awesome-security-hardening

A collection of awesome security hardening guides, best practices, checklists, benchmarks, tools and other resources. This is work in progress: please contribute by sending your suggestions. You may do this by creating issue tickets or forking, editing and sending pull requests. You may also send suggestions on Twitter to @decalage2, or use https://www.decalage.info/contact

---

Table of Contents

• Security Hardening Guides and Best Practices
  • Hardening Guide Collections
  • GNU/Linux
    • Red Hat Enterprise Linux - RHEL
    • CentOS
    • SUSE
    • Ubuntu
  • Windows
  • macOS
  • Network Devices
    • Switches
    • Routers
    • IPv6
    • Firewalls
  • Virtualization - VMware
  • Containers - Docker - Kubernetes
  • Services
    • SSH
    • TLS/SSL
    • Web Servers
      • Apache HTTP Server
      • Apache Tomcat
      • Eclipse Jetty
      • Microsoft IIS
    • Mail Servers
    • FTP Servers
    • Database Servers
    • Active Directory
    • ADFS
    • Kerberos
    • LDAP
    • DNS
    • NTP
    • NFS
    • CUPS
  • Authentication - Passwords
  • Hardware - CPU - BIOS - UEFI
  • Cloud
• Tools
  • Tools to check security hardening
    • GNU/Linux
    • Windows
    • Network Devices
    • TLS/SSL
    • SSH
    • Hardware - CPU - BIOS - UEFI
    • Docker
    • Cloud
    • DNS
  • Tools to apply security hardening
    • GNU/Linux
    • Windows
    • TLS/SSL
    • Cloud
  • Password Generators
• Books
• Other Awesome Lists
  • Other Awesome Security Lists

---

Security Hardening Guides and Best Practices

Hardening Guide Collections

• CIS Benchmarks (registration required)
• ANSSI Guides
• NSA Cybersecurity Advisories & Guidance
• NSA Cybersecurity Resources for Cybersecurity Professionals and NSA Cybersecurity publications
• US DoD DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)
• OpenSCAP Security Policies
• Australian Cyber Security Center Publications
• FIRST Best Practice Guide Library (BPGL)
• Harden the World - a collection of hardening guidelines for devices, applications and OSs (mostly Apple for now).

GNU/Linux

• ANSSI - Configuration recommendations of a GNU/Linux system - version 2.0, 2022
• CIS Benchmark for Distribution Independent Linux - 2019, archived
• trimstray - The Practical Linux Hardening Guide - practical step-by-step instructions for building your own hardened systems and services. Tested on CentOS 7 and RHEL 7.
• trimstray - Linux Hardening Checklist - most important hardening rules for GNU/Linux systems (summarized version of The Practical Linux Hardening Guide)
• How To Secure A Linux Server - for a single Linux server at home
• nixCraft - 40 Linux Server Hardening Security Tips (2019 edition)
• nixCraft - Tips To Protect Linux Servers Physical Console Access
• TecMint - 4 Ways to Disable Root Account in Linux
• ERNW - IPv6 Hardening Guide for Linux Servers
• trimstray - Iptables Essentials: Common Firewall Rules and Commands
• Neo23x0/auditd - Best Practice Auditd Configuration
• CIRCL TR-83 - Linux Boot Hardening HOWTO - How to secure the boot sequence of your Linux based distribution (2024)

Red Hat Enterprise Linux - RHEL

• Red Hat - A Guide to Securing Red Hat Enterprise Linux 7
• DISA STIGs - Red Hat Enterprise Linux 7 (2019)
• CIS Benchmark for Red Hat Linux
• nixCraft - How to set up a firewall using FirewallD on RHEL 8

CentOS

• Lisenet - CentOS 7 Server Hardening Guide (2017)
• HighOn.Coffee - Security Harden CentOS 7 (2015)

SUSE

• SUSE Linux Enterprise Server 12 SP4 Security Guide
• SUSE Linux Enterprise Server 12 Security and Hardening Guide

Ubuntu

• Ubuntu documentation - Security
• Ubuntu wiki - Security Hardening Features

Windows