Linux Server Hardening: CIS Benchmarks in Practice

“This course contains the use of artificial intelligence.”

This is the rebuilt, hands-on edition of Linux Server Hardening: CIS Benchmarks in Practice. Instead of describing controls from slides, you harden a real Ubuntu 24.04 LTS server in a virtual machine, one control at a time, and prove each change with a scan. More than half of the content lectures are screen-recorded labs marked [LAB]: every command is run on camera, and the output you see is the output it really printed.

The course has one running artefact, the baseline: a hardened Ubuntu 24.04 LTS host plus its evidence pack, made of a tailoring file, an exception register, an Ansible role and before-and-after scan reports. You build the lab host with snapshots so you can break things safely, install OpenSCAP and the SCAP Security Guide, run your first CIS scan and learn to read the report without chasing the score.

You then learn to read the benchmark like an engineer: the description, rationale and impact of a recommendation, its audit and remediation blocks, automated versus manual controls, how one recommendation maps to an oscap rule ID, and how to write a tailoring file for the deviations you genuinely need. CIS profiles are treated as what they are: recommendations, not law.

The hardening sections follow the benchmark in order: partitions and mount options, filesystem module blacklists, GRUB passwords and kernel parameters verified after a real reboot, package sources and automatic updates, service reduction and time synchronisation, a default-deny host firewall with nftables, ufw or firewalld, SSH verified with sshd -T and ssh -Q, accounts, PAM, pam_pwquality, pam_faillock and sudo, journald, rsyslog and auditd with immutable rules, file permissions, SUID/SGID baselines, AIDE, and AppArmor. RHEL 9 differences such as dnf, firewalld and SELinux are called out where they matter.

Then comes the part most courses skip: what to do when hardening breaks production. You diagnose a host that stopped accepting connections, roll back a single control and prove the rollback, and write exceptions an auditor will accept. After that you turn the baseline into code with SSG-generated remediation and an Ansible CIS role, bake a hardened image, and add a compliance gate to CI that fails the build on drift.

The final section covers audit evidence and operations: before-and-after reports, a second opinion with Lynis, scheduled drift scanning, the evidence pack you hand an auditor, and how to move to a new benchmark version. Licensed consoles such as CIS-CAT Pro and Ubuntu Pro’s Security Guide are explained conceptually and never used in the labs; everything you run is free and open source.

Ten downloadable working documents accompany the course, from the hardening baseline template and the tailoring file starter kit to the SSH hardening guide, the exception register and the audit evidence and drift monitoring kit, plus the lab scripts as a download, so the artefacts you build are ones you can take to work.