Guide · Open source
How to use the-practical-linux-hardening-guide: read, clone and apply it
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Practical Linux Hardening Guide is a written checklist, not a program, that walks through making a Linux server more secure step by step. It is aimed at system administrators, students and teams preparing for CIS or STIG style compliance. After this guide you will know how to open the guide, where to find its explanations, and how to decide whether it fits your distribution and goals.
The Practical Linux Hardening Guidetrimstray/the-practical-linux-hardening-guide · ★ 10.9k · MIT Install options & downloads Quick start
- 1Decide if the target matches. Confirm your server runs RHEL 7 or CentOS 7, or accept that you must adapt the steps for another distribution.
- 2Open the guide. Read the guide online at its GitHub Pages homepage, or clone the repository to read it locally.
- 3Read the introduction and policy sections. Understand what the guide is, how it relates to CIS and STIG, and the general hardening rules.
- 4Pick a chapter and read its rationale. Read the rationale first so you understand why a change is needed before applying it.
- 5Apply the solution in a test environment. Use the compliant solution settings, test them against your workload, and adjust using the comments section.
- 6Check results with OpenSCAP tools if needed. For automated checks, consult the separate OpenSCAP-related sections and their own documentation.
What the guide is and what it is not
The guide provides a high-level overview of hardening GNU/Linux systems, along with practical step-by-step instructions for building hardened systems and services. The author states it is not an official standard or handbook, but it touches and uses industry standards.
It is based on minimal RHEL 7 and CentOS 7 installations. If you run another distribution, the author says the guide is still for you, but the exact steps were written for those versions.
- Type: a text guide, not software
- Licence: MIT
- Prerequisites: none listed in the source
Read the guide online or clone it locally
The simplest way to use the guide is to read it online at the project's homepage on GitHub Pages. To read it offline, clone the repository with git.
- Read online: open the project's GitHub Pages site, linked from the README as the guide's homepage
- Read locally: clone the repository and open the files in your editor or browser
git clone https://github.com/trimstray/the-practical-linux-hardening-guideUnderstand the chapter structure
Each chapter is split into subsections. Every subsection follows the same pattern, so you can scan for the part you need.
Rationale explains the reasoning behind a change. Solution and policies give the compliant configuration. Comments help you adapt it. Useful resources point to deeper reading.
- Rationale: why the change matters
- Solution (+ policies): the compliant setting to apply
- Comments: what you can change or add
- Useful resources: external reading
Check the compliance references before you apply changes
The guide follows two OpenSCAP configurations: a U.S. Government Commercial Cloud Services (C2S) baseline inspired by CIS v2.1.1, and the Red Hat Enterprise Linux 7 STIG. The STIG requirements are derived from NIST 800-53 and related documents.
The author notes that some comments may differ from industry principles. If you are unsure what to do, the guide directs you to the Policy Compliance section.
- C2S baseline (inspired by CIS v2.1.1) for RHEL 7
- RHEL 7 STIG, derived from NIST 800-53
- Policy Compliance section covers CIS, STIG, NIST and PCI-DSS
Apply the general hardening rules
The README lists general rules that apply before any specific setting. Use them as a filter when reading each chapter.
The author warns against applying every rule blindly. Each environment is different, so a rule that works in theory may not work in your setup. Test changes before relying on them.
- Never use the root account for anything that does not require it
- Only sudo individual commands
- Never run a server as root except at initialization, and drop unnecessary privileges before accepting requests
- Secure your firewall and forbid all unnecessary access
- Do not install unnecessary or unstable software
Use OpenSCAP tooling for automation
The guide says that in practice, these standards are complicated checklists, and that real-world implementation is ideally automated with something like OpenSCAP. The guide itself is text; the OpenSCAP tools it mentions are separate projects.
The README lists a SCAP Security Guide, OpenSCAP Base and SCAP Workbench as sections. Check their own documentation for install and usage details, since this guide does not give those commands in the source provided.
- SCAP Security Guide
- OpenSCAP Base
- SCAP Workbench
What people use it for
- Working through a hardening checklist on a new RHEL 7 or CentOS 7 server
- Learning why each server hardening step matters before applying it
- Preparing background notes for a CIS or STIG style compliance review
- Getting a starting point before reading the official benchmarks in full
Frequently asked questions
How do I install the practical linux hardening guide?
There is nothing to install. It is a written guide, and the source lists no prerequisites. You can read it online or clone the repository with git clone https://github.com/trimstray/the-practical-linux-hardening-guide to read it locally.
Is the practical linux hardening guide free and what is its licence?
Yes, the guide is licensed under MIT, as shown in the README and the LICENSE.md file linked from it. The source does not list any price.
Does the guide work on Ubuntu or other newer distributions?
The guide is based on minimal RHEL 7 and CentOS 7 installations and is tested on those versions. The author says it is also useful for other distributions, but commands and settings may need adapting.
Is this guide an official CIS or STIG standard?
No. The author states it is not an official standard or handbook. It uses the C2S baseline inspired by CIS and the RHEL 7 STIG as references, and recommends the official benchmarks for compliance.
What are the alternatives to this hardening guide?
The comparable projects listed are CIS Benchmarks, OpenSCAP, DevSec Hardening Framework and Lynis. CIS Benchmarks and the RHEL 7 STIG are the official checklists the guide draws on, while Lynis and OpenSCAP are automated tools.
Why does the guide say I should not apply every rule blindly?
The author says each environment is different, so rules that should work in theory may fail in practice. Use a rational approach and test changes before relying on them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this guide if you are a system administrator or student on RHEL 7 or CentOS 7 who wants a readable, reasoned checklist before reading the full CIS or STIG benchmarks. Pick something else if you need current instructions for newer distributions, an official standard for audits, or automated scanning, since the guide itself is text only.
Install options & downloads