awesome-security-hardening

A collection of awesome security hardening guides, best practices, tools and other resources. This is work in progress: please contribute by forking, editing and sending pull requests. You may also send suggestions on Twitter to @decalage2, or use https://www.decalage.info/contact

---

Security Hardening Guides and Best Practices

Hardening Guide Collections

• CIS Benchmarks (registration required)
• ANSSI Best Practices
• NSA Security Configuration Guidance
• NSA Cybersecurity Resources for Cybersecurity Professionals and NSA Cybersecurity publications
• US DoD DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)
• OpenSCAP Security Policies
• Australian Cyber Security Center Publications
• FIRST Best Practice Guide Library (BPGL)

GNU/Linux

• ANSSI - Configuration recommendations of a GNU/Linux system
• nixCraft - 40 Linux Server Hardening Security Tips (2019 edition)
• nixCraft - Tips To Protect Linux Servers Physical Console Access

Red Hat Enterprise Linux - RHEL

• A Guide to Securing Red Hat Enterprise Linux 7
• DISA STIGs RHEL
• nixCraft - How to set up a firewall using FirewallD on RHEL 8

SUSE

• SUSE Linux Enterprise Server 12 SP4 Security Guide
• SUSE Linux Enterprise Server 12 Security and Hardening Guide

Ubuntu

Windows

• Awesome Windows Domain Hardening

macOS

Network Devices

• NSA - Harden Network Devices - very short but good summary

Switches

• DISA - Layer 2 Switch SRG

Routers

• NSA - A Guide to Border Gateway Protocol (BGP) Best Practices

Virtualization - VMware

• VMware Security Hardening Guides

Services

SSH

• NIST IR 7966 - Security of Interactive and Automated Access Management Using Secure Shell (SSH)
• ANSSI - (Open)SSH secure use recommendations
• Linux Audit - OpenSSH security and hardening
• Positron Security SSH Hardening Guides - focused on crypto algorithms

TLS/SSL

• NIST SP800-52 Rev 2 (2nd draft) - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations - 2018, recommends TLS 1.3
• ANSSI - Security Recommendations for TLS - 2017, does not cover TLS 1.3
• Qualys SSL Labs - SSL and TLS Deployment Best Practices - 2017, does not cover TLS 1.3
• RFC 7540 Appendix A TLS 1.2 Cipher Suite Black List

Web Servers

• Cipherli.st - Strong Ciphers for Apache, nginx and Lighttpd

Apache HTTP Server

• Apache HTTP Server documentation - Security Tips
• GeekFlare - Apache Web Server Hardening and Security Guide
• Apache Config - Apache Security Hardening Guide

Apache Tomcat

• Apache Tomcat 9 Security Considerations / v8 / v7
• OWASP Securing tomcat
• How to get Tomcat 9 to work with authbind to bind to port 80

Eclipse Jetty

• Eclipse Jetty - Configuring Security
• Jetty hardening (2015)

Microsoft IIS

• CIS Microsoft IIS Benchmarks

Mail Servers

FTP Servers

Database Servers

LDAP

• OpenLDAP Security Considerations
• Best Practices in LDAP Security (2011)
• LDAP: Hardening Server Security (so administrators can sleep at night)
• LDAP Authentication Best Practices - retrieved from web.archive.org
• Hardening OpenLDAP on Linux with AppArmor and systemd - slides
• zytrax LDAP for Rocket Scientists - LDAP Security
• How To Encrypt OpenLDAP Connections Using STARTTLS

DNS

• NIST SP 800-81-2 - Secure Domain Name System (DNS) Deployment Guide (2013)
• CMU SEI - Six Best Practices for Securing a Robust Domain Name System (DNS) Infrastructure
• NSA BIND 9 DNS Security (2011)

NTP

• IETF - Network Time Protocol Best Current Practices draft-ietf-ntp-bcp (2019)
• CMU SEI - Best Practices for NTP Services
• Linux.com - Arrive On Time With NTP -- Part 2: Security Options
• Linux.com - Arrive On Time With NTP -- Part 3: Secure Setup

CUPS

• CUPS Server Security

Authentication - Passwords

• UK NCSC - Password administration for system owners
• NIST SP 800-63 Digital Identity Guidelines

Hardware - BIOS - UEFI

• NSA Info Sheet: UEFI Lockdown Quick Guidance (March 2018)
• NSA Tech Report: UEFI Defensive Practices Guidance (July 2017)

Cloud

• NSA Info Sheet: Cloud Security Basics (August 2018)
• DISA DoD Cloud Computing Security

Tools

Tools to check security hardening

GNU/Linux

• Lynis - script to check the configuration of Linux hosts
• OpenSCAP Base - oscap command line tool
• SCAP Workbench - GUI for oscap
• Tiger - The Unix security audit and intrusion detection tool (might be outdated)

Network Devices

• Nipper-ng - to check the configuration of network devices (does not seem to be updated)

TLS/SSL

• Qualys SSL Labs - List of tools to assess TLS/SSL servers and clients

Tools to apply security hardening

GNU/Linux

• Bastille Linux - outdated

Windows

• Hardentools - for Windows individual users (not corporate environments) at risk, who might want an extra level of security at the price of some usability.

Books