security-baseline-ubuntu

Production-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, custom AppArmor/Firejail 0.9.80, Rootless Docker, AIDE integrity checks, Lynis audits, and secure hardware (YubiKey/Ledger). 17 languages.

🛡️ Advanced OS Hardening: Security, Privacy & Anonymity Guide

An enterprise-grade, comprehensive guide dedicated to host-level hardening, operational security (OpSec), and digital self-defense. This project is localized into 17 languages to empower journalists, human rights defenders, and infosec professionals globally.

🌐 Select Your Language

📌 Project Overview

This guide provides step-by-step instructions to transform a standard Linux distribution into a resilient, high-security workstation capable of mitigating advanced physical, supply-chain, and network-level threats. It focuses strictly on open-source solutions, host-level isolation, compliance verification, and radical reduction of the OS attack surface.

Key Security Vectors Covered:

• Hardware & Boot Hardening: Implementing strict bootloader password protection to mitigate Evil Maid attacks, enforcing pre-boot security standards, and establishing secure physical configuration lines.

• DMA & Memory Protection: Kernel-level IOMMU programming (iommu.passthrough=0) to block malicious Direct Memory Access via Thunderbolt/USB4/PCIe interfaces, combined with low-level kernel tuning to eliminate memory data remanence.

• Telemetry & Component Purging: Sanitizing the host completely via automated Bash scripting—purging built-in Canonical telemetry, completely disabling the Snapd ecosystem, and removing vulnerable print/discovery services (Avahi/CUPS).

• System Integrity & Security Auditing: Deploying a cryptographic baseline for system files via AIDE (File Integrity Monitoring) and validating the overall defensive posture using automated compliance stress-tests via Lynis.

• Sandboxing & Mandatory Access Control (MAC): Enforcing granular application containment by deploying strict AppArmor security policies and isolation chambers using the Firejail sandbox framework.

• Network Perimeter Isolation: Engineering bulletproof MAC address spoofing, disabling the IPv6 stack, and building an uncompromising UFW firewall architecture with a strict Kill Switch to completely eliminate traffic leaks outside the virtual boundary of the tun0 VPN interface.

• Browser Hardening: Extreme browser core modification via about:config and deployment of specialized user.js files to neutralize WebRTC leaks, browser fingerprinting, and advanced cross-site tracking.

• Hardware Token Integration: Elevating physical access controls to the hardware level by binding display managers, interactive shells, and local KeePassXC credential vaults directly to YubiKey 5 cryptographic tokens.

• Secure Virtualization & Crypto-Asset Protection: Designing secure workflows for isolated guest operating systems, advanced anti-forensic optimization of VDI virtual containers (zero-filling and compression), and sandboxing desktop interfaces for hardware wallets like Ledger Live.

• Data Sanitization & Anti-Forensics: Irreversible localized data destruction using low-level shred/wipe routines and systematic metadata extraction/scrubbing via the MAT2 toolkit to fortify operational security (OPSEC).

[!NOTE] Contributions are welcome! If you want to improve a translation, update technical content, or report a bug, please open an Issue or submit a Pull Request. Let's make the digital world safer together.