Linux Hardening Agent Skill
Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance requirements.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill linux-hardeningWhat comes with it
18 776 bytes besides the instructionThe instruction itself
10 sections, as written by the authorLinux Hardening
Secure Linux servers following CIS benchmarks and security best practices.
When to Use This Skill
Use this skill when:
- Hardening production servers
- Meeting compliance requirements
- Implementing security baselines
- Configuring secure SSH access
SSH Hardening
# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Protocol 2
User Security
# Password policy
sudo apt install libpam-pwquality
# /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
# Lock inactive accounts
useradd -D -f 30
# Audit sudo usage
echo "Defaults logfile=/var/log/sudo.log" >> /etc/sudoers
Firewall Configuration
# UFW setup
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 443/tcp
ufw enable
# Or iptables
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Kernel Hardening
# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
# Apply
sysctl -p
File Permissions
# Critical files
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 700 /root
chmod 600 /etc/ssh/sshd_config
# Find world-writable files
find / -type f -perm -0002 -ls
# Find SUID files
find / -perm -4000 -type f -ls
Audit Configuration
# Install auditd
apt install auditd
# /etc/audit/rules.d/audit.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-a always,exit -F arch=b64 -S execve -k exec
Best Practices
- Disable unused services
- Keep system updated
- Use fail2ban for intrusion prevention
- Enable SELinux/AppArmor
- Regular security audits
- Monitor log files
- Implement least privilege
Related Skills
- cis-benchmarks - Compliance scanning
- firewall-config - Firewall rules
Other skills for the same job
different authors, same section of the catalogue
Automate Benchmark Email tasks via Rube MCP (Composio). Always search tools first for current schemas.
Use when the user asks to "triage our comments, DMs, and mentions", "draft replies to this thread", "can we repost this fan post", or "set up inbox SLAs and an escalation path"; produces a ranked triage queue with register detection (sincere / ironic / performative / parasocial, sentiment-inversion table included — "this is so bad" under a comedy register is praise), a commenter taxonomy (troll monitor-only / rager / misguided / unhappy-customer / advocate) with a response-tier ladder and per-channel SLAs, an escalation matrix ending at the crisis path, a moderation ladder plus house rules for owned spaces, and a UGC curation-and-rights mode whose dated permission entries route to the channel registry — every reply is a ranked DRAFT a human posts; nothing is ever auto-sent. Not for launch-window feedback triage — use launch-feedback-synthesizer. 评论私信提及分诊/语域识别/回复草稿/UGC授权
| Benchmark Email integration. Manage data, records, and automate workflows. Use when the user wants to interact with Benchmark Email data.
>- Decision protocol for making side-effectful agent tools idempotent — so when an LLM tool call is retried (timeout, framework resume, user re-run, model duplicate emit), the second it'll call exactly once; the tool must promise the second call is safe. Framework-agnostic — applies to LangGraph node bodies that re-run on resume, MCP tools, OpenAI tool-calling duplicate email sent, charged twice, exactly-once, idempotency key, tool called twice, retry side effect, double-send, at-least-once delivery.
Autonomously research, implement, train and ship ML code using the Hugging Face ecosystem. Port of huggingface/ml-intern as a Claude Code skill. Triggers when the user asks to implement, train, fine-tune, or reproduce an ML model / paper / dataset workflow (e.g. "implement DeepSeek-V3 at 100M", "fine-tune Qwen on dataset X", "reproduce paper Y"). Clarifies ambiguous tasks before starting, runs under an explicit experiment budget, explores multiple viable solution paths in parallel via implementation subagents, and diagnoses + retries failed runs. HF-native: pulls datasets/models/papers from the Hub, pushes trained checkpoints + run logs back to the Hub. Emits Telegram + Slack milestone alerts via scripts/notify.sh.
Automate Benchmark Email tasks via Rube MCP (Composio). Always search tools first for current schemas.
Embed a Copilot-inspired AI chat interface in WPF apps with DevExpress AIChatControl — install DevExpress.AIIntegration.Wpf.Chat, change the project SDK to Microsoft.NET.Sdk.Razor, register an IChatClient (Azure OpenAI / OpenAI / Ollama / Semantic Kernel) with AIExtensionsContainerDesktop.Default, drop the control inside a ThemedWindow, and enable features like response streaming, Markdown rendering, file attachments, prompt suggestions, and chat history persistence. Use when building chat assistants, document Q&A, RAG dashboards, or any in-app conversational UI in WPF. Also use when someone mentions "AIChatControl", "DevExpress.AIIntegration.Wpf.Chat", "AIExtensionsContainerDesktop", "RegisterChatClient", "IChatClient", "dxaichat:", "UseStreaming", "MarkdownConvert", "FileUploadEnabled", "PromptSuggestions", "MessageSending", "MessageSent", "SaveMessages / LoadMessages", "ChatClientServiceKey", or building a "RAG" / "chat with your data" feature. Requires .NET 8+ and the WebView2 runtime.
> Help developers use the DevExtreme Chat component (dxChat) in Angular, React, Vue, and jQuery. Use when someone asks about Chat configuration, rendering messages, managing users, typing indicators, alerts, message editing, Markdown support, suggestion buttons, AI service integration (OpenAI, Azure, Dialogflow), popup embedding, streaming responses, or any scenario involving dxChat or DxChat. "chat user", "chat bot", "typing indicator", "chat suggestions", "AI chat", "chat markdown", "chat editing", "chat popup", "onMessageEntered", "renderMessage", "typingUsers".
How to use it
Take bagelhole/linux-hardening from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.