What this prompt does
This prompt writes a Bash script that audits and hardens a [distro] server against [security_framework] benchmarks, given the server runs [primary_services] and is used by [user_count] admins. It works through SSH hardening (root login off, key-only auth, port [ssh_port], idle timeout, max auth tries), firewall config with [firewall_tool] allowing only [allowed_ports], disabling unused services, unattended-upgrades, auditd rules for sensitive files plus [monitored_paths], password policy, file permissions with AIDE, and an HTML PASS/FAIL/MANUAL-REVIEW report.
The variables tailor the hardening to your environment. [distro] and [security_framework] set which benchmark and tooling apply, [ssh_port] and [allowed_ports] define the network surface, and [monitored_paths] extends auditd beyond the default sensitive files. The PASS/FAIL/MANUAL-REVIEW report framing ensures the script documents what it changed and what still needs a human. That report is as valuable as the remediation itself: it gives you an auditable record of the server's posture, and the MANUAL-REVIEW category acknowledges that some controls (which services are truly unnecessary, for instance) are judgment calls a script should flag rather than silently enforce.
When to use it
- Bringing a fresh server into production and you want a hardening pass first
- Auditing an existing box against
[security_framework]like a CIS benchmark - You want a record of what was changed versus what needs manual review
- Locking down SSH, then firewall, then auditd and file integrity in order
- Enforcing password policy and account lockout consistently
- Setting up AIDE for file integrity monitoring on sensitive directories
Example output
You get a Bash script organized by control area: SSH config edits, [firewall_tool] rules for [allowed_ports], a service enumeration and flagging step, unattended-upgrades setup, auditd rules, password policy changes, permission fixes plus AIDE, and a final HTML report marking each check PASS, FAIL, or MANUAL-REVIEW. The script audits and remediates, with the report summarizing both.
Pro tips
- Confirm
[ssh_port]and[allowed_ports]agree before running; changing the SSH port without opening it in[firewall_tool]is the classic way to lock yourself out - Keep a second logged-in session open while applying SSH changes so a bad config does not strand you
- Treat MANUAL-REVIEW items as real work — automated remediation cannot safely decide everything, and the report flags those for a reason
- Match
[security_framework]to your compliance target; CIS Level 1 and Level 2 differ in how aggressive the controls are - Extend
[monitored_paths]to your app's config and data directories so auditd catches tampering beyond /etc/passwd and /etc/shadow - Run the audit-only pass first if the script supports it, review the report, then apply remediation rather than hardening blind
- Enable unattended-upgrades for critical patches only as the prompt specifies; auto-applying every update on a production box invites surprise breakage
