hardening-linux-endpoint-with-cis-benchmark

Featured

Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.

DevOps & Infrastructure 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Hardening Linux Endpoint with CIS Benchmark ## When to Use Use this skill when: - Hardening Linux servers (Ubuntu, RHEL, CentOS, Debian) against CIS benchmarks - Automating Linux security baselines using Ansible, OpenSCAP, or shell scripts - Meeting compliance requirements (PCI DSS, HIPAA, SOC 2) for Linux endpoints - Remediating findings from vulnerability scans or security audits **Do not use** for Windows hardening (use hardening-windows-endpoint-with-cis-benchmark). ## Prerequisites - Root or sudo access on target Linux endpoints - CIS Benchmark PDF for target distribution (from cisecurity.org) - OpenSCAP or CIS-CAT for automated assessment - Ansible for enterprise-scale remediation (optional) ## Workflow ### Step 1: Filesystem Configuration (Section 1) ```bash # 1.1.1 Disable unused filesystems cat >> /etc/modprobe.d/CIS.conf << 'EOF' install cramfs /bin/true install freevxfs /bin/true install jffs2 /bin/true install hfs /bin/true install hfsplus /bin/true install squashfs /bin/true install udf /bin/true EOF # 1.1.2 Ensure /tmp is a separate partition with nodev,nosuid,noexec # /etc/fstab entry: # tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0 systemctl unmask tmp.mount systemctl enable tmp.mount # 1.1.8 Ensure nodev option on /dev/shm mount -o remount,nodev,nosuid,noexec /dev/shm echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0" >> /etc/fstab # 1.4 Secure boot settings chown root:root /boot/grub/grub.cfg chmod 600 /boot/grub/grub.c...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

DevOps & Infrastructure Featured

hardening-windows-endpoint-with-cis-benchmark

Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.

12,642 Updated today
mukul975
DevOps & Infrastructure Listed

security-hardening

Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles. Use when hardening production infrastructure, meeting compliance requirements, or implementing defense-in-depth security.

368 Updated 5 months ago
ancoleman
DevOps & Infrastructure Featured

hardening-docker-containers-for-production

Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas

12,642 Updated today
mukul975
Data & Documents Solid

blue-team-defense--hardening

System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement

47 Updated today
Masriyan
AI & Automation Featured

performing-container-image-hardening

This skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.

12,642 Updated today
mukul975