hardening-linux-endpoint-with-cis-benchmark

name	hardening-linux-endpoint-with-cis-benchmark
description	Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","hardening","linux-security","CIS-benchmark","Ubuntu","RHEL"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Hardening Linux Endpoint with CIS Benchmark

When to Use

Use this skill when:

• Hardening Linux servers (Ubuntu, RHEL, CentOS, Debian) against CIS benchmarks
• Automating Linux security baselines using Ansible, OpenSCAP, or shell scripts
• Meeting compliance requirements (PCI DSS, HIPAA, SOC 2) for Linux endpoints
• Remediating findings from vulnerability scans or security audits

Do not use for Windows hardening (use hardening-windows-endpoint-with-cis-benchmark).

Common Misconfigurations & Verification

• auditd rules edited but never loaded: writing /etc/audit/rules.d/cis.rules does nothing until augenrules --load runs and auditctl -l lists them; an earlier -e 2 (immutable) line blocks later additions until reboot. Confirm the identity/scope/perm_mod watches are live, not just on disk.
• sysctl applied at runtime but not persisted: values set with sysctl -w revert on reboot. Verify the /etc/sysctl.d/99-cis.conf keys actually take effect — e.g. sysctl net.ipv4.conf.all.rp_filter after sysctl --system (some are overridden by cloud-init or a higher-numbered file).
• /tmp and /dev/shm options silently inactive: mount | grep -E '/tmp|/dev/shm' must show noexec,nosuid,nodev; an fstab typo leaves the partition mounted with defaults. A line in fstab is not proof it is applied.
• Config drift after baseline: re-run OpenSCAP on a schedule — a one-time pass does not catch package updates or an admin re-enabling PasswordAuthentication. Match the profile to the OS (ssg-ubuntu2204-ds.xml, cis_level1_server); a mismatched data stream reports false passes.
• Verify enforcement, not just config: after hardening, test from a second SSH session (so a bad sshd_config won't lock you out), then touch /etc/passwd and confirm an auditd identity key event is generated and shipped to the remote rsyslog/SIEM.

Prerequisites

• Root or sudo access on target Linux endpoints
• CIS Benchmark PDF for target distribution (from cisecurity.org)
• OpenSCAP or CIS-CAT for automated assessment
• Ansible for enterprise-scale remediation (optional)

Workflow

Step 1: Filesystem Configuration (Section 1)