Overview
This project implements a repeatable hardening workflow for Ubuntu Server 24.04 LTS based on CIS Benchmark controls. It includes both standalone Bash scripts and an Ansible role, plus Lynis-based before/after reporting and supporting tools such as auditd, AIDE, Fail2Ban, rkhunter, chkrootkit, and nftables.
The purpose is not to claim that a single script can make a server “secure”. The purpose is to show a systematic, auditable approach to reducing risk on a Linux host.
Results
On the documented test system, the workflow improved the Lynis hardening score from 62 to 84.
| Metric | Before | After | Change |
|---|---|---|---|
| Lynis hardening score | 62 | 84 | +22 |
| Unconfined AppArmor profiles | 7 | 0 | -7 |
| Lynis suggestions | 35 | 23 | -12 |
| Security tools installed | 0 | 7 | +7 |
These results depend on the starting image and chosen profile. The repo documents the measured environment and validation flow rather than treating the score as a universal guarantee.
Scope
The workflow covers filesystem options, AppArmor, GRUB, kernel parameters, service reduction, network hardening, nftables, SSH, PAM/sudo, auditd, and file integrity tooling.
It supports two execution styles:
- Bash scripts for lab use and direct step-by-step execution.
- Ansible for a more repeatable infrastructure-as-code approach.
Engineering Highlights
The Ansible role favors native modules where possible: ansible.posix.mount, ansible.posix.sysctl, community.general.pam_limits, ansible.builtin.systemd, and ansible.builtin.apt. GRUB password handling is designed around Ansible Vault instead of interactive prompts.
The workflow also includes safety-oriented documentation for areas that can cause operational issues, especially SSH access, firewall rules, audit immutability, and service behavior.
Why It Matters
Security hardening is only useful when it is repeatable and explainable. This project demonstrates not just a list of commands, but a workflow: baseline, apply controls, validate, report, and document tradeoffs.
For a recruiter or reviewer, it shows practical Linux administration, defensive security fundamentals, automation, and the ability to turn benchmark guidance into working implementation.
Lessons Learned
Hardening is full of real-world tradeoffs. Controls that look simple in a benchmark can affect remote access, service behavior, logging volume, or recovery procedures. Building both Bash and Ansible paths helped clarify which changes are straightforward and which require more careful operational planning.