Linux Hardening

A solid starting point for locking down Linux boxes with CIS-aligned configs. Covers the usual suspects: SSH hardening (no root login, key-based auth only), firewall rules via UFW or iptables, kernel parameter tweaks in sysctl, and auditd for tracking changes to sensitive files. The examples are copy-paste ready, which is helpful when you're setting up a new production server or trying to pass a compliance audit. It won't do everything for you, but it gives you the essential commands and config snippets in one place. Pair it with fail2ban and SELinux/AppArmor as suggested and you've got a reasonable baseline for most deployments.

skills.sh installs: 832
GitHub stars: 1.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add bagelhole/devops-security-agent-skills --skill linux-hardening --agent claude-code

Installs into .claude/skills of the current project.

Files

Linux Hardening

Secure Linux servers following CIS benchmarks and security best practices.

When to Use This Skill

Use this skill when:

Hardening production servers
Meeting compliance requirements
Implementing security baselines
Configuring secure SSH access

SSH Hardening

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Protocol 2

User Security

# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Lock inactive accounts
useradd -D -f 30

# Audit sudo usage
echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers

Firewall Configuration

# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Or iptables
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT