linux-hardening — Claude Code skill: harden Linux servers
A skill that walks your agent through CIS benchmarks: SSH config, user policy, firewall rules and kernel parameters. Useful when a server heads to production or an audit.
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a claude-codeWhat linux-hardening does
The skill hands your agent ready-made configs and commands for Linux hardening. It covers SSH (no root login, no password auth, a cap on auth attempts), password policy through libpam-pwquality with minlen = 14, locking inactive accounts, and logging sudo to /var/log/sudo.log.
Then come firewall rules for UFW and iptables, kernel settings in /etc/sysctl.d/99-security.conf (redirects off, kernel.randomize_va_space = 2), permissions on files like /etc/shadow, and find commands for world-writable and SUID files. A separate block writes auditd rules that watch /etc/passwd, /etc/shadow and /etc/sudoers.
One thing to know before you run it: these commands change a live system, and ufw enable plus iptables -P INPUT DROP cut incoming traffic right away. Add the SSH rule first or you lock yourself out. Keep console access from your provider handy.
What it helps with
- close SSH to brute force and root logins
- set a password policy and account expiry
- build UFW or iptables rules from scratch
- bring sysctl values to safe defaults
- locate world-writable and SUID files
Example prompts for the agent
- harden SSH following CIS benchmarks
- check permissions on /etc/shadow and list SUID files
- write auditd rules to watch changes in /etc/passwd
How to install linux-hardening
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a claude-code2Manually: put the files in place
~/.claude/skills/linux-hardening/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/linux-hardening/
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a codex2Manually: put the files in place
.agents/skills/linux-hardening/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a cursor2Manually: put the files in place
.cursor/skills/linux-hardening/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install BagelHole/DevOps-Security-Agent-Skills linux-hardening2Manually: put the files in place
.github/skills/linux-hardening/SKILL.md1Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a gemini-cli2Platform CLI
gemini skills install https://github.com/BagelHole/DevOps-Security-Agent-Skills --path security/hardening/linux-hardeningManually: put the files in place
.devin/skills/linux-hardening/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about linux-hardening
How do I install linux-hardening in Claude?
Run npx skills add BagelHole/DevOps-Security-Agent-Skills --skill linux-hardening -a claude-code. The skill lands in ~/.claude/skills/linux-hardening/SKILL.md.
What does linux-hardening do?
It gives the agent configs and commands for Linux hardening: SSH, password policy, firewall, kernel parameters, file permissions and auditd rules.
What should I prepare before running it?
Console access to the server. The ufw enable and iptables -P INPUT DROP commands block incoming connections, so the SSH rule has to be in place first.
Source text
SKILL.md · MIT
--- name: linux-hardening description: Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance requirements. license: MIT metadata: author: devops-skills version: "1.0" --- # Linux Hardening Secure Linux servers following CIS benchmarks and security best practices. ## When to Use This Skill Use this skill when: - Hardening production servers - Meeting compliance requirements - Implementing security baselines - Configuring secure SSH access ## SSH Hardening ```bash # /etc/ssh/sshd_config PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes MaxAuthTries 3 ClientAliveInterval 300 ClientAliveCountMax 2 AllowUsers deploy admin Protocol 2 ``` ## User Security ```bash # Password policy sudo apt install libpam-pwquality # /etc/security/pwquality.conf minlen = 14 dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1 # Lock inactive accounts useradd -D -f 30 # Audit sudo usage echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers ``` ## Firewall Configuration ```bash # UFW setup ufw default deny incoming ufw default allow outgoing ufw allow ssh ufw allow 443/tcp ufw enable # Or iptables iptables -P INPUT DROP iptables -P FORWARD DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT ``` ## Kernel Hardening ```bash # /etc/sysctl.d/99-security.conf net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.icmp_echo_ignore_broadcasts = 1 kernel.randomize_va_space = 2 fs.suid_dumpable = 0 # Apply sysctl -p ``` ## File Permissions ```bash # Critical files chmod 600 /etc/shadow chmod 644 /etc/passwd chmod 700 /root chmod 600 /etc/ssh/sshd_config # Find world-writable files find / -type f -perm -0002 -ls # Find SUID files find / -perm -4000 -type f -ls ``` ## Audit Configuration ```bash # Install auditd apt install auditd # /etc/audit/rules.d/audit.rules -w /etc/passwd -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/sudoers -p wa -k actions -a always,exit -F arch=b64 -S execve -k exec ``` ## Best Practices - Disable unused services - Keep system updated - Use fail2ban for intrusion prevention - Enable SELinux/AppArmor - Regular security audits - Monitor log files - Implement least privilege ## Related Skills - [cis-benchmarks](../cis-benchmarks/) - Compliance scanning - [firewall-config](../../network/firewall-config/) - Firewall rules
© devops-skills · MIT · BagelHole/DevOps-Security-Agent-Skills
