🔒 Linux Hardening
Locking the doors before someone tests the handles. A practical checklist first, then the big compliance frameworks explained in plain English, with the Linux commands that go with them.
📚 Hardening & Compliance Guides
Click a title to view the full guide:
Linux Hardening Basics CIS Benchmarks Container and Kubernetes Hardening AKS Hardening (Azure Policy and Gatekeeper) PCI DSS HIPAA DISA STIG NIST 800-53 and 800-171 ISO 27001 and SOC 2 OpenSCAP, USG and Lynis Firewall Basics (nftables, ufw, firewalld) SSH Hardening in Depth fail2ban: Automatic Banning
I asked my server to be more secure.
It said Permission denied. Progress.
It said Permission denied. Progress.
Which Guide Do I Need?
- Just want a safe server — Start with Linux Hardening Basics, then the CIS Benchmarks (Level 1 is the sensible default)
- Running containers or Kubernetes — Container and Kubernetes Hardening, and the AKS Hardening guide if you are on Azure
- You take payment cards — PCI DSS
- You handle US health data — HIPAA
- US Department of Defense work — DISA STIG (and NIST 800-171 for contractors)
- US federal or FedRAMP — NIST 800-53
- Customers keep asking for a security report — SOC 2 or ISO 27001
- Want to actually check a server — OpenSCAP, USG and Lynis
⚠️ Heads up: A framework is met by your whole program (policies, people, evidence), not by a Linux setting alone, and hardening can break things. Test on a copy, keep console access, and check with your auditor or compliance officer. These pages are guides, not legal advice.
Coming Soon
- More hardening guides, as they get written up