Linux System Hardening & Audit Script 🛡️

A lightweight, automated Bash script designed to apply baseline security hardening to newly provisioned Linux servers. Supports both RHEL/Fedora and Debian/Ubuntu environments.

---

⚡ Key Features

• OS Detection: Automatically identifies package manager and system architecture (apt vs dnf/yum).
• Service Minimisation: Identifies, stops, and disables legacy or insecure services (telnet, vsftpd, cups, etc.).
• SSH Hardening:
  • Backs up existing sshd_config with a timestamp before making edits.
  • Disables direct root login.
  • Disables password authentication (enforces SSH keys).
  • Disables empty passwords.
• Automated Firewall Baseline:
  • Configures UFW on Debian/Ubuntu (Deny Incoming, Allow Outgoing, Allow SSH).
  • Configures Firewalld on RHEL/Fedora derivatives (Sets default zone to drop, opens SSH).
• Audit Logging: Logs all terminal output, warnings, and changes to /var/log/system_hardening_<date>.log.

---

🚀 Quick Start

⚠️ Warning: This script disables SSH password authentication. Ensure you have valid SSH key access configured before running this script to avoid locking yourself out of your server.

1. Clone the repository

git clone https://github.com/SudoShea/linux-system-hardening.git
cd linux-system-hardening

2. Make the script executable

chmod +x harden.sh

3. Run as root

sudo ./harden.sh

Example Terminal Output

[+] Starting system hardening script. Logging to /var/log/system_hardening_2026-07-23_16:00:00.log
[+] Detected Operating System: fedora
[+] Phase 1: Disabling insecure and unused services...
[+] Phase 2: Securing SSH configuration...
[+] Backed up sshd_config to /etc/ssh/sshd_config.bak_2026-07-23_16:00:00
[+] SSH configuration updated and service restarted.
[+] Phase 3: Configuring Firewall...
[+] Setting up Firewalld (RHEL/Fedora)...
[+] Firewalld enabled and set to drop all incoming except SSH.

==============================================================================
Hardening Complete!
==============================================================================

---

📄 License

Distributed under the MIT License. See LICENSE for details.