Automated Security Hardening for Ubuntu Server

Today, I am looking at a set of security scripts, which harden Ubuntu Server (20.04 or 22.04). Hardening is the process to change the system configuration in order to meet the basic set of compliance standards. In this example we will receive our compliance information from lynis, CIS and the DISA STIG. There are several things to discuss before jumping into the video.
WARNING: Never try a new automation script on production servers without first testing it in a controlled lab on test equipment! - you have been warned
First, how do we know what we need to change on our systems in order to bring it into compliance with various agency and regulatory standards. The first is the tool set provided by:
github.com/konstruktoid/harde...
Second, Once we have applied the changes to our system, how do we know we have met the standards we are trying to comply with?
www.open-scap.org/
Security Content Automation Protocol (SCAP) is a method for using specific standards to help organizations automate vulnerability management and policy compliance evaluation. SCAP comprises numerous open security standards, as well as applications which use these standards to check systems for vulnerabilities and misconfigurations.
One of the compliance files is called a STIG or A Security Technical Implementation Guide is a configuration standard consisting of cybersecurity requirements for a specific product. These are usually crafted for a specific operating system and version such as Ubuntu 20.04, RedHat 8, etc.
One other method of security validation I did not show is CIS Ubuntu Security Benchmark and you can find more information here: www.cisecurity.org/benchmark/...
00:00 - Intro
00:28 - Preparations
01:31 - Setup the Server
06:40 - Change ubuntu.cfg
08:56 - running the ubuntu.sh script
09:38 - validating the changes
11:17 - Running a few tests (768)
14:46 - OpenSCAP Run
16:19 - SCAP Analysis
21:17 - Final Thoughts
22:12 - Outro
Support me on Patreon: / djware
Follow me:
Twitter @djware55
Facebook: / don.ware.7758
Discord: / discord
Gitlab: gitlab.com/djware27
"Tech Live" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
creativecommons.org/licenses/b...
"Militaire Electronic" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
creativecommons.org/licenses/b...
Werq by Kevin MacLeod
Link: incompetech.filmmusic.io/song...
License: filmmusic.io/standard-license
Industrial Cinematic by Kevin MacLeod
Link: incompetech.filmmusic.io/song...
License: filmmusic.io/standard-license
Music Used in this video
"NonStop" Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0 License
#Infosec #SCAP #STIG

[@esra_erimez]

By the way, the importance of this video simply cannot be overstated

[@tucuxir]

Very useful. Thanks for sharing.

[@guilherme5094]

Very good DJ 👍!

[@C6438911]

A score of 92 with Lynis is pretty good (to my limited knowledge that is).
I'm not a system administrator or security expert by any stretch of the imagination. But still quite interesting to see these kind of video's about security.
Thank you for researching / testing and explaining these kind of security scripts / tools.

[@CyberGizmo]

Welcome Auxilium and yep 92 isn't too bad, certainly better than the 63 I started out with :D

[@kelvinsankale]

Thank you.

[@ericneo2]

Thank you

[@CyberGizmo]

Of course this automation isnt meant for development machines, possibly not test machines (integration test). Possibly could be used on a system test machine and of course a production server.

[@esra_erimez]

Would you consider doing videos about penetration testing? For example, using Kali?

[@CyberGizmo]

I will find a link for two good channels on it, I don;t consider myself a pentester, mostly do it just to check my systems

[@marcello4258]

why is this not on odysee? :/

[@CyberGizmo]

dunno, it should be uploaded there automagically