skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hardening-linux-endpoint-with-cis-benchmark

Hardens Linux servers against CIS Benchmarks using sysctl, auditd, sshd, and OpenSCAP.

954|172|Updated Mar 13, 2026
Search Tags:#auditd#sysctl#openscap#SSH hardening#CIS Benchmark#Compliance#linux hardening
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hardening-linux-endpoint-with-cis-benchmark
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hardening-linux-endpoint-with-cis-benchmark
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/hardening-linux-endpoint-with-cis-benchmark
Command: npx skills add https://github.com/xalgord/xalgorix --skill hardening-linux-endpoint-with-cis-benchmark

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Newly deployed Linux servers ship with permissive defaults that expand the attack surface and fail compliance audits, and manually applying hundreds of CIS Benchmark controls is error-prone and hard to verify.

Core Features & Use Cases

  • Step-by-step CIS remediation: Covers filesystem restrictions, kernel network parameters via sysctl, SSH hardening, PAM password policy, and auditd logging rules for Ubuntu, RHEL, and CentOS.
  • Automated compliance assessment: Runs OpenSCAP with the CIS Level 1 server profile to generate HTML reports proving which controls pass or fail.
  • Misconfiguration detection: Highlights common failure modes such as auditd rules never loaded, sysctl values not persisted, and /tmp mount options silently inactive.
  • Use Case: When deploying a new Ubuntu 22.04 server that must meet PCI DSS requirements, follow the workflow to apply CIS controls, then verify with an OpenSCAP scan before going to production.

Quick Start

Harden this Ubuntu 22.04 server against the CIS Level 1 server benchmark and verify the results with OpenSCAP.

Frequently Asked Questions about hardening-linux-endpoint-with-cis-benchmark

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden a Linux server with CIS Benchmarks?▼

Apply CIS controls in stages: disable unused filesystems, set kernel network parameters via /etc/sysctl.d, harden sshd_config, enforce PAM password policy, and configure auditd rules. Then verify with an OpenSCAP scan using the cis_level1_server profile.

How to run an OpenSCAP CIS benchmark scan on Ubuntu?▼

Install openscap-scanner and scap-security-guide, then run oscap xccdf eval with the cis_level1_server profile against the matching data stream such as ssg-ubuntu2204-ds.xml. The scan produces an XML results file and an HTML report.

Does CIS hardening work on RHEL and CentOS as well as Ubuntu?▼

Yes, the workflow covers Ubuntu, RHEL, and CentOS, but you must match the OpenSCAP data stream and profile to the specific OS version. A mismatched data stream reports false passes, so select the correct ssg content file for your distribution.

Why are my auditd rules not working after editing the rules file?▼

Writing rules to /etc/audit/rules.d/ does nothing until you run augenrules --load, and a -e 2 immutable flag blocks later additions until reboot. Confirm rules are live with auditctl -l rather than trusting the file on disk.

Can CIS hardening lock me out of SSH?▼

Yes, misconfiguring PermitRootLogin or PasswordAuthentication in sshd_config can lock out administrators. Always test changes from a second active SSH session and allow SSH in UFW before enabling the firewall.

Related Skills

Explore More Software Engineering Skills→
drupadsachaniadrupadsachania

infrastructure-security

Assess and harden infrastructure against vulnerabilities and configuration weaknesses.

Community
Advanced
AbsolutelySkilledAbsolutelySkilled
207

regulatory-compliance

Automate evidence collection and control mapping for SOC 2, HIPAA, and PCI-DSS compliance.

Official
Advanced
ryukyagamilightryukyagamilight
1

audit

Configure auditd and scan Linux systems for vulnerabilities and compliance issues.

Community
Advanced
jassicsjassics
6

host-hardening-review

Compare system configurations against the CIS Benchmark and identify deviations.

Community
Advanced