LH-1.5: copy-and-paste Linux assessments across four distributions

A copy-and-paste workflow for collecting Linux security evidence over SSH, downloading it with SCP, preparing six reviewed input files for Claude or Codex, and validating the returned report structure.

The observational collector was tested on Ubuntu 24.04, Debian 13, Fedora 44 and Amazon Linux 2023 x86_64 EC2 images. It selects APT or DNF/DNF5 checks, preserves evidence gaps, distinguishes DNF exit 100 from errors, and queries private copies of RPM metadata to avoid rewriting the host's package cache. It does not install packages, refresh repositories, apply fixes, restart services or reboot.

The fixed LH-1.2 catalogue still contains 28 controls. Cross-distribution validation covers collection and transfer; it does not certify security controls or extend the modifying hardening runbook beyond its original Ubuntu scope. The retained PDF inside the toolkit is clearly labeled as historical LH-1.4 material; use quickstart.md and the Markdown guide for this workflow.

Validation: fixture suites, report/catalogue integrity and checksums passed. Final collection, private permissions and SCP integrity passed on all four disposable EC2 hosts. All test instances and temporary access resources were removed. See ec2-validation.md for the evidence scope and limitations.

LH-1.4: Zero Wire context and offline assessment workflow

LH-1.4 adds optional current vulnerability context while preserving the operator-collected, evidence-only assessment workflow.

• An operator runs vulnerability-context.py on a macOS/Linux analysis workstation to fetch Zero Wire RSS and CISA KEV. It never reads or uploads a server report.
• Saved snapshots include original responses, timestamps, hashes and source gaps. Offline normalization verifies and replays them without network access.
• The assessment prompt uses supplied context, requires official vendor applicability and active-fix evidence, and adds a dated, unscored CVE appendix. Public advisory research requires explicit allowance; offline analysis is the default.
• The guide and 20-page PDF link Cloudflare's 3 November 2026 Zero Wire announcement. Assessment, approved hardening changes and disposable-lab reproduction remain separate guides.

Start with README.md and vulnerability-context.md in the complete ZIP. The 28-control LH-1.2 catalogue and server collection scripts are unchanged. The helper is a curated intelligence aid, not a complete CVE scanner or proof that a server is safe.

Validated with 19 new offline fixtures, the existing local suites, a live public-feed fetch and byte-identical offline replay. The ZIP, checksums and PDF were checked. Dated validation metadata is included; no new VM test run or website deployment is claimed. Interactive website browser validation remains outstanding.

Assets: complete toolkit ZIP, assessment PDF, full prompt and SHA256SUMS. Retain the release version and checksum receipt with your assessment. Hashes provide integrity checks, not independent author attestation.

Linux Hardening Toolkit LH-1.3 — separate assessment, hardening and lab guides

Choose the guide for your task:

• Assess an existing server: use the assessment guide/PDF. Collect with the reviewed scripts on the Linux target, redact and transfer the report, then run the prompt on a separate workstation.
• Apply selected approved fixes: use hardening-runbook.md in the ZIP/repository. Inspection and change commands are separated.
• Reproduce our tests: use lab-guide.md only for a disposable VM. Its apt-get install steps and modifying fixtures are optional maintainer work, never assessment prerequisites.

The primary PDF is now 19 pages and contains no installation/remediation command examples. The README and prompt explicitly keep missing tools/evidence visible instead of instructing setup or repairs. The full ZIP includes all three guides, the prompt, collection/validation tools, templates and dated VM evidence.

Control catalogue LH-1.2, all 28 IDs, operational scripts and worked results (3 scoped PASS, 25 MANUAL) are unchanged. Existing local fixture/artifact/checksum checks and rendered PDF review passed; root-only capture assertions remain a workstation skip with prior VM receipts retained. This documentation revision does not claim another VM run or a CloudHero website deployment.

Use SHA256SUMS to compare the three release assets. Checksums provide integrity checks, not independent publisher attestation.

Linux Hardening Toolkit LH-1.2.1 — evidence-only assessment workflow

This revision makes the execution workflow explicit throughout the guide, PDF, README and assessment prompt:

1. An authorized operator runs bash collect-report.sh ./assess.sh on the approved Linux server.
2. The operator retains the original, redacts a copy and transfers it through an approved channel.
3. On a different machine, supply the full prompt, redacted report, completed policy and target context to the approved AI tool.
4. Review the 28-control report before approving any remediation.

The prompt must not download or execute collectors, connect to the server, request SSH/sudo access or inspect the analysis workstation. Missing evidence is requested from the operator; it does not trigger live collection. The guide and README include an explicit instruction to paste alongside the full prompt.

Download the complete ZIP or the PDF/prompt assets. Release SHA256SUMS checks these downloads; the ZIP includes its own file manifest. The revised PDF has 28 visually reviewed pages. Local artifact, fixture and checksum checks passed. A prompt is not an execution permission boundary: the analysis environment should have no server credentials or production execution access.

Collector, inventory, report-validation and VM fixture code are unchanged. The fixed control catalogue remains LH-1.2. This documentation/prompt release does not claim a new VM test or production assessment. The earlier LH-1.2 release remains available. The website post has a separate local preview/release process.

Linux Hardening Toolkit LH-1.2

Linux hardening toolkit LH-1.2 covers SSH, patch management, kernel lifecycle, firewall exposure, audit logging, configuration drift and production verification.

Included: a 27-page guide, a reusable 28-control assessment prompt, policy and change templates, private evidence capture, drift/report validators and dated Ubuntu 24.04 LTS ARM64 VM evidence.

Download linux-hardening-toolkit.zip for the complete package, or the PDF and prompt separately. Release SHA256SUMS verifies these assets; the ZIP includes its own file manifest. Run python3 scripts/validate-toolkit.py after extraction.

The assessed mechanisms include fresh SSH, role-specific sudo, kernel fallback, IPv4/IPv6 filtering, authenticated audit/syslog forwarding, all 300 queued-message receipts, drift detection and a synthetic rollback gate. These are bounded lab results. Organization-specific policy, production paths, human response and real workload acceptance still require evidence. Modifying lab fixtures are for disposable VMs only.

This release publishes the toolkit; it does not deploy the accompanying website article. See PUBLICATION.md for the original PDF and evidence provenance.