-
Notifications
You must be signed in to change notification settings - Fork 0
Hardening
Tristan Israël edited this page Feb 10, 2026
·
2 revisions
This document is related to the hardening.
The reference is the hardening guide for GNU/Linux.
- Enable secured UEFI boot (R3)
- Enable Measured boot (R3)
- Configure a password for the bootloader (R5)
- Protect kernel and initramfs command line parameters (R6)
- Enable L1TF protection (R8)
- Enable page poisonning (R8)
- Enable Page Table Isolation (R8)
- Disable Slabs caches merge (R8)
- Enable Slabs cache verifications (R8)
- Enable protection against Spectre v4 vulnerability (Speculative Store Bypass) (R8)
- Enable protection against Spectre v2 vulnerability (Branch Target Injection) (R8)
- Enable Microarchitectural Data Sampling (R8)
- Force Kernel Panic on errors from Machine Check (R8)
- Enable Page allocator randomization (R8)
- Prevent from automatic modules loading (R9)
- Set the modules list and block modules loading (R10)
- Activate and configure LSM Yama (R11)
- Disable IPv6 (R13)
- Configure file systems (R14)
- Add memory management parameters to the kernel compilation (R15)
- Verify compilation options for the kernel data structures (R16)
- Set compilation options for the memory allocator (R17)
- Set compilation options for the krnel modules management (R18)
- Set compilation options for abnormal events (R19)
- Set compilation options for the kernel security primitives (R20)
- Set compilation options for the compiler plugins (R21)
- Set compilation options for the network stack (R22)
- Set compilation options for various kernel behaviors (R23)
- Set compilation options specific to x86_64 architecture (R25)
- Set compilation options for the compiler plugins (R21)
- Apply recommended partitionning rules (R28)
- Restrict access to /boot (R29)
- Use non privileged accounts for services (R34)
- Modify default UMASK value (R36)
- Remove admin account when not in debugging mode (R38)
- Remove sudo when not in debugging mode (R38)
- Modify default sudo configuration (R39)
- Activate AppArmor security profiles (R45)
- Restrict access to sensitive directories (R50)
- Restrict access to sockets and named pipes (R52)
- Set the sticky bit to writable directories (R54)
- Separate temporary files in different places for each process (R55)
- Setup a logging system (syslog) (R71)
- Seal and verify files integrity (R78)
- Protect seals database (R79)