❯ git clone https://github.com/gensecaihq/Ubuntu-Security-Hardening-Script.git ▌

Ubuntu Security Hardening Script: Automated, auditable security hardening for Ubuntu 26.04, 24.04 and earlier LTS

View on GitHub114 stars16 forksShell · MIT licence · by Aloke Majumder

The Ubuntu Security Hardening Script automates a secure-by-default baseline for Ubuntu servers and workstations. It is plain Bash you can read: 17 hardening modules covering access, network, kernel, integrity, malware and compliance.

It is safe by design. It checks for SSH keys before disabling password authentication, backs up every file it touches, detects desktops so GUI apps keep working, logs everything, and can be re-run without wiping custom firewall rules.

What Ubuntu Security Hardening Script Does

17 hardening modules

SSH, kernel sysctls, auditd, AppArmor, UFW, Fail2ban, AIDE, ClamAV, rootkit detection, automatic updates, systemd sandboxing, cloud metadata protection and compliance scanning.

Ubuntu 26.04 LTS ready

Post-quantum SSH key exchange, sudo-rs and Rust coreutils awareness, AppArmor 5.0 and auditd 4.1.

Lockout prevention

SSH key checks before disabling passwords, rate-limited SSH and safe re-runs that preserve your custom rules.

Compliance scanning

OpenSCAP CIS and DISA-STIG scanning, a Lynis audit and a JSON compliance report for your SIEM.

Integrity and malware

AIDE file monitoring, auditd rules for living-off-the-land and container-escape techniques, ClamAV, rkhunter and chkrootkit.

Pick your release

Dedicated scripts for Ubuntu 26.04, 24.04 and 22.04/20.04/18.04 LTS.

Who It's For

Sysadmins building a hardened Ubuntu baseline
Teams preparing for CIS or DISA-STIG audits
Cloud teams hardening Ubuntu VMs on AWS, Azure or GCP
Anyone who wants hardening they can read and audit

Ubuntu Security Hardening Script: FAQs

❯

Which Ubuntu versions does the hardening script support?

Ubuntu 26.04 LTS (recommended), 24.04 LTS, and 22.04, 20.04 and 18.04 LTS through a separate script. 20.04 and 18.04 need Ubuntu Pro ESM for security updates.

❯

Will it lock me out of SSH?

It is designed not to: it checks for SSH keys before disabling password authentication, rate-limits rather than blocks SSH, and backs up every file it changes.

❯

Does it help with CIS or DISA-STIG compliance?

Yes. It runs OpenSCAP CIS and DISA-STIG scanning and a Lynis audit, and produces a human report plus a JSON compliance report you can send to a SIEM.

❯

Can I run it more than once?

Yes. The current script is idempotent: re-running it on a hardened machine preserves custom firewall rules and doesn't duplicate configuration.

❯

Is it free?

Yes, it is open source under the MIT licence.

Need help putting it into production?

I built and maintain Ubuntu Security Hardening Script. If you want help deploying it, building an AI-assisted SOC around it, or training your team, see AI & security consulting and hands-on training, or get in touch.