - Generic recommandations but based on MDaemon Security Gateway for Email Servers

NFS

• Linux NFS-HOWTO - Security and NFS - a good overview of NFS security issues and some mitigations
• Red Hat - RHEL7 Storage Administration Guide - Securing NFS
• NFSv4 without Kerberos and permissions - why NFSv4 without Kerberos does not provide security
• CertDepot - RHEL7: Use Kerberos to control access to NFS network shares
• Linux NFS-HOWTO - Security and NFS - a good overview of NFS security issues and some mitigations
• Red Hat - RHEL7 Storage Administration Guide - Securing NFS

NTP

• IETF - Network Time Protocol Best Current Practices draft-ietf-ntp-bcp
• CMU SEI - Best Practices for NTP Services
• Linux.com - Arrive On Time With NTP -- Part 2: Security Options
• Linux.com - Arrive On Time With NTP -- Part 3: Secure Setup

SSH

• NIST IR 7966 - Security of Interactive and Automated Access Management Using Secure Shell (SSH)
• ANSSI - (Open)SSH secure use recommendations
• Linux Audit - OpenSSH security and hardening
• Positron Security SSH Hardening Guides - focused on crypto algorithms
• stribika - Secure Secure Shell - some algorithm recommendations might be slightly outdated
• IETF - Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH) draft-ietf-curdle-ssh-kex-sha2-10 - update to the recommended set of key exchange methods for use in the Secure Shell (SSH) protocol to meet evolving needs for stronger security. This document updates RFC 4250.
• Gravitational - How to SSH Properly - how to configure SSH to use certificates and two-factor authentication
• ANSSI - (Open)SSH secure use recommendations
• Linux Audit - OpenSSH security and hardening
• Gravitational - How to SSH Properly - how to configure SSH to use certificates and two-factor authentication
• ANSSI - (Open)SSH secure use recommendations

TLS/SSL

• Applied Crypto Hardening: bettercrypto.org - handy reference on how to configure the most common services’ crypto settings (TLS/SSL, PGP, SSH and other cryptographic tools)
• NIST SP800-52 Rev 2 (2nd draft) - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations - 2018, recommends TLS 1.3
• Netherlands NCSC - IT Security Guidelines for Transport Layer Security (TLS) - 2021
• ANSSI - Security Recommendations for TLS - 2017, does not cover TLS 1.3
• Qualys SSL Labs - SSL and TLS Deployment Best Practices - 2017, does not cover TLS 1.3
• ANSSI - Security Recommendations for TLS - 2017, does not cover TLS 1.3
• ANSSI - Security Recommendations for TLS - 2017, does not cover TLS 1.3

Web Servers

• Cipherlist.eu - Strong Ciphers for Apache, nginx and Lighttpd
• Apache HTTP Server documentation - Security Tips
• GeekFlare - Apache Web Server Hardening and Security Guide
• Apache Config - Apache Security Hardening Guide
• Apache Tomcat 9 Security Considerations - 8.0-doc/security-howto.html) / v7
• OWASP Securing tomcat
• How to get Tomcat 9 to work with authbind to bind to port 80
• Eclipse Jetty - Configuring Security
• Jetty hardening
• CIS Microsoft IIS Benchmarks
• OWASP Securing tomcat

Tools to apply security hardening

Cloud

• DevSec Hardening Framework - a framework to automate hardening of OS and applications, using Chef, Ansible and Puppet

GNU/Linux

• Bastille Linux - outdated
• Linux Server Hardener - for Debian/Ubuntu (2019)
• Bastille Linux - outdated

Windows

• Microsoft Security Compliance Toolkit 1.0 - set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products
• mackwage/windows_hardening.cmd - Script to perform some hardening of Windows 10
• Hardentools - for Windows individual users (not corporate environments) at risk, who might want an extra level of security at the price of some usability.
• Windows 10 Hardening - A collective resource of settings modifications (mostly opt-outs) that attempt to make Windows 10 as private and as secure as possible.
• Disassembler0 Windows 10 Initial Setup Script - PowerShell script for automation of routine tasks done after fresh installations of Windows 10 / Server 2016 / Server 2019
• Automated-AD-Setup - A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening
• Windows 10/11 Hardening Script by ZephrFish - PowerShell script to harden Windows 10/11

Tools to check security hardening

Cloud

• toniblyx/my-arsenal-of-aws-security-tools - List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

CUPS

• Chef InSpec - open-source testing framework by Chef that enables you to specify compliance, security, and other policy requirements. can run on Windows and many Linux distributions.

DNS

• IntoDNS.ai - Free DNS and email security scanner. Checks SPF, DKIM, DMARC, DNSSEC, BIMI, MTA-STS configuration and provides AI-powered fix suggestions.

Docker

• Docker Bench for Security - script that checks for dozens of common best-practices around deploying Docker containers in production, inspired by the CIS Docker Community Edition Benchmark v1.1.0.

GNU/Linux

• Lynis - script to check the configuration of Linux hosts
• OpenSCAP Base - oscap command line tool
• SCAP Workbench - GUI for oscap
• Tiger - The Unix security audit and intrusion detection tool
• otseca - Open source security auditing tool to search and dump system configuration. It allows you to generate reports in HTML or RAW-HTML formats.
• SUDO_KILLER - A tool to identify sudo rules' misconfigurations and vulnerabilities within sudo
• CIS Benchmarks Audit - bash script which performs tests against your CentOS system to give an indication of whether the running server may comply with the CIS v2.2.0 Benchmarks for CentOS (only CentOS 7 for now)
• CIS Debian Hardening - Modular Debian 11/12/13 security hardening scripts based on CIS Benchmarks recommendations.
• VPS Security Audit Script - A comprehensive Bash script for auditing the security and performance of your VPS (Virtual Private Server)

Hardware - CPU - BIOS - UEFI

• CHIPSEC: Platform Security Assessment Framework - framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components
• chipsec-check - Tools to generate a Debian Linux distribution with chipsec to test hardware requirements

Network Devices

• Nipper-ng - to check the configuration of network devices (does not seem to be updated)

SSH

• ssh-audit - SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

TLS/SSL

• Qualys SSL Labs - List of tools to assess TLS/SSL servers and clients
• CryptoLyzer - Fast, flexible and comprehensive server cryptographic protocol (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI.
• SSLyze - Fast and powerful SSL/TLS scanning library.

Windows

• PingCastle - Tool to check the security of Active Directory
• Microsoft DSC Environment Analyzer (DSCEA) - simple implementation of PowerShell Desired State Configuration that uses the declarative nature of DSC to scan Windows OS based systems in an environment against a defined reference MOF file and generate compliance reports as to whether systems match the desired configuration