// the find
trimstray/linux-hardening-checklist
Simple checklist to help you deploying the most important areas of the GNU/Linux production systems - work in progress.
A markdown checklist of Linux hardening steps organized by category: partitioning, kernel parameters, PAM, SELinux, network sysctl settings, and similar. It's a quick-reference for sysadmins setting up production Linux servers who want a prioritized list of what to do and in what order. The author also maintains a deeper companion guide (the-practical-linux-hardening-guide) for when you need the rationale behind each item.
The three-tier priority system (low/medium/high) is genuinely useful — it tells you what to skip on a rushed deployment vs. what's non-negotiable. The shell examples are copy-paste ready and specific, not hand-wavy. The checklist tables at the end of each section work well as a pre-flight for audits. It aligns with OpenSCAP, so what you check here roughly matches what automated compliance scanners will flag.
Several sections are completely empty (Permissions, System Updates, Services, Tools) — the skeleton exists but the content never showed up, and the last commit was late 2024 so don't expect it to. It's RHEL/CentOS-centric: some of it (authconfig, /etc/sysconfig/init, ExecShield) doesn't apply to Debian-based distros without translation. There's no rationale for any item, which means you're either taking these on faith or doing your own research — the companion guide is supposedly where that lives but you're clicking away for everything. icmp_echo_ignore_all = 1 blocking all ICMP is listed without any warning that it breaks network diagnostics and some MTU discovery paths.