Secure Linux servers following CIS benchmarks and security best practices.
When to Use This Skill
Use this skill when:
- Hardening production servers
- Meeting compliance requirements
- Implementing security baselines
- Configuring secure SSH access
Target and recovery
Confirm distribution/version, selected CIS profile, current service config and user-authorized changes. Keep a known-working access session and out-of-band recovery, back up affected files privately, preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall/default-deny rules before verifying management access and IPv4/IPv6 requirements.
SSH Hardening
# Example sshd configuration; merge with existing policy
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers <confirmed-management-users>
User Security
# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
# Set the default for FUTURE accounts: inactivity after password expiry,
# not 30 days since last login; review service-account consequences first.
useradd -D -f 30
# Audit sudo usage
# Edit a reviewed /etc/sudoers.d/ fragment with visudo and validate with visudo -c.
# Do not append blindly to /etc/sudoers.
Firewall Configuration
# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable
# Alternative iptables changes require an isolated validated ruleset,
# management allow rules, conntrack, DNS/IPv6 decisions and timed rollback.
# Do not set INPUT DROP first on a live remote host.
Kernel Hardening
# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
# After reviewing a supported value set, apply the exact file separately:
# sudo sysctl -p /etc/sysctl.d/99-security.conf
File Permissions
# Inspect distro-prescribed owner/group/mode before any authorized repair.
# /etc/shadow group readability may be required; do not blanket chmod it.
# Find world-writable files
find / -xdev -type f -perm -0002 -ls
# Find SUID files
find / -xdev -perm -4000 -type f -ls
Audit Configuration
Package installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.
# Install auditd
apt install auditd
# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec
Best Practices
- Disable unused services
- Keep system updated
- Use fail2ban for intrusion prevention
- Enable SELinux/AppArmor
- Regular security audits
- Monitor log files
- Implement least privilege
Related Skills
- cis-benchmarks (
cis-benchmarks) - Compliance scanning - firewall-config (
firewall-config) - Firewall rules
Limitations
- Apply guidance only within authorized scope; test destructive steps in non-production first.
- Docs-only import: upstream scripts and templates not bundled.
Example
# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20
Adapted from BagelHole/DevOps-Security-Agent-Skills (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.