CAPSTONE

Full Server Hardening Checklist

< Shield House

HARDENING OBJECTIVES

0/10 Complete

    CIS HARDENING INTEL

    CAPSTONE MISSION

    This server just went through a pen test and failed spectacularly. Apply every hardening technique from the previous 7 labs: firewall, SSH, SELinux, audit logging, file integrity, sudo policies, and password rules. This is your final exam.

    [ ] Firewall: iptables default deny
    [ ] SSH: root disabled, key-only, port changed
    [ ] Sudo: RBAC, no NOPASSWD ALL
    [ ] Audit: watches on /etc/passwd, /etc/shadow
    [ ] Passwords: complexity, aging, lockout
    [ ] Services: disable unnecessary daemons
    [ ] Permissions: fix world-writable files
    [ ] Kernel: harden network parameters
    [ ] Integrity: establish AIDE baseline
    [ ] Verification: full audit

    Key Commands (All Labs)

    iptables -P INPUT DROP
    Default deny firewall
    sed -i 's/old/new/' /etc/ssh/sshd_config
    Edit SSH config
    auditctl -w /path -p rwxa -k key
    Add audit watch
    systemctl disable service
    Disable unnecessary service
    sysctl -w net.param=value
    Set kernel parameter
    Why This Matters
    CIS Benchmarks provide hardening checklists for every major OS. This capstone mirrors a real CIS Level 1 Server assessment. In the field, you will be expected to harden servers to these standards before they touch production. Everything from the previous 7 labs comes together here.