MR
Mayur Rathi
@sickn33
⭐ 47.3k GitHub stars

linux-hardening

linux-hardening is an code AI skill with a core value of Apply CIS benchmarks and secure Linux servers. It helps developers solve real-world problems in the code domain, boosting efficiency, automating repetitive tasks, and optimizing workflows.

Apply CIS benchmarks and secure Linux servers.

Last verified on: 2026-10-06

Quick Facts

Category code
Works With Claude
Source sickn33/antigravity-awesome-skills
Stars ⭐ 47.3k
Last Verified 2026-10-06
Risk Level Low
mkdir -p ./skills/linux-hardening && curl -sfL https://raw.githubusercontent.com/sickn33/antigravity-awesome-skills/main/skills/linux-hardening/SKILL.md -o ./skills/linux-hardening/SKILL.md

Run in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).

Skill Content

# Linux Hardening


Secure Linux servers following CIS benchmarks and security best practices.


When to Use This Skill


Use this skill when:

- Hardening production servers

- Meeting compliance requirements

- Implementing security baselines

- Configuring secure SSH access


SSH Hardening


bash 
# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Protocol 2

User Security


bash 
# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

# Lock inactive accounts
useradd -D -f 30

# Audit sudo usage
echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers

Firewall Configuration


bash 
# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable

# Or iptables
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Kernel Hardening


bash 
# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0

# Apply
sysctl -p

File Permissions


bash 
# Critical files
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 700 /root
chmod 600 /etc/ssh/sshd_config

# Find world-writable files
find / -type f -perm -0002 -ls

# Find SUID files
find / -perm -4000 -type f -ls

Audit Configuration


bash 
# Install auditd
apt install auditd

# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec

Best Practices


- Disable unused services

- Keep system updated

- Use fail2ban for intrusion prevention

- Enable SELinux/AppArmor

- Regular security audits

- Monitor log files

- Implement least privilege


Related Skills


- cis-benchmarks (`cis-benchmarks`) - Compliance scanning

- firewall-config (`firewall-config`) - Firewall rules


Limitations


- Apply guidance only within authorized scope; test destructive steps in non-production first.

- Docs-only import: upstream scripts and templates not bundled.


Example


bash 
# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20

> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

🎯 Best For

  • UX researchers
  • Product managers
  • Claude users
  • Software engineers
  • Development teams

💡 Use Cases

  • Mapping user journeys
  • Identifying friction points
  • Code quality improvement
  • Best practice enforcement

📖 How to Use This Skill

  1. 1

    Install the Skill

    Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.

  2. 2

    Load into Your AI Assistant

    Open Claude and reference the skill. Paste the SKILL.md content or use the system prompt tab.

  3. 3

    Apply linux-hardening to Your Work

    Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.

  4. 4

    Review and Refine

    Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.

❓ Frequently Asked Questions

Can this analyze user behavior data?

UX research skills work best when you provide session recordings, heatmaps, and analytics data.

Is linux-hardening compatible with Cursor and VS Code?

Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.

Do I need specific dependencies for linux-hardening?

Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.

How do I install linux-hardening?

Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/linux-hardening/SKILL.md, ready to use.

Can I customize this skill for my team?

Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.

⚠️ Common Mistakes to Avoid

Over-relying on AI insights

UX decisions should combine AI analysis with direct user feedback and research.

Skipping validation

Always test AI-generated code changes, even for simple refactors.

Missing dependency updates

Check if the skill requires updated dependencies or new packages.

🔗 Related Skills

00-andruia-consultant 00-andruia-consultant007 00720-andruia-niche-intelligence 20-andruia-niche-intelligenceaas-compose-stack aas-compose-stackaas-discover aas-discoveraccesslint-scan accesslint-scan