hardening-linux-endpoint-with-cis-benchmark
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
Best use case
hardening-linux-endpoint-with-cis-benchmark is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
Teams using hardening-linux-endpoint-with-cis-benchmark should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How hardening-linux-endpoint-with-cis-benchmark Compares
| Feature / Agent | hardening-linux-endpoint-with-cis-benchmark | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Hardening Linux Endpoint with CIS Benchmark ## When to Use Use this skill when: - Hardening Linux servers (Ubuntu, RHEL, CentOS, Debian) against CIS benchmarks - Automating Linux security baselines using Ansible, OpenSCAP, or shell scripts - Meeting compliance requirements (PCI DSS, HIPAA, SOC 2) for Linux endpoints - Remediating findings from vulnerability scans or security audits **Do not use** for Windows hardening (use hardening-windows-endpoint-with-cis-benchmark). ## Prerequisites - Root or sudo access on target Linux endpoints - CIS Benchmark PDF for target distribution (from cisecurity.org) - OpenSCAP or CIS-CAT for automated assessment - Ansible for enterprise-scale remediation (optional) ## Workflow ### Step 1: Filesystem Configuration (Section 1) ```bash # 1.1.1 Disable unused filesystems cat >> /etc/modprobe.d/CIS.conf << 'EOF' install cramfs /bin/true install freevxfs /bin/true install jffs2 /bin/true install hfs /bin/true install hfsplus /bin/true install squashfs /bin/true install udf /bin/true EOF # 1.1.2 Ensure /tmp is a separate partition with nodev,nosuid,noexec # /etc/fstab entry: # tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0 systemctl unmask tmp.mount systemctl enable tmp.mount # 1.1.8 Ensure nodev option on /dev/shm mount -o remount,nodev,nosuid,noexec /dev/shm echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0" >> /etc/fstab # 1.4 Secure boot settings chown root:root /boot/grub/grub.cfg chmod 600 /boot/grub/grub.cfg # Set GRUB password grub-mkpasswd-pbkdf2 # Generate hash, add to /etc/grub.d/40_custom ``` ### Step 2: Services and Network (Sections 2-3) ```bash # 2.1 Disable unnecessary services systemctl disable --now avahi-daemon systemctl disable --now cups systemctl disable --now rpcbind systemctl disable --now xinetd # 2.2 Ensure NTP is configured apt install chrony -y # or systemd-timesyncd systemctl enable --now chrony # 3.1 Network parameters (host only, not router) cat >> /etc/sysctl.d/99-cis.conf << 'EOF' net.ipv4.ip_forward = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 net.ipv4.icmp_echo_ignore_broadcasts = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 net.ipv4.tcp_syncookies = 1 net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.default.accept_ra = 0 EOF sysctl --system # 3.4 Configure firewall (UFW or firewalld) ufw enable ufw default deny incoming ufw default allow outgoing ufw allow ssh ``` ### Step 3: Access Control (Sections 4-5) ```bash # 5.2 SSH Server Configuration (/etc/ssh/sshd_config) sed -i 's/#Protocol 2/Protocol 2/' /etc/ssh/sshd_config cat >> /etc/ssh/sshd_config << 'EOF' LogLevel VERBOSE MaxAuthTries 4 PermitRootLogin no PermitEmptyPasswords no PasswordAuthentication no X11Forwarding no MaxStartups 10:30:60 LoginGraceTime 60 AllowTcpForwarding no ClientAliveInterval 300 ClientAliveCountMax 3 EOF systemctl restart sshd # 5.3 Password policy (PAM) # /etc/security/pwquality.conf minlen = 14 dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1 # 5.4 User account settings # /etc/login.defs PASS_MAX_DAYS 365 PASS_MIN_DAYS 1 PASS_WARN_AGE 7 # Lock inactive accounts useradd -D -f 30 ``` ### Step 4: Audit and Logging (Section 4) ```bash # Install and configure auditd apt install auditd audispd-plugins -y systemctl enable --now auditd # /etc/audit/rules.d/cis.rules cat > /etc/audit/rules.d/cis.rules << 'EOF' -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d/ -p wa -k scope -w /var/log/sudo.log -p wa -k actions -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change -a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /var/log/faillog -p wa -k logins -w /var/log/lastlog -p wa -k logins -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm_mod -a always,exit -F arch=b64 -S unlink -S rmdir -S rename -k delete -w /sbin/insmod -p x -k modules -w /sbin/modprobe -p x -k modules -e 2 EOF augenrules --load # Configure rsyslog for remote logging echo "*.* @@syslog-server.corp.com:514" >> /etc/rsyslog.d/50-remote.conf systemctl restart rsyslog ``` ### Step 5: Assess with OpenSCAP ```bash # Install OpenSCAP apt install openscap-scanner scap-security-guide -y # Run CIS benchmark assessment oscap xccdf eval \ --profile xccdf_org.ssgproject.content_profile_cis_level1_server \ --results /tmp/cis_results.xml \ --report /tmp/cis_report.html \ /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml # View HTML report in browser for detailed results ``` ## Key Concepts | Term | Definition | |------|-----------| | **OpenSCAP** | Open-source SCAP (Security Content Automation Protocol) scanner for automated compliance | | **auditd** | Linux audit framework for monitoring system calls and file access | | **PAM** | Pluggable Authentication Modules; configurable authentication framework for Linux | | **sysctl** | Linux kernel parameter configuration for network and system security tuning | | **AIDE** | Advanced Intrusion Detection Environment; file integrity checker for Linux | ## Tools & Systems - **OpenSCAP**: Automated CIS benchmark assessment for Linux - **Ansible Lockdown**: Ansible roles for automated CIS benchmark remediation - **Lynis**: Open-source security auditing tool for Linux/Unix systems - **AIDE**: File integrity monitoring for Linux endpoints - **auditd**: Linux audit framework for system call monitoring ## Common Pitfalls - **Applying server benchmarks to workstations**: CIS provides separate benchmarks for server and workstation profiles. Server benchmarks disable desktop services. - **Breaking SSH access**: Misconfiguring sshd_config (especially PermitRootLogin, PasswordAuthentication) can lock out administrators. Always test SSH configuration changes from a second session. - **Not testing firewall rules**: Enabling UFW without allowing SSH first will disconnect remote sessions permanently. - **Kernel parameter changes without testing**: Some sysctl settings can break application networking. Test in staging first.
Related Skills
performing-privilege-escalation-on-linux
Linux privilege escalation involves elevating from a low-privilege user account to root access on a compromised system. Red teams exploit misconfigurations, vulnerable services, kernel exploits, and w
performing-linux-log-forensics-investigation
Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
performing-kubernetes-cis-benchmark-with-kube-bench
Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.
performing-endpoint-vulnerability-remediation
Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.
performing-endpoint-forensics-investigation
Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
performing-container-image-hardening
This skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.
implementing-rbac-hardening-for-kubernetes
Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
implementing-endpoint-dlp-controls
Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.
implementing-endpoint-detection-with-wazuh
Deploy and configure Wazuh SIEM/XDR for endpoint detection including agent management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, and automated response actions.
hunting-for-lolbins-execution-in-endpoint-logs
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.
hardening-windows-endpoint-with-cis-benchmark
Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
hardening-docker-daemon-configuration
Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.