Project · Intermediate · about 14 hours
Harden a host and measure it against a benchmark
Harden a Linux server against a CIS-style benchmark, automate the changes, and produce before-and-after compliance scores with evidence.
Skills:Security compliance and data protection, Linux and Bash, Security fundamentals
Part of: Cybersecurity Engineer
Brief
Hardening is a core security task with a clear measure of success: a benchmark score. Take a default server to a hardened, auditable state and prove the improvement.
What to build
Start a fresh Ubuntu VM and run a benchmark scanner (for example the CIS-CAT assessor or an open Lynis or OpenSCAP scan) to get a baseline
Write an Ansible role or script that applies hardening: password and login policy, SSH configuration, host firewall, auditd rules, disabling unused services, and file permissions on sensitive paths
Make it idempotent, so a second run changes nothing
Rescan and record the before-and-after scores
Write an exceptions register for anything you deliberately left, with the reason and any compensating control
Deliverables
Repository with the hardening automation,
scans/,EXCEPTIONS.mdandSUMMARY.md
How it is graded
Reviewers run your automation on a fresh VM, rescan, and compare with your reported scores.
Stretch
Add the scan to CI so a configuration drift lowers the score and fails the build.
Deliverables
- An automated hardening script or Ansible role mapped to benchmark controls
- Before-and-after scans with a benchmark tool
- A short exceptions register for controls you did not apply, with reasons
- A one-page summary for a manager and an auditor
How a reviewer grades it
| Criterion | Weight | What good looks like |
|---|---|---|
| Hardening covers accounts, SSH, firewall, auditing, services and file permissions | 30% | |
| Changes are automated and idempotent | 25% | |
| Before-and-after scores are real and the improvement is explained | 30% | |
| Exceptions are justified | 15% |