3 ms·

Agreed. A more recent one which is quite extensive, yet a bit old, is https://madaidans-insecurities.github.io/guides/linux-hardening.html https://madaidans-ins

• velcrovan 2y ago
  What I want is an accompanying example Ansible playbook for at least one distribution so I can understand the reasoning behind each step and still do it all with a single command.
• josephcsible 2y ago
  That one is no good because it tries to normalize DRM and tivoization by pretending they're for "security". E.g., it says to set kernel.kexec_load_disabled=1, debugfs=off, module.sig_enforce=1, and lockdown=confidentiality, all of which only restrict the root user. It's also terrible for other reasons, e.g.: > net.ipv6.conf.all.accept_ra=0 > net.ipv6.conf.default.accept_ra=0 > Malicious IPv6 router advertisements can result in a man-in-the-middle attack, so they should be disabled. But that's the main way to configure IPv6. The IPv4 equivalent of that advice would be to disable your DHCP client, since malicious DHCP servers can result in a man-in-the-middle attack. And it also has the same horrendous advice for PAM to require the kinds of passwords that we now know reduce security.