OSS
First public release. Treat it as a beta pre-release — see Known issues before you put it on a machine you care about.
OSS puts Linux hardening settings in a window. You tick what you want, it shows you the exact diff of every file it will change, and applies the lot behind one password prompt. Afterwards it re-reads every value off the live system and tells you which ones actually took.
614 settings across 25 areas: sysctl, GRUB, module blacklists, PAM, sudo, SSH, auditd, AppArmor, journald, DNS, NetworkManager, ufw, fstab, file permissions, USB device policy, snap permissions, users and groups, installed packages, and the GNOME privacy settings.
Install
| Distro | File | Command |
|---|---|---|
| Debian, Ubuntu, Mint, Pop!_OS | oss_0.1.0_all.deb |
sudo apt install ./oss_0.1.0_all.deb |
| Fedora, RHEL, Rocky, Alma | oss-0.1.0-1.noarch.rpm |
sudo dnf install oss-0.1.0-1.noarch.rpm |
| openSUSE | oss-0.1.0-1.noarch.rpm |
sudo zypper install oss-0.1.0-1.noarch.rpm |
| Arch, Manjaro, EndeavourOS | oss-0.1.0-1-any.pkg.tar.gz |
sudo pacman -U oss-0.1.0-1-any.pkg.tar.gz |
oss-fonts is optional. It holds the twelve bundled typefaces, split out because they are under a different licence and Fedora does not accept packages that bundle fonts. Without it the app uses your system font.
Needs python3 3.11+, python3-gi, GTK 4, libadwaita, polkit and fontconfig. All present on a stock desktop. Nothing here downloads anything, at install or at runtime.
What it does that a hardening script doesn't
Every change is shown as a literal file diff before you agree to it. Files are backed up, and a failure at any point restores all of them and puts the systemd units back. Candidate configs are checked with the tool's own validator first — sshd -t, visudo -c, auditctl -R, and a live mount -o remount before fstab is touched, so a bad mount option fails while the filesystem is still mounted instead of at boot.
The privileged helper does not trust the GUI. It takes flag ids and values, nothing else, and re-renders every file from its own copy of the catalogue.
Known issues
The recommended preset is generated — it is every setting rated safe, which is 427 of them. That is a lot to turn on at once. Read the review diff before applying it.
sysctl --system reads /etc/sysctl.conf after /etc/sysctl.d, so a key set in both is written and then immediately overridden. Boot behaves differently. The app detects this and names the keys, but will not edit sysctl.conf for you.
Immutable distros (Silverblue, Kinoite, MicroOS, SteamOS) are not supported — the helper cannot be installed into a read-only /usr.
Apache-2.0. Bundled typefaces are OFL-1.1.