// the find
trimstray/the-practical-linux-hardening-guide
This guide details creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG).
A hardening guide for RHEL 7 and CentOS 7 systems, walking through CIS, STIG, NIST, and PCI-DSS compliance with OpenSCAP tooling. Aimed at sysadmins who need to bring Linux servers up to formal compliance standards rather than just following generic 'top 10 tips' blog posts.
Anchors every recommendation to actual policy standards (CIS, STIG, NIST) rather than opinion, which matters when you need to justify changes to an auditor. OpenSCAP integration is practical — the guide shows you how to generate HTML compliance reports with a single oscap command, not just tell you to install it. The rationale/solution/comments structure per subsection is well thought out: you know why a change is being made, not just what to run. Pointing to DevSec Hardening Framework for automation is a useful bridge for teams that want Ansible-driven hardening.
The guide is frozen on RHEL 7 / CentOS 7, both of which are end-of-life. CentOS 7 reached EOL in June 2024 and RHEL 7 in June 2024 as well — so anyone on current systems (RHEL 8/9, AlmaLinux, Rocky) gets diminishing returns here. The actual content lives in the GitHub Wiki, not the repo itself, which means the repo is essentially a README pointing elsewhere — not ideal for offline use or forking. Last meaningful content update appears to be years old; the November 2024 push date is probably a minor file touch, not real content updates. No coverage of systemd hardening primitives (PrivateTmp, NoNewPrivileges, CapabilityBoundingSet) which are now the practical first line of defense on modern systems.