linux-hardening-checklist: Simple checklist to harden Linux systems

linux-hardening-checklist helps strengthen GNU/Linux systems by outlining essential hardening steps. Hardening reduces a system's attack surface by eliminating vulnerabilities. This checklist provides a prioritized set of rules to minimize potential attack vectors and improve overall security. The project is a continually evolving resource, aiming for compatibility with OpenSCAP standards.

The checklist prioritizes hardening tasks with clear levels (low, medium, high) and visual indicators. It emphasizes partitioning, mount options, and specific configuration changes. The inclusion of rationale and links to external resources enhances usability. The project is designed as a comprehensive list for system administrators and security professionals to systematically harden their Linux environments. The design consciously avoids forcing specific tools, promoting adaptability to various setups.

• Partitioning: Implement separate partitions for /boot, /home, /usr, /var, and /tmp to limit the impact of compromised partitions.
• Restrict Mount Options: Apply restrictive mount options (e.g., nodev, nosuid, noexec) to partitions like /usr, /var, /tmp, and /boot to further reduce attack surface.
• SELinux & Auditd: Configure SELinux enforcing mode and leverage auditd for comprehensive system logging and intrusion detection.
• Permissions: Enforce restrictive permissions on files and directories to limit unauthorized access.
• System Updates: Implement a regular system update schedule to patch vulnerabilities.
• Network Security: Configure firewall rules, restrict unnecessary network services, and implement secure network configurations.
• Logging: Configure comprehensive logging to capture system events for security analysis.

The project is actively developed and maintained, demonstrated by recent commits and ongoing improvements. Documentation is in progress but steadily expanding. Supports OpenSCAP and demonstrates awareness of security best practices. Community engagement is limited but growing.

This project is beneficial for system administrators, DevOps engineers, and security professionals seeking a structured approach to securing GNU/Linux systems. It’s valuable for hardening production servers, development environments, and personal workstations. By systematically applying the checklist, users can significantly reduce their systems' vulnerability to attacks and improve their overall security posture.