Warning The vulnerabilities PHP2Shell and HTTP2Shell are being heavily exploited right now. Many websites and servers are affected. Please check here first whether you are affected. Am I affected?
Servers & clusters · Hardening
Harden Linux servers. To a standard, with a report.
A new server can do far more than it needs. Every unneeded feature is an open door. We close them and prove it in writing.
What you get
-
A report for auditors
For each server you see how many rules pass. Clients, insurers and NIS2 audits get a clear answer.
-
A break-in stays contained
Every service may only do what it needs. If one is hacked, the attacker gets no further.
-
No server drifts
Settings are checked regularly. If someone changes something by hand, it shows.
-
Rebuilt in 15 minutes
Everything is automated. A fully hardened server is ready in 15 minutes, with firewall, SELinux and CIS check.
What we set up
-
Services locked in
SELinux stays on. Each service may only use its own files and ports. Even after it has been hacked.
→ -
Firewall on every server
Only the needed services are reachable. Outgoing connections are limited too, so nobody pulls data out or loads tools in.
-
Every admin session recorded
What an administrator types and sees is recorded. In an incident every session can be replayed.
-
Sign-in
Keys only, no direct admin login. After several failed attempts the account is locked.
-
Allowed programs
Only checked programs from trusted packages start. Injected malware does not run.
-
Changes noticed
If a system file changes unexpectedly, an alert is raised. Key events go to a central log an attacker cannot delete.
→ -
Kernel secured
Unused drivers and features are blocked, protections against known attack techniques are on.
-
Old encryption off
Outdated, insecure methods are switched off server-wide.
-
Measured to the CIS Benchmark
Hundreds of settings are checked automatically. You see in percent what passes and what remains open.
→
What the report looks like
Price
Once as a project. Or ongoing for a fixed price.
As a project for your existing servers. Or as part of ongoing operations, with regular re-checks.
For IT leads
Technical detailsRHEL · Rocky Linux · AlmaLinux · OpenSCAP · SELinux · auditd · AIDE · fapolicyd
- Profiles
- CIS Benchmark Level 1 and 2 for servers via SCAP Security Guide, exceptions justified per rule.
- Evidence
- OpenSCAP scan before and after hardening, HTML report and ARF result per server, repeated regularly.
- Access control
- SELinux enforcing with the targeted policy, fapolicyd with trust from the RPM database.
- Audit and integrity
- auditd rules per CIS, forwarding to the SIEM, AIDE database with scheduled checks.
- System
- Separate partitions with nodev, nosuid, noexec, sysctl hardening, blocked kernel modules, system-wide crypto policy without SHA-1.
- Access
- SSH with keys or certificates only, no root login, pam_faillock, sudo with I/O logging.
- Host firewall
- firewalld/nftables with default deny inbound, egress filtering per service.
- Session recording
- tlog via SSSD for all admin sessions, recordings centralised in the journal and SIEM, replayable.
- Kernel
- Modules blacklisted (usb-storage, unused file systems), kptr_restrict, dmesg_restrict, unprivileged BPF off, Yama ptrace_scope.
- Log integrity
- auditd with immutable rules (-e 2), forwarding via TLS to central logging, local deletion ineffective.
- Automation
- Hardening as code, idempotent, with a dry run before every change. Internal; the documentation is yours.
Further reading
-
Server absichern: Warum ein Standard-Server nicht mehr reicht
A freshly installed server is set up for convenience.
→ -
KI findet Sicherheitslücken am Fließband: Was das für Ihre Server heißt
New AI models find vulnerabilities faster than ever.
→ -
Neue Sicherheitslücke gemeldet: Was Firmen jetzt tun sollten
Almost every week there is a new critical vulnerability.
→
FAQ
Frequently asked questions
Will our software still work afterwards?
Yes. We measure first, then test, and only set targeted exceptions. Every exception is in the report.
RHEL or Rocky Linux?
Both work. RHEL has vendor support; Rocky Linux and AlmaLinux are free and built the same way.
Our software says SELinux must be off.
We hear that a lot. Usually just one setting is missing. We find it and SELinux stays on.
Who is this for?
For companies with about 30+ staff and anyone whose servers must not stop. With or without an in-house IT team.
Contact
Free first call
Briefly describe your situation. We help you assess it and plan the next step. Reply within 24 hours on working days.
Linux hardening for RHEL, Rocky Linux and AlmaLinux in Austria
vetosec hardens Linux servers to CIS Level 1 and 2 with OpenSCAP reports, SELinux enforcing, auditd, AIDE and fapolicyd.
office [at] vetosec [dot] at · vetosec.at/contact/