Awesome Security Hardening

An evolving how-to guide for securing a Linux server.

This guide details creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG).

The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Testing TLS/SSL encryption anywhere on any port

PowerShell script for automation of routine tasks done after fresh installations of Windows 10 / Server 2016 / Server 2019

Fast and powerful SSL/TLS scanning library.

Platform Security Assessment Framework

lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers.

Hardentools simply reduces the attack surface on Microsoft Windows computers by disabling low-hanging fruit risky features.

SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific misconfiguration or flaw in sudo to gain elevated privileges on the system, essentially allowing a regular user to execute commands as the root user.

No description.

Best Practice Auditd Configuration

Simple checklist to help you deploying the most important areas of the GNU/Linux production systems - work in progress.

Iptables Essentials: Common Firewall Rules and Commands.

PCI-DSS compliant Debian 12/13 hardening

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as general hardware and firmware security guidance. #nsacyber

Open source security auditing tool to search and dump system configuration. It allows you to generate reports in HTML or RAW-HTML formats.

Simple command line tool to check for compliance against CIS Benchmarks

Configuration guidance for implementing application whitelisting with AppLocker. #nsacyber

Configuration guidance for implementing Pass-the-Hash mitigations. #nsacyber

A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening.

An admittedly frivolous (and infrequently updated) attempt to harden Windows 10.

Scripts for comparing Microsoft Windows compliance with the ASD 1709 & Office 2016 Hardening Guides

Some settings stolen from multiple scripts @ZephrFish

Configuration guidance for implementing BitLocker. #nsacyber

POSIX shell script automating Linux/FreeBSD server security hardening.

MDE relies on some of the Audit settings to be enabled

Automatically exported from code.google.com/p/nipper-ng

Tools to generate a Linux distribution booting from a USB key to test hardware requirements

CryptoLyzer is a fast, flexible and comprehensive server cryptographic protocol (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI. (read-only clone of the original GitLab project)

No description.

cawk is a multi-supplier network configuration checker only based on the tuple (gawk,gmake,gm4) and IA code ready