eugexo/security-baseline-ubuntu
Production-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, Emergency Panic Button, custom AppArmor/Firejail 0.9.80 and Bubblewrap, Rootless Docker, AIDE integrity checks, Lynis audits, and secure hardware (YubiKey/Ledger). 17 languages.
If this practical guide has saved your host from compromise, helped you configure your security baseline, or saved you hours of debugging AppArmor and Firejail profiles, you can support the author and further development of this open-source initiative.
⚠️ OPSEC Warning: Double-check the addresses before sending any funds.
| Coin | Address |
|---|---|
 Monero (XMR) | 41iZ3BCmeDHJMqoWKYqkmWBM9WNFgMmBvhgt9iYRV6DZQHD5sjc5z2ubjMtdmie7vH3KatF8Qyg1bRsbtEJ5aAYHCZYQCwF |
 Bitcoin (BTC) | bc1q02qe2dujga6dw7d8m0m9s4ntngjq8ynrydxcwk |
 Solana (SOL) | H974LELMFSLw8f2M9hACc1vDxXRfHgQcBoL1Ef4AuYRw |
 Ripple (XRP) | rULyw4LQXiVV6ecciJPndq7SHHi2hc2tHv |
 USDT (TRC-20) | TKzQieJ7RjGeRHU8bi6wiuFruP9uYpuexL |
An enterprise-grade, comprehensive guide dedicated to host-level hardening, operational security (OpSec), and digital self-defense. This project is localized into 17 languages to empower journalists, human rights defenders, and infosec professionals globally.
| Language | Code | Quick Access |
|---|---|---|
| العربية (Arabic) | AR | 📖 اقرأ باللغة العربية | 📘 كِتَاب |
| বাংলা (Bengali) | BN | 📖 বাংলায় গাইড পড়ুন | 📘 বই |
| 中文 (Chinese) | ZH | 📖 閱讀中文版 | 📘 書籍 |
| Deutsch | DE | 📖 Auf Deutsch lesen | 📘 Buch |
| Eesti | ET | 📖 Loe juhendit eesti keeles | 📘 Raamat |
| English | EN | 📖 Read Guide in English | 📘 Book |
| Español | ES | 📖 Leer en Español | 📘 Libro |
| Français | FR | 📖 Lire en Français | 📘 Livre |
| हिन्दी (Hindi) | HI | 📖 हिंदी में पढ़ें | 📘 किताब |
| Bahasa Indonesia (Indonesian) | ID | 📖 Baca Panduan Indonesia | 📘 Buku |
| 日本語 (Japanese) | JA | 📖 日本語でガイドを読む | 📘 本 |
| 한국어 (Korean) | KO | 📖 한국어로 읽기 | 📘 책 |
| فارسی (Persian) | FA | 📖 به زبان فارسی بخوانید | 📘 کتاب |
| Português (Brasil) | PT-BR | 📖 Ler em Português | 📘 Livro |
| Русский | RU | 📖 Читать руководство на русском | 📘 Книга |
| Türkçe (Turkish) | TR | 📖 Kılavuzu Türkçe olarak okuyun | 📘 Kitap |
| اردو (Urdu) | UR | 📖 اردو میں گائیڈ پڑھیں | 📘 کتاب |
This guide provides step-by-step instructions to transform a standard Linux distribution into a resilient, high-security workstation capable of mitigating advanced physical, supply-chain, and network-level threats. It focuses strictly on open-source solutions, host-level isolation, compliance verification, and radical reduction of the OS attack surface.
Hardware & Boot Hardening: Implementing strict bootloader password protection to mitigate Evil Maid attacks, enforcing pre-boot security standards, and establishing secure physical configuration lines.
DMA & Memory Protection: Kernel-level IOMMU programming (iommu.passthrough=0) to block malicious Direct Memory Access via Thunderbolt/USB4/PCIe interfaces, combined with low-level kernel tuning to eliminate memory data remanence.
Telemetry & Component Purging: Sanitizing the host completely via automated Bash scripting—purging built-in Canonical telemetry, completely disabling the Snapd ecosystem, and removing vulnerable print/discovery services (Avahi/CUPS).
System Integrity & Security Auditing: Deploying a cryptographic baseline for system files via AIDE (File Integrity Monitoring), hunting rootkits with Rkhunter, and validating the overall defensive posture using automated compliance stress-tests via Lynis.
