I'm not sure there is anything new here... Ubuntu did start down the path of getting FIPS-140-2 and EAL, but I don't believe it was ever completed. The main r

I'm not sure there is anything new here... Ubuntu did start down the path of getting FIPS-140-2 and EAL, but I don't believe it was ever completed. The main reason for this, is paying users aren't screaming for it. It is a signficant investment, for a low return. There has been a number of external efforts for STIG compliance, but nothing formal. You can find a bunch of them on github. Most of the technical items that Major raises aren't really issues IMO. - Services starting by default: Don't like it, use policyrc.d to stop it. This can be done as part of the install, or via ansible prior to installing packages. - AIDE doing a full scan: Change the config, but as a default - covering everything is safer than leaving gaps (considering his effort is part of an Ansible project, this would seem logical!) - Verifying packages: Don't purely rely on the package manager for this! Use tripwire which is explicitly designed for this.. and debsums (with -a, that was omitted in the article [but isn't perfect]) - Firewall, permissive by default for most installations is perfectly acceptable. That is what post-install config is for. The target audience of Ubuntu server is cloud, where IaaS provided firewalls (security groups) provide the default protection, and for baremetals there should really be hardware firewalls as the 1st line of defence. However, doing # ufw default deny , switches to whitelist - LSM, AppArmor is a pretty good default. But selinux can be switched pretty easily. The main issue against selinux is that many find it hard to use, which means that systems are left insecure. As an out of the box solution, AppArmor does provide some confinement which for many is enough. When was the last time you saw a how-to that prefixed with disabling the LSM (not as common as it used to be). Generally, the out-of-box security experience isn't awful as it fits the majority of the users. Hardening for per-deployment basis is expected, but there hasn't been enough standardisation around this - which the ansible work Major is doing will be a good contribution. Whilst I'm a bit down on the actual content of this article, I'm really excited that Major is working on this and it is a good thing for Ubuntu when his work has finished. -- former Ubuntu Server Engineering Manager and current cloud/security.