# Harden Linux servers. To a standard, with a report. Source: https://vetosec.at/en/servers/linux-haertung/ A new server can do far more than it needs. Every unneeded feature is an open door. We close them and prove it in writing. - **Over 90%** CIS Benchmark score - **15 minutes** to a hardened server - **Report** for auditors ## What you get - **A report for auditors**: For each server you see how many rules pass. Clients, insurers and NIS2 audits get a clear answer. - **A break-in stays contained**: Every service may only do what it needs. If one is hacked, the attacker gets no further. - **No server drifts**: Settings are checked regularly. If someone changes something by hand, it shows. - **Rebuilt in 15 minutes**: Everything is automated. A fully hardened server is ready in 15 minutes, with firewall, SELinux and CIS check. ## What we set up - [**Services locked in**](https://vetosec.at/en/it-security/haertung/): SELinux stays on. Each service may only use its own files and ports. Even after it has been hacked. - **Firewall on every server**: Only the needed services are reachable. Outgoing connections are limited too, so nobody pulls data out or loads tools in. - **Every admin session recorded**: What an administrator types and sees is recorded. In an incident every session can be replayed. - **Sign-in**: Keys only, no direct admin login. After several failed attempts the account is locked. - **Allowed programs**: Only checked programs from trusted packages start. Injected malware does not run. - [**Changes noticed**](https://vetosec.at/en/services/monitoring/): If a system file changes unexpectedly, an alert is raised. Key events go to a central log an attacker cannot delete. - **Kernel secured**: Unused drivers and features are blocked, protections against known attack techniques are on. - **Old encryption off**: Outdated, insecure methods are switched off server-wide. - [**Measured to the CIS Benchmark**](https://vetosec.at/en/it-security/cis-benchmark/): Hundreds of settings are checked automatically. You see in percent what passes and what remains open. ## What the report looks like - Compliance scan: We scan servers automatically against recognised security baselines. This server meets 96.8 percent of the applicable rules; the open items are listed in the report and get worked off. ## Price **Once as a project. Or ongoing for a fixed price.** As a project for your existing servers. Or as part of ongoing operations, with regular re-checks. Send a request ## For IT leads Technical details: RHEL · Rocky Linux · AlmaLinux · OpenSCAP · SELinux · auditd · AIDE · fapolicyd - **Profiles**: CIS Benchmark Level 1 and 2 for servers via SCAP Security Guide, exceptions justified per rule. - **Evidence**: OpenSCAP scan before and after hardening, HTML report and ARF result per server, repeated regularly. - **Access control**: SELinux enforcing with the targeted policy, fapolicyd with trust from the RPM database. - **Audit and integrity**: auditd rules per CIS, forwarding to the SIEM, AIDE database with scheduled checks. - **System**: Separate partitions with nodev, nosuid, noexec, sysctl hardening, blocked kernel modules, system-wide crypto policy without SHA-1. - **Access**: SSH with keys or certificates only, no root login, pam_faillock, sudo with I/O logging. - **Host firewall**: firewalld/nftables with default deny inbound, egress filtering per service. - **Session recording**: tlog via SSSD for all admin sessions, recordings centralised in the journal and SIEM, replayable. - **Kernel**: Modules blacklisted (usb-storage, unused file systems), kptr_restrict, dmesg_restrict, unprivileged BPF off, Yama ptrace_scope. - **Log integrity**: auditd with immutable rules (-e 2), forwarding via TLS to central logging, local deletion ineffective. - **Automation**: Hardening as code, idempotent, with a dry run before every change. Internal; the documentation is yours. ## Further reading - [**Server absichern: Warum ein Standard-Server nicht mehr reicht**](https://vetosec.at/en/articles/cybersecurity/warum-standard-server-nicht-reicht/): A freshly installed server is set up for convenience. - [**KI findet Sicherheitslücken am Fließband: Was das für Ihre Server heißt**](https://vetosec.at/en/articles/cybersecurity/ki-findet-sicherheitsluecken/): New AI models find vulnerabilities faster than ever. - [**Neue Sicherheitslücke gemeldet: Was Firmen jetzt tun sollten**](https://vetosec.at/en/articles/cybersecurity/neue-sicherheitsluecke-was-tun/): Almost every week there is a new critical vulnerability. ## Frequently asked questions ### Will our software still work afterwards? Yes. We measure first, then test, and only set targeted exceptions. Every exception is in the report. ### RHEL or Rocky Linux? Both work. RHEL has vendor support; Rocky Linux and AlmaLinux are free and built the same way. ### Our software says SELinux must be off. We hear that a lot. Usually just one setting is missing. We find it and SELinux stays on. ### Who is this for? For companies with about 30+ staff and anyone whose servers must not stop. With or without an in-house IT team. ## Related - [IT Check](https://vetosec.at/en/services/it-check/): from €1,299 - [Gap analysis & consulting](https://vetosec.at/en/services/gap-analysis/): ISO 27001, NIS2, GDPR - [Servers & clusters](https://vetosec.at/en/servers/): Proxmox, Linux, high availability ## Linux hardening for RHEL, Rocky Linux and AlmaLinux in Austria vetosec hardens Linux servers to CIS Level 1 and 2 with OpenSCAP reports, SELinux enforcing, auditd, AIDE and fapolicyd. Updated: October 26, 2026 Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/