The Practical Linux Hardening Guide
trimstray's guide to "creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG)" — MIT, 10.8k★, 694 forks, 173 commits (GitHub API, re-checked 2026-09-27; last push 2024-11-19, so the repo is dormant and only the star count still moves). The spoke's founding system-hardening source and its anchor for benchmark-based practice.
T2 rather than T1: it's a well-regarded independent compilation, not a standards body. The authority it carries is borrowed from the benchmarks it tracks — CIS v2.1.1, STIG for RHEL 7, NIST, PCI-DSS, audited via OpenSCAP — which are the T1 documents behind it.
How it's built
Chapters break into sections that each give rationale → solution → comments → resources. The rationale-first ordering is the useful part: every control arrives with the threat it answers, so a reader can tell which settings their environment actually needs instead of applying a config wholesale. That's the difference between hardening and cargo-culting, and it's a structural choice, not a stylistic one.
Scope is the host: boot and kernel, filesystems, services, accounts and authentication, network defaults, logging and audit. For turning the document into repeatable configuration it points at the DevSec Hardening Framework (dev-sec.io).
The dating problem, stated plainly
It targets RHEL 7 / CentOS 7, both long past their prime, against CIS v2.1.1. Specific settings and package names have moved; CentOS 7 in particular reached end of life. What survives is the taxonomy — which surfaces exist on a Linux host and what each is for — and the rationale text explaining why a control was ever recommended. Read it as a map, verify every command against a current benchmark. The repo has not been pushed since November 2024, which is why the page's re-check window is 180 days rather than 60: nothing on it changes except the star count.
What it doesn't cover
Host configuration only. Nothing about the application running on the box, which is where most breaches actually enter, and nothing about detection — a fully hardened host with no monitoring fails silently. The founding corpus's other two sources cover those layers, which is most of why this spoke exists as one spoke.
Related
system-hardening · security-benchmark · defensive-security · trimstray