Kernel & Linux

Most breaches start with a service nobody knew was running

A fleet you can describe, and defend.

The problem

Your servers run whatever the base image shipped with. Nobody knows which processes are talking to the internet, the audit trail is whatever journald happened to keep, and the compliance questionnaire is due next month. The commercial agent you were quoted costs per host and runs code you cannot inspect.

The approach

I reduce what is running, restrict what is reachable, and make the result reproducible so it holds across a hundred hosts rather than the three someone remembered to fix. Firewall and access policy as reviewable code, service isolation via systemd rather than convention, and packages built by you instead of trusted from a stranger.

What you get

Baseline hardening applied via Ansible, reviewable line by line
nftables policy generated from a declared inventory, not hand-edited
systemd unit sandboxing — capabilities, namespaces and filesystem scope
Zero Trust access to admin surfaces, so nothing sensitive faces the internet
Reproducible Debian/Ubuntu package builds pinned to versions you chose
A written threat model naming what this does and does not defend against

Example

hardening/tasks/main.yml

- name: Lock down SSH
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config.d/00-hardening.conf
    create: true
    mode: '0600'
    validate: '/usr/sbin/sshd -t -f %s'
    regexp: "^{{ item.key }}"
    line: "{{ item.key }} {{ item.value }}"
  loop:
    - { key: PermitRootLogin,        value: 'no' }
    - { key: PasswordAuthentication, value: 'no' }
    - { key: KbdInteractiveAuthentication, value: 'no' }
    - { key: AllowTcpForwarding,     value: 'no' }
  notify: restart sshd

- name: Default-deny firewall
  ansible.builtin.template:
    src: nftables.conf.j2
    dest: /etc/nftables.conf
    validate: 'nft -c -f %s'   # never ship a ruleset that will not parse
    mode: '0600'
  notify: reload nftables

- name: Persist the audit trail off-box
  ansible.builtin.include_role:
    name: journald_remote

Tell me what is broken

A short description is enough. Within one business day I will tell you what I think the problem is, roughly how long it takes, and whether you need me at all. Sometimes the honest answer is no.

[email protected]

I reply within 1 business day · No contact forms, no tracking pixels, no CRM sequence.

On GitHub