awesome-security-hardening - A collection of awesome security hardening guides,

项目说明

awesome-security-hardening

![Awesome]()

A collection of awesome security hardening guides, best practices, checklists, benchmarks, tools and other resources.
This is work in progress: please contribute by sending your suggestions. You may do this by creating issue tickets or forking, editing and sending pull requests. You may also send suggestions on Twitter to , or use

------

Table of Contents

Security Hardening Guides and Best Practices

- Hardening Guide Collections
- GNU/Linux
- Red Hat Enterprise Linux - RHEL
- CentOS
- SUSE
- Ubuntu
- Windows
- macOS
- Network Devices
- Switches
- Routers
- IPv6
- Firewalls
- -
- Containers - Docker - Kubernetes
- Services
- SSH
- TLS/SSL
- Web Servers
- Apache HTTP Server
- Apache Tomcat
- Eclipse Jetty
- Microsoft IIS
- Mail Servers
- FTP Servers
- Database Servers
- Acti
- ADFS
- Kerberos
- LDAP
- DNS
- NTP
- NFS
- CUPS
- Authentication - Passwords
- Hardware - CPU - BIOS - UEFI
- Cloud

Tools

- Tools to check security hardening
- GNU/Linux
- Windows
- Network Devices
- TLS/SSL
- SSH
- Hardware - CPU - BIOS - UEFI
- Docker
- Cloud
- DNS
- Tools to apply security hardening
- GNU/Linux
- Windows
- TLS/SSL
- Cloud
- Password Generators

Books

Other Awesome Lists

- Other Awesome Security Lists

------

Security Hardening Guides and Best Practices

Hardening Guide Collections

CIS Benchmarks (registration required)

ANSSI Guides

NSA Cybersecurity Ad & Guidance

NSA Cybersecurity Resources for Cybersecurity Professionals and NSA Cybersecurity publications

US DoD DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)

OpenSCAP Security Policies

Australian Cyber Security Center Publications

FIRST Best Practice Guide Library (BPGL)

Harden the World - a collection of hardening guidelines for devices, applications and OSs (mostly Apple for now).

GNU/Linux

ANSSI - Configuration recommendations of a GNU/Linux system - 2.0, 2022

CIS Benchmark for Distribution Independent Linux - 2019, archived

trimstray - The Practical Linux Hardening Guide - practical step-by-step instructions for building your own hardened systems and services. Tested on CentOS 7 and RHEL 7.

trimstray - Linux Hardening Checklist - most important hardening rules for GNU/Linux systems (summarized of The Practical Linux Hardening Guide)

How To Secure A Linux 服务端 - for a single Linux 服务端 at home

nixCraft - 40 Linux Ser Security Tips (2019 edition)

nixCraft - Tips To Protect Linux Servers Physical Console Access

TecMint - 4 Ways to Disable Root Account in Linux

ERNW - IPv6 Hardening Guide for Linux Servers

trimstray - Iptables Essentials: Common Firewall Rules and Commands

Neo23x0/auditd - Best Practice Auditd Configuration

CIRCL TR-83 - Linux Boot Hardening HOWTO - How to secure the boot sequence of your Linux based distribution (2024)

Red Hat Enterprise Linux - RHEL

Red Hat - A Guide to Securing Red Hat Enterprise Linux 7

DISA STIGs - Red Hat Enterprise Linux 7 (2019)

CIS Benchmark for Red Hat Linux

nixCraft - How to set up a firewall using FirewallD on RHEL 8

CentOS

Lisenet - CentOS 7 Ser Guide (2017)

HighOn.Coffee - Security Harden CentOS 7 (2015)

SUSE

SUSE Linux Enterprise 服务端 12 SP4 Security Guide

SUSE Linux Enterprise 服务端 12 Security and Hardening Guide

Ubuntu

Ubuntu documentation - Security

Ubuntu wiki - Security Hardening Features

Windows

Microsoft - Windows security baselines

Microsoft - Windows Ser | Assurance

Microsoft - Windows 10 Enterprise Security

BSI/ERNW - Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities (2021) - focused on Windows 10 LTSC 2019

ACSC - Hardening Microsoft Windows 10, 21H1, Workstations

ACSC - Securing PowerShell in the Enterprise

Awesome Windows Domain Hardening

Microsoft - How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows 服务端

Microsoft recommended block rules - List of applications or files that can be used by an attacker to circumvent application whitelisting policies

ERNW - IPv6 Hardening Guide for Windows Servers

NSA - AppLocker Guidance - Configuration guidance for implementing application whitelisting with AppLocker

NSA - Pass the Hash Guidance - Configuration guidance for implementing Pass-the-Hash mitigations (Archived)

NSA - BitLocker Guidance - Configuration guidance for implementing disk encryption with BitLocker

NSA - Event Forwarding Guidance - Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding

Windows Defense in Depth Strategies - work in progress

Endpoint Isolation with the Windows Firewall based on Jessica Payne’s ‘Demystifying the Windows Firewall’ talk from Ignite 2016

ZeroSec - Paving The Way to DA - red teaming techniques and how to prevent them

See also Acti and ADFS below.

macOS

ERNW - IPv6 Hardening Guide for OS-X

Network Devices

NSA - Harden 网络 Devices (PDF) - very short but good summary

Switches

DISA - Layer 2 Switch SRG v2r1

Routers

NSA - A Guide to Border Gateway 协议 (BGP) Best Practices

IPv6

NSA - IPv6 Security Guidance (Jan 2023)

ERNW - De an Enterprise IPv6 Security Strategy Part 1, Part 2, Part 3, Part 4 - 网络 Isolation on the Routing Layer, Traffic Filtering in IPv6 Networks

see also IPv6 links under GNU/Linux, Windows and macOS

Firewalls

NIST SP 800-41 Rev 1 - Guidelines on Firewalls and Firewall Policy (2009)

trimstray - Iptables Essentials: Common Firewall Rules and Commands

-

Security Hardening Guides - covers most products and

CIS ESXi 6.5 Benchmark (2018)

DISA STIGs - - 6.0 and 5

ENISA - Security aspects of - generic, high-level best practices for and containers (Feb 2017)

NIST SP 800-125 - Guide to Security for Full Technologies - (2011)

NIST SP 800-125A Re 1 - Security Recommendations for Ser Hypervisor Platforms (2018)

NIST SP 800-125B Secure 网络 Configuration for Machine ( (2016)

ANSSI - Recommandations de sécurité pour les architectures basées sur ESXi - for 5.5 (2016), in French

ANSSI - Securing a infrastructure (2026)

- Protecting From Specialized Malware (2022) - see also Mandiant - Bad VIB(E)s Part Two: Detection and Hardening within ESXi Hyper

Containers - Docker - Kubernetes

How To Harden Your Docker Containers

CIS Docker Benchmarks - registration required

NIST SP 800-190 - Application Container Security Guide

A Practical Introduction to Container Security

ANSSI - Recommandations de sécurité relatives au déploiement de conteneurs Docker (2020), in French

Kubernetes Security Checklist

Kubernetes Role Based Access Control Good Practices

Kubernetes Multi-tenancy

Kubernetes blog - A Closer Look at NSA/CISA Kubernetes Hardening Guidance

ReynardSec - Docker Security – Step-by-Step Hardening (Docker Hardening) (2023)

Services

SSH

NIST IR 7966 - Security of Interactive and Automated Access Management Using Secure Shell (SSH)

ANSSI - (Open)SSH secure use recommendations

Linux Audit - OpenSSH security and hardening

Positron Security SSH Hardening Guides (2017-2018) - focused on crypto algorithms

stribika - Secure Secure Shell (2015) - some algorithm recommendations might be slightly outdated

Applied Crypto Hardening: bettercrypto.org - handy reference on how to configure the most common services’ crypto settings (TLS/SSL, PGP, SSH and other cryptographic tools)

IETF - Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH) draft-ietf-curdle-ssh-kex-sha2-10 - update to the recommended set of key exchange methods for use in the Secure Shell (SSH) 协议 to meet e needs for stronger security. This document updates RFC 4250.

Gra - How to SSH Properly - how to configure SSH to use certificates and two-factor authentication

TLS/SSL

NIST SP800-52 Rev 2 (2nd draft) - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations - 2018, recommends TLS 1.3

Netherlands NCSC - IT Security Guidelines for Transport Layer Security (TLS) - 2021

ANSSI - Security Recommendations for TLS - 2017, does not cover TLS 1.3

Qualys SSL Labs - SSL and TLS Deployment Best Practices - 2017, does not cover TLS 1.3

RFC 7540 Appendix A TLS 1.2 Cipher Suite Black List

Applied Crypto Hardening: bettercrypto.org - handy reference on how to configure the most common services’ crypto settings (TLS/SSL, PGP, SSH and other cryptographic tools)

Web Servers

Cipherlist.eu - Strong Ciphers for Apache, nginx and Lighttpd

#### Apache HTTP Server

Apache HTTP Ser - Security Tips

GeekFlare - Apache Web Ser and Security Guide

Apache Config - Apache Security Hardening Guide

#### Apache Tomcat

Apache Tomcat 9 Security Considerations / v8 / v7

OWASP Securing tomcat

How to get Tomcat 9 to work with authbind to bind to port 80

#### Eclipse Jetty

Eclipse Jetty - Configuring Security

Jetty hardening (2015)

#### Microsoft IIS

CIS Microsoft IIS Benchmarks

Mail Servers

MDaemon - 15 Best Practices for Protecting Your Email - Generic recommandations but based on MDaemon Security Gateway for Email Servers

FTP Servers

JSCAPE - Guide for securing FTP - Generic recommandations but based on JSCAPE MFT 服务端

Database Servers

Netwrix - MS SQL Ser Best Practices

Acti

Microsoft - Best Practices for Securing Acti

ANSSI CERT-FR - Acti Security Assessment Checklist - other with changelog - 2022 (English and French )

"Admin Free" Acti and Windows, Part 1- Understanding Pri Groups in AD

"Admin Free" Acti and Windows, Part 2- Protected Accounts and Groups in Acti

ASD - Detecting and mitigating Acti compromises - 2024

ADFS

adsecurity.org - Securing Microsoft Acti Federation 服务端 (ADFS)

Microsoft - Best practices for securing Acti Federation Services

Kerberos

CIS MIT Kerberos 1.10 Benchmark - 2012

LDAP

OpenLDAP Software 2.4 Administrator's Guide - OpenLDAP Security Considerations

Best Practices in LDAP Security (2011)

LDAP: Hardening Ser (so administrators can sleep at night)

LDAP Authentication Best Practices - retrieved from web.archive.org

Hardening OpenLDAP on Linux with AppArmor and systemd - slides

zytrax LDAP for Rocket Scientists - LDAP Security

How To Encrypt OpenLDAP Connections Using STARTTLS

DNS

CIS - BIND DNS 服务端 9.9 Benchmark (2017)

DISA STIGs - BIND 9.x (2019)

NIST SP 800-81-2 - Secure Domain Name System (DNS) Deployment Guide (2013)

CMU SEI - Six Best Practices for Securing a Robust Domain Name System (DNS) Infrastructure

NSA BIND 9 DNS Security (2011)

NTP

IETF - 网络 Time 协议 Best Current Practices draft-ietf-ntp-bcp (last draft #13 in March 2019)

CMU SEI - Best Practices for NTP Services

Linux.com - Arrive On Time With NTP -- Part 2: Security Options

Linux.com - Arrive On Time With NTP -- Part 3: Secure Setup

NFS

Linux NFS-HOWTO - Security and NFS - a good o of NFS security issues and some mitigations

Red Hat - A Guide to Securing Red Hat Enterprise Linux 7 - Securing NFS

Red Hat - RHEL7 Storage Administration Guide - Securing NFS

NFSv4 without Kerberos and permissions - why NFSv4 without Kerberos does not provide security

CertDepot - RHEL7: Use Kerberos to control access to NFS 网络 shares

CUPS

CUPS Ser

Authentication - Passwords

UK NCSC - Password administration for system owners

NIST SP 800-63 Digital Identity Guidelines

OWASP Password Storage Cheat Sheet

ANSSI - Recommendations on multi-factor authentication and passwords (2021, French)

Hardware - CPU - BIOS - UEFI

ANSSI - Hardware security requirements for x86 platforms - recommendations for security features and configuration options applying to hardware devices (CPU, BIOS, UEFI, etc) (Nov 2019)

NSA - Hardware and Firmware Security Guidance - Guidance for the Spectre, Meltdown, Speculati Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow as well as general hardware and firmware security guidance.

NSA Info Sheet: UEFI Lockdown Quick Guidance (March 2018)

NSA Tech Report: UEFI Defensi Guidance (July 2017)

Cloud

NSA Info Sheet: Cloud Security Basics (August 2018)

DISA DoD Cloud Computing Security

asecure.cloud - Build a Secure Cloud - A free repository of customizable AWS security configurations and best practices

Tools

Tools to check security hardening

Chef InSpec - open-源码 testing 框架 by Chef that enables you to specify compliance, security, and other policy requirements. can run on Windows and many Linux distributions.

GNU/Linux

Lynis - script to check the configuration of Linux hosts

OpenSCAP Base - oscap command line tool

SCAP Workbench - GUI for oscap

Tiger - The Unix security audit and intrusion detection 工具 (might be outdated)

otseca - Open 源码 security auditing 工具 to search and dump system configuration. It allows you to generate reports in HTML or RAW-HTML formats.

SUDO_KILLER - A 工具 to identify sudo rules' misconfigurations and within sudo

CIS Benchmarks Audit - bash script which performs tests against your CentOS system to give an indication of whether the running 服务端 may comply with the CIS v2.2.0 Benchmarks for CentOS (only CentOS 7 for now)

CIS Debian Hardening - Modular Debian 11/12/13 security hardening scripts based on CIS Benchmarks recommendations.

Audit Script - A comprehensive Bash script for auditing the security and performance of your VPS ( Private 服务端)

Windows

Microsoft Security Compliance Toolkit 1.0 - set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products

Microsoft DSC En Analyzer (DSCEA) - simple implementation of PowerShell Desired State Configuration that uses the declarati of DSC to scan Windows OS based systems in an en against a defined reference MOF file and generate compliance reports as to whether systems match the desired configuration

HardeningAuditor - Scripts for comparing Microsoft Windows compliance with the Australian ASD 1709 & Office 2016 Hardening Guides

PingCastle - 工具 to check the security of Acti

MDE-AuditCheck - 工具 to check that Windows audit settings are properly configured in the GPO for Microsoft Defender for Endpoint

Network Devices

Nipper-ng - to check the configuration of 网络 devices (does not seem to be updated)

cawk - multi-supplier 网络 configuration checker

TLS/SSL

Qualys SSL Labs - List of tools to assess TLS/SSL servers and clients

CryptoLyzer - Fast, flexible and comprehensi cryptographic 协议 (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI.

SSLyze - Fast and powerful SSL/TLS scanning library.

testssl.sh - Testing TLS/SSL encryption anywhere on any port

SSH

CryptoLyzer - Fast, flexible and comprehensi cryptographic 协议 (TLS, SSL, SSH, DNSSEC) and related setting (HTTP headers, DNS records) analyzer and fingerprint (JA3, HASSH tag) generator with Python API and CLI.

ssh-audit - SSH ser (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

Hardware - CPU - BIOS - UEFI

CHIPSEC: Platform Security Assessment 框架 - 框架 for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components

chipsec-check - Tools to generate a Debian Linux distribution with chipsec to test hardware requirements

Docker

Docker Bench for Security - script that checks for dozens of common best-practices around deploying Docker containers in production, inspired by the CIS Docker Community Edition Benchmark v1.1.0.

Cloud

toniblyx/my-arsenal-of-aws-security-tools - List of open 源码 tools for AWS security: defensi, auditing, DFIR, etc.

DNS

IntoDNS.ai - Free DNS and email security scanner. Checks SPF, DKIM, DMARC, DNSSEC, BIMI, MTA-STS configuration and provides AI-powered fix suggestions.

Tools to apply security hardening

DevSec Hardening 框架 - a 框架 to automate hardening of OS and applications, using Chef, Ansible and Puppet

GNU/Linux

Linux Ser - for Debian/Ubuntu (2019)

Bastille Linux - outdated

Windows

Microsoft Security Compliance Toolkit 1.0 - set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products

Hardentools - for Windows indi users (not corporate en) at risk, who might want an extra level of security at the price of some usability.

Windows 10 Hardening - A collecti of settings modifications (mostly opt-outs) that attempt to make Windows 10 as private and as secure as possible.

Disassembler0 Windows 10 Initial Setup Script - PowerShell script for automation of routine tasks done after fresh installations of Windows 10 / 服务端 2016 / 服务端 2019

Automated-AD-Setup - A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening

mackwage/windows_hardening.cmd - Script to perform some hardening of Windows 10

Windows 10/11 Hardening Script by ZephrFish - PowerShell script to harden Windows 10/11

TLS/SSL

Mozilla SSL Configuration Generator

Cloud

toniblyx/my-arsenal-of-aws-security-tools - List of open 源码 tools for AWS security: defensi, auditing, DFIR, etc.

Password Generators

How-To Geek - 10 Ways to Generate a Random Password from the Linux Command Line

Vitux - 8 Ways to Generate a Random Password on Linux Shell

SS64 - Password security and a comparison of Password Generators

Books

Other Awesome Lists

Awesome Cybersecurity Blue Team - A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

Other Awesome Security Lists

(borrowed from Awesome Security)

Awesome Security - A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

Android Security Awesome - A collection of android security related resources.

Awesome CTF - A curated list of CTF frameworks, libraries, resources and software.

Awesome Cyber Skills - A curated list of hacking en where you can train your cyber skills legally and safely.

Awesome Hacking - A curated list of awesome Hacking tutorials, tools and resources.

Awesome Honeypots - An awesome list of honeypot resources.

Awesome Malware Analysis - A curated list of awesome malware analysis tools and resources.

Awesome PCAP Tools - A collection of tools de by other researchers in the Computer Science area to process 网络 traces.

Awesome Pentest - A collection of awesome penetration testing resources, tools and other shiny things.

Awesome Linux Containers - A curated list of awesome Linux Containers frameworks, libraries and software.

Awesome Incident Response - A curated list of resources for incident response.

Awesome Web Hacking - This list is for anyone wishing to learn about web application security but do not have a starting point.

Awesome Threat Intelligence - A curated list of threat intelligence resources.

Awesome Pentest Cheat Sheets - Collection of the cheat sheets useful for pentesting

Awesome Industrial Control System Security - A curated list of resources related to Industrial Control System (ICS) security.

Awesome YARA - A curated list of awesome YARA rules, tools, and people.

Awesome Threat Detection and Hunting - A curated list of awesome threat detection and hunting resources.

Awesome Container Security - A curated list of awesome resources related to container building and runtime security

Awesome Crypto Papers - A curated list of cryptography papers, articles, tutorials and howtos.

项目信息

开发语言：未知

Star 数：6572

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of awesome security hardening guides, tools and other resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。