hardening-linux-endpoint-with-cis-benchmark

name	hardening-linux-endpoint-with-cis-benchmark
description	Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","hardening","linux-security","CIS-benchmark","Ubuntu","RHEL"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Hardening Linux Endpoint with CIS Benchmark

When to Use

Use this skill when:

• Hardening Linux servers (Ubuntu, RHEL, CentOS, Debian) against CIS benchmarks
• Automating Linux security baselines using Ansible, OpenSCAP, or shell scripts
• Meeting compliance requirements (PCI DSS, HIPAA, SOC 2) for Linux endpoints
• Remediating findings from vulnerability scans or security audits

Do not use for Windows hardening (use hardening-windows-endpoint-with-cis-benchmark).

Prerequisites

• Root or sudo access on target Linux endpoints
• CIS Benchmark PDF for target distribution (from cisecurity.org)
• OpenSCAP or CIS-CAT for automated assessment
• Ansible for enterprise-scale remediation (optional)

Workflow

Step 1: Filesystem Configuration (Section 1)

# 1.1.1 Disable unused filesystems
cat >> /etc/modprobe.d/CIS.conf << 'EOF'
install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install squashfs /bin/true
install udf /bin/true
EOF

# 1.1.2 Ensure /tmp is a separate partition with nodev,nosuid,noexec
# /etc/fstab entry:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0
systemctl unmask tmp.mount
systemctl enable tmp.mount

# 1.1.8 Ensure nodev option on /dev/shm
mount -o remount,nodev,nosuid,noexec /dev/shm
echo "tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0" >> /etc/fstab

# 1.4 Secure boot settings
chown root:root /boot/grub/grub.cfg
chmod 600 /boot/grub/grub.cfg
# Set GRUB password
grub-mkpasswd-pbkdf2  # Generate hash, add to /etc/grub.d/40_custom

Step 2: Services and Network (Sections 2-3)

# 2.1 Disable unnecessary services
systemctl disable --now avahi-daemon
systemctl disable --now cups
systemctl disable --now rpcbind
systemctl disable --now xinetd


apt install chrony -y  
systemctl  --now chrony


 >> /etc/sysctl.d/99-cis.conf << 
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
EOF
sysctl --system


ufw 
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh