linux-hardener

Linux Hardener is a comprehensive security automation tool for Linux systems, written in Rust. It scans hosts for security misconfigurations, applies hardening fixes, and supports full rollback through signed checkpoints. Every change is snapshotted before it is made, so `hardener rollback` restores the host to its prior state. The tool ships as a single CLI binary and a desktop application built with Tauri and a Leptos/WASM frontend. Eight hardening plugins cover kernel parameters, SSH configuration, firewall rules, PAM authentication, service minimisation, audit rules, file permissions, and MAC systems (SELinux/AppArmor). Findings are mapped onto ten compliance frameworks: CIS, STIG, NIST 800-53, PCI-DSS, HIPAA, GDPR, ISO/IEC 27001:2022, SOC 2, NIST SP 800-171 Rev 3, and FedRAMP. Controls the engine cannot assess are reported as needing manual review rather than assumed to pass. Distribution support is family-based, covering Debian, Ubuntu, Fedora, RHEL, Arch Linux, and openSUSE. The tool reads both `/etc` and `/usr/etc` layers on openSUSE, and handles SSH drop-in configuration to preserve vendor `Include` lines. A Docker image with a `FROM scratch` base enables read-only auditing without host modification. Key features include: checkpoint-based rollback with Ed25519-signed SQLite storage, a hash-chained audit log, policy exceptions with expiry dates, scope exclusions for non-applicable controls, scheduled scanning via daemon or systemd timer, and fleet operations over SSH with concurrent batch scanning and apply. The desktop application provides a dashboard with security scores, per-framework compliance views, severity-grouped findings, and a fleet apply interface with staged preview. Configuration is loaded from four sources in order: `/etc/linux-hardener/config.toml`, user config (skipped under root), `--config` flag, and `HARDENER_*` environment variables. The tool distinguishes between `scan` (read-only, no root needed), `apply --dry-run` (preview changes), and `apply` (execute changes). Batch operations default to dry-run and require `--execute` to make changes. The project includes 2343 passing tests, a cross-distribution suite that applies and rolls back on six booted containers, and a differential suite comparing hosts before and after apply through an independent oracle. The codebase is organised into domain crates for plugins, compliance, scheduler, core, state, and distribution detection, with shared foundation crates for common utilities and WASM-safe types.