An evolving how-to guide for securing a Linux server.
-
Updated
Jan 1, 2022
{{ message }}
An evolving how-to guide for securing a Linux server.
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
Prowler is a security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 200 controls covering CIS, ISO27001, GDPR, HIPAA, SOC2, ENS and other security frameworks.
Wazuh - The Open Source Security Platform
user.js -- Firefox configuration hardening
Migrate C code to Rust
Librefox: Firefox with privacy enhancements
Generates sandboxes for C/C++ libraries automatically
Simple Golang HTTPS/TLS Examples
A collection of awesome security hardening guides, tools and other resources
https://github.com/0xmachos/mOSL is a good replacement until this is updated.
Basically, we should remove all settings that are no longer relevant, and add ones that are newly added.
The Hitchhiker’s Guide to Online Anonymity
Hardening Ubuntu. Systemd edition.
Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.
USBGuard is a software framework for implementing USB device authorization policies (what kind of USB devices are authorized) as well as method of use policies (how a USB device may interact with the system)
Open-source tool to enforce privacy & security best-practices on Windows and macOS, because privacy is sexy
Security Knowledge Framework (SKF) Python Flask / Angular project
I'm not confident in the security brought by the readonly_exec statement.
In the classical *nix DAC model, it is expected for unprivileged users to be able to change the write permission flag on files they own. Therefore, Snuffleupagus readonly_exec statement only relies on the hope that an attacker won't find a way to rely on this standard mechanism to prevent the execution of arbitrary
Hardening Script for Linux Servers/ Secure LAMP-LEMP Deployer/ CIS Benchmark
A nice feature of http.Mux is that it can be used as a handler, so users can set up separate parts of an application on separate muxes that share a common configuration (e.g. a set of interceptors) and then install them on the root mux.
This is currently not possible with GSW, and we should seriously consider doing it.
Ansible playbook roles for security
Scripts built from our Guide to User Data Security
Kubernetes RBAC static Analysis & visualisation tool
Ansible role for Red Hat 7 CIS Baseline
Quickly secure UNIX/Linux systems
Continuously monitor your AWS services for configurations that can lead to degradation of confidentiality, integrity or availability. All results will be sent to Security Hub for further aggregation and analysis.
Add a description, image, and links to the security-hardening topic page so that developers can more easily learn about it.
To associate your repository with the security-hardening topic, visit your repo's landing page and select "manage topics."
Description of problem:
The bash remediation of selinux_state runs:
whereas the Ansible remediation doe