The Practical Linux Hardening Guide
A long, opinionated checklist for hardening Linux servers, tied to CIS and STIG benchmarks.
- Stars
- 10.9k
- Forks
- 699
- Licence
- MIT
- Language
- —
- Last update
- 2.0 years ago
- Type
- Learning resource
No commits in over a year — check for forks or alternatives before adopting.
What it is
This is a written guide, not a program, that walks through making a Linux server more secure step by step. It explains the reasoning behind each hardening step and offers configurations that follow the CIS and DISA STIG benchmarks, which are common industry checklists. The author says it is a practical checklist rather than an official standard, and it is based on RHEL 7 and CentOS 7.
- Work through the checklist to review the security settings of an existing server
- Use the rationale and comments sections to decide which hardening rules fit your environment
- Follow the linked CIS, STIG, and OpenSCAP resources to go deeper on a topic
- Use the guide as a reference when planning a server build
Great for
- System administrators hardening a Linux server who want a readable checklist
- Students learning what server hardening involves and why each step matters
- Teams preparing for CIS or STIG style compliance who want background explanations
- People who want a starting point before reading the official benchmarks in full
Not ideal for
- Anyone running only newer distributions who needs exact, current instructions, since the guide targets RHEL 7 and CentOS 7 (reason: the README says it is tested on those versions)
- Compliance auditors who need an official standard, since the author states it is not an official standard or handbook
- Readers who want automated tooling, since the guide is text and the OpenSCAP tooling it mentions is separate
How to get it
- 1
Read it online
Clone the repository to read the guide locally
git clone https://github.com/trimstray/the-practical-linux-hardening-guide - 2
Run it
- Open the guide online at the project's GitHub Pages site or in the cloned repository
- Read the Introduction to understand what hardening means and which standards are used
- Pick a chapter that matches your system and work through its Rationale and Solution sections
- Check the Policy Compliance section to choose which benchmark to follow
- 3
Get the most out of it
- Read the Policy Compliance section first to choose between CIS and STIG
- Use the linked OpenSCAP and SCAP Security Guide resources to automate checks
- Read the Useful resources links in each subsection for deeper detail
- Adapt the rules to your environment, since the author warns that not every rule will work everywhere
Downloads
Strengths
- Explains the reasoning behind each recommendation, not just the setting
- Links to external resources and industry standards so claims can be checked
- Clearly states its own limits and invites corrections
Trade-offs
- Built around RHEL 7 and CentOS 7, which are older releases, so some steps may not apply directly to current systems
- The author admits some rules could be done better and the guide is not exhaustive
- Mixes the author's own opinions with industry standards, so readers must judge which advice to follow
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| the-practical-linux-hardening-guide (this) | 10.9k | Learning resource | intermediate | 2.0 years ago | System administrators hardening a Linux server who want a readable checklist |
| macOS-Security-and-Privacy-Guide | 22.6k | Learning resource | intermediate | 4 days ago | Mac owners who want a checklist of security and privacy settings to work through |
| YubiKey-Guide | 13.1k | Learning resource | advanced | 4 days ago | Developers who want to sign commits and log in over SSH with a hardware-backed key |
| chezmoi | 22.1k | Dev tool | intermediate | 4 days ago | People who use more than one computer and want their settings to match |
| react | 47.1k | Learning resource | beginner | 2 months ago | React developers who are new to TypeScript and want copy-paste examples |
| claude-howto | 46.4k | Learning resource | beginner | 4 days ago | Developers who have installed Claude Code and want to go beyond basic prompts |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.