The Practical Linux Hardening Guide
trimstray‘s guide to “creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG)” — MIT, 10.7k★, 678 forks, 173 commits. The spoke’s founding system-hardening source and its anchor for benchmark-based practice.
T2 rather than T1: it’s a well-regarded independent compilation, not a standards body. The authority it carries is borrowed from the benchmarks it tracks — CIS v2.1.1, STIG for RHEL 7, NIST, PCI-DSS, audited via OpenSCAP — which are the T1 documents behind it.
How it’s built
Chapters break into sections that each give rationale → solution → comments → resources. The rationale-first ordering is the useful part: every control arrives with the threat it answers, so a reader can tell which settings their environment actually needs instead of applying a config wholesale. That’s the difference between hardening and cargo-culting, and it’s a structural choice, not a stylistic one.
Scope is the host: boot and kernel, filesystems, services, accounts and authentication, network defaults, logging and audit. For turning the document into repeatable configuration it points at the DevSec Hardening Framework (dev-sec.io).
The dating problem, stated plainly
It targets RHEL 7 / CentOS 7, both long past their prime, against CIS v2.1.1. Specific settings
and package names have moved; CentOS 7 in particular reached end of life. What survives is the
taxonomy — which surfaces exist on a Linux host and what each is for — and the rationale text
explaining why a control was ever recommended. Read it as a map, verify every command against a current
benchmark. freshness: aging in the frontmatter is not decoration.
What it doesn’t cover
Host configuration only. Nothing about the application running on the box, which is where most breaches actually enter, and nothing about detection — a fully hardened host with no monitoring fails silently. The founding corpus’s other two sources cover those layers, which is most of why this spoke exists as one spoke.
Related
system-hardening · security-benchmark · defensive-security · trimstray