Hardening is a process
Build repeatable checks and audit evidence into the way Linux systems are maintained.
A one-time hardening exercise becomes less useful as a system changes. A repeatable process helps teams understand the current baseline and detect configuration drift.
Start with an agreed baseline and documented exceptions. Ansible can apply approved configuration, while OpenSCAP can assess compliance and produce evidence for review.
- Agree the baseline and exceptions with security and application owners.
- Test changes on representative systems before applying them broadly.
- Assess the impact of changes to SELinux, authentication, audit rules and services.
- Retain scan results and link remediation to reviewed changes.
- Repeat checks as the system evolves, rather than treating the first scan as completion.
A useful security process supports availability as well as compliance. Every change needs an owner, verification and a way back.