Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -113,9 +113,6 @@ After running a script:
3. Keep any backups created by the script until you are confident the system is working correctly.
4. Re-run relevant audits or service checks after applying changes.

> [!WARNING]
> The SSHD hardening script modifies SSH configurations. Ensure you have alternative access to your system before applying changes in production environments.

## Compatibility

The scripts target Linux systems with Bash 4.0 or newer. Compatibility varies by script because each one touches different tools, services, and configuration files.
Expand Down
2 changes: 1 addition & 1 deletion hardening/Nginx WAF/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ cd hardening/Nginx\ WAF/
sudo ./nginx-waf.bash
```

## Installation Summary
## Execution Summary

- Detects the installed Nginx version and configure arguments.
- Installs missing build dependencies through `apt-get`.
Expand Down
1 change: 0 additions & 1 deletion hardening/Root Locker/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ sudo ./hardening/Root\ Locker/root-locker.bash

- Confirm that at least one non-root user has working sudo access before running this script.
- Do not run this on a system where direct root login is the only available administrative access path.
- This script does not modify SSH configuration. If SSH allows root login through another authentication method, review `sshd_config` separately.

## Verify

Expand Down
4 changes: 1 addition & 3 deletions hardening/SSHD Hardening/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Hardens the OpenSSH server configuration using settings aligned with Lynis recommendations.

> [!WARNING]
> [!NOTE]
> This script modifies the system SSH daemon configuration. Treat it as a high-risk change on remote systems because an invalid or overly restrictive SSH configuration can lock you out.

## Requirements
Expand All @@ -21,8 +21,6 @@ Run the script from the repository root:
sudo ./hardening/SSHD\ Hardening/harden-sshd.bash
```

The script prompts before changing SSH configuration.

## Changes Made

The script updates supported settings in `/etc/ssh/sshd_config` when those settings are already present in the file:
Expand Down
6 changes: 2 additions & 4 deletions hardening/UFW Cloudflare/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Run the script from the repository root:
sudo ./hardening/UFW\ Cloudflare/ufw-cloudflare.bash
```

## Installation Summary
## Execution Summary

- Reads existing UFW rules marked with the `Cloudflare IP` comment.
- Downloads current Cloudflare IPv4 and IPv6 ranges from Cloudflare.
Expand Down Expand Up @@ -50,9 +50,7 @@ The temporary backup is removed during normal cleanup.

## Safety Notes

- This script changes firewall rules. Make sure you have recovery access before running it on a remote system.
- Confirm that SSH or other management ports are already allowed as needed before changing web rules.
- This script targets HTTP and HTTPS only: TCP ports `80` and `443`.
- Make sure you have recovery access before running it on a remote system.
- Direct origin access may remain possible through other open ports or non-UFW firewall layers.

## Verify
Expand Down