Baseline and harden these machines
We turn off root login over SSH, limit sudo to named people and the commands they need, move SSH to keys behind multi-factor sign-in, set the firewall to deny by default, copy logs off each server and test a restore. Score your servers below to see which of those you already have.
About two minutes. No email to see the result.
Fresh start, or adding protection to employee machines?
It sets the price. A machine nobody uses yet has nothing to work around, so it costs less to lock down. Got both kinds? Pick already in use.
No email until step 5.
The kit behind the fixes, written up for whoever has to run it.
The open-source Security Content Automation Protocol (SCAP) framework. OpenSCAP evaluates system configurations against NIST, CIS, and DISA STIG stand...
Read the write-up →AIDE (Advanced Intrusion Detection Environment) takes a fingerprint of the files and directories you care about, then tells you exactly what changed s...
Read the write-up →Lynis is a free, open-source security auditor from CISOfy for Linux, macOS and other Unix systems. Nothing to install: extract the archive, run lynis...
Read the write-up →An SSH key copied off a laptop works from anywhere, for anyone, until you notice. This guide adds a second factor to every server login, either a hard...
Read the write-up →One of the original file integrity monitoring tools dating back to the 1990s, Tripwire Open Source pioneered the concept of cryptographic file signatu...
Read the write-up →The questions map to these benchmark topics. Section numbers move between releases, so we check them against the current benchmark at each audit instead of quoting them here.