Linux VPS hardening playbooks and before/after audit reports.
Playbook, audit script, and this report are in the repo.
Score excludes unknown checks. A warning counts as half a pass. The bar is the after score; the mark is the before score.
Run it on your own server: sudo scripts/audit.sh --json
Short example from a fictional host. This page did not collect it.
{
"schema": "hardenkit.audit.v1",
"hostname": "web-01.globex.example",
"os": {"name": "Ubuntu", "version": "22.04"},
"kernel": "5.15.0-122-generic",
"read_only": true,
"privileged": false,
"summary": {"score": 98.2, "pass": 26, "fail": 0, "warn": 1, "unknown": 1}
}
Files come from a fixed whitelist. The request id is a key, not a filesystem path.
---
- name: Harden a Linux VPS
hosts: vps
become: true
gather_facts: true
pre_tasks:
- name: Require a supported operating system family
ansible.builtin.assert:
that:
- ansible_os_family in ["Debian", "RedHat"]
fail_msg: HardenKit supports Debian and RedHat families only.
roles:
- role: users
- role: ssh_hardening
- role: firewall
- role: fail2ban
- role: unattended_upgrades
when: ansible_os_family == "Debian"
- role: dnf_automatic
when: ansible_os_family == "RedHat"
- role: sysctl
- role: auditd
- role: filesystem
- role: time_sync