Hardening handbook
The whole hardening subject, from understanding the threats and the defense principles to why and how you harden each Linux component, and what Pavois audits.
Foundations
12 chaptersUnderstanding the threats to a Linux host →
Who attacks a server, how the **attack surface** lets them in, and how the **kill-chain** unfolds, mapped to **MITRE ATT&CK**, and why a hardened baseline breaks the chain at every link.
Why we harden →
A fresh install ships **permissive defaults**. Hardening shrinks the **attack surface** and the **blast radius** of a compromise, and makes a system **auditable** and **reproducible**.
The defense principles behind every rule →
Every Pavois rule is one **principle** made concrete: **defense in depth**, **least privilege**, **attack-surface reduction**, **fail-safe defaults**, **separation of duties**, **accountability**.
Effective configuration: the truth no file holds →
Pavois reads the configuration a service **actually resolves**, not the files that try to set it. The drop-in is the easy case; the real point is the state in **no file at all**: compiled-in defaults, resolved precedence, kernel values and generated units.
The standards Pavois maps to →
CIS, ANSSI-BP-028, NIST 800-53/171, PCI-DSS and STIG describe the same hardening from different angles. Pavois keeps **one neutral rule** and treats each standard as a **view** over it, with a stated mapping **strength**.
SOCLE control ID model →
Every Pavois control carries a stable SOCLE identifier, **`SOCLE-<DOMAIN>-<FAMILY>-<NUMBER>`**. How to read it, the real domains and families, and the stability rules that let you cite it.
Evidence & exports →
What a Pavois scan produces for an auditor: **effective checks**, graded reports, machine-readable exports (**JSON/SARIF/JUnit/CSV**) and the **OSCAL baseline**, and the limits to state honestly.
How the A-E grade is computed →
A single **A-E** letter is only worth trusting if you can **recompute it by hand**. Pavois publishes the full formula: severity-weighted penalties, per-band caps, and a **critical failure forces grade E**.
What a PASS proves: the qualified verdict →
Most scanners answer with one bit: pass or fail. Pavois qualifies every PASS on **two axes**, what evidence it read and whether it **survives a reboot**, and the verdict feeds the **A-E grade**.
Trust model for the evidence bundle →
A bundle is tamper-evident on its own; it becomes opposable audit evidence only once signed under a trust policy your organization accepts. Who signs, with which identity, how keys rotate, and how to verify offline.
Is SOCLE just your own norm? (governance & the circularity question) →
Pavois calls itself the executable Linux profile of SOCLE, a norm from the same author. That looks circular. The honest answer: what SOCLE is, what it explicitly is **not**, and why a control's authority rests on **external standards**, not on SOCLE's say-so.
What Pavois covers, and what it doesn't →
A reference is trusted for what it admits it cannot do. The honest map: the host-hardening domains Pavois audits **in depth**, the ones still **thin**, and what is **out of scope** by design.
Domains
18 chaptersHardening SSH →
SSH is the front door to a server. Harden the daemon so a remote foothold can't become full control, and verify the **effective** config, not the file.
Hardening PAM →
**PAM** is the gatekeeper every login passes through. Tune its modules so weak passwords, password reuse and brute-force never reach a shell, and lock accounts on repeated failure.
Mandatory Access Control (SELinux / AppArmor) →
Mandatory Access Control confines each service to **least privilege** so a compromised process can't roam the whole system. The only state that protects you is **enforcing** mode.
Hardening the host firewall →
A host firewall is the last gate in front of every listening service. **Default-deny** inbound so only the ports you chose are ever reachable, and allow SSH *before* you enable it.
Hardening sudo →
sudo is the controlled bridge from a user account to **root**. Harden the policy so one stolen session can't quietly become unaccountable, unauthenticated root, and log every escalation.
File Permissions & Ownership →
Sensitive files like `/etc/shadow`, SSH keys and cron jobs are only as safe as their **mode bits**. Tighten permissions, set a strict **UMASK**, kill **world-writable** files and review **SUID/SGID** so a low-privilege account can't read secrets or escalate.
Mount & filesystem hardening →
Split high-risk directories onto their own mounts and strip them with `nodev`, `nosuid`, `noexec` so a writable corner of the disk can't become a launch pad.
Hardening kernel modules →
Every loadable module is **kernel-mode code** waiting to run. Disable the unused filesystems and network protocols so a stray socket or a crafted disk image can't drag them in.
Hardening the kernel & network with sysctl →
The kernel's runtime tunables decide how the host routes packets and exposes its own memory. Tighten them so the network stack and the kernel itself stop helping an attacker, and make the change persist a reboot.
Audit logging with auditd →
Without a tamper-resistant **audit trail** you cannot say who did what. **auditd** records, inside the **kernel**, privileged commands, identity and permission changes, time changes and module loads, for **accountability** and **forensics**.
Hardening logging with journald and rsyslog →
Logs are the **black box** of a server. Make them **persistent**, **tamper-evident** and **shipped off-box** so an incident can be reconstructed after the fact.
Hardening systemd services →
Every running daemon is reachable **attack surface**. Turn off the units you don't need and **sandbox** the ones you keep, then measure each one's exposure.
Package hygiene →
Every installed package is code that can be exploited. Strip the **unneeded and insecure** ones, keep the rest **patched automatically**, and verify packages are **signed** and really on disk.
Hardening the bootloader (GRUB) →
GRUB runs before the OS and before any OS-level control. Protect it with a **password**, lock down `grub.cfg`, and pass hardening flags on the **kernel command line**.
Synchronizing time →
An accurate clock is **invisible plumbing** for security: logs, certificates and Kerberos all break when it drifts. Keep **one trustworthy, authenticated** NTP source disciplining the system clock.
Login banners and MOTD →
A login banner is both a legal notice you must display before authentication and a place where systems quietly leak their OS and kernel version: fix both.
Controlling cron and at access →
Scheduled jobs are an attacker's favourite way to **stay**. Lock down who may use `cron` and `at` with a **default-deny allow-list** so a foothold can't quietly become persistence.
Hardening the GNOME desktop (dconf) →
On workstations, **lock** the GNOME settings with dconf so a user, or malware in their session, can't weaken the desktop's defenses (screen lock, removable media, login banner).
Tooling
5 chaptersUndo a hardening run: restore points →
Pavois photographs the prior state before it converges, and can put it back. Measured on a live host: 597 of 620 controls returned to their exact prior state, and the 23 that did not are named. Here is how it works, and what it honestly cannot undo.
Operating Pavois: privileges, air-gap, timing, exceptions →
What Pavois needs from the target (root, and why a narrow sudoers does not work), how it runs without internet access, how long a scan actually takes, and how to record an accepted risk an auditor will accept.
Run Pavois in CI (GitHub Actions) →
Every scan returns an **exit code** a pipeline can gate on and emits **SARIF/JUnit/JSON/CSV/HTML**. Scan a disposable container or an **SSH target**, fail the job under a grade, and publish findings, secrets handled safely.
Feature status: delivered, partial, roadmap →
An honest map of every Pavois claim against what ships today, what is partial, and what is on the roadmap. No claim without a status.
Governance: licence, versioning, provenance, security →
Who maintains this, under what licence, how the rule base is versioned, where a mapping like CIS 5.1.20 comes from, what happens when CIS publishes a new benchmark, and how to report a vulnerability.