sudosecurity/hardline
2
0
Fork 0
Code Issues Pull requests Releases 9 Activity
9 releases 9 tags
  • v0.2.0 af0cd05d18

    Hardline 0.2.0 Stable

    Traven released this 2026-10-19 00:54:13 +00:00 | 60 commits to main since this release

    Adds the kernel (phase 7) and accounts (phase 8) phases: sysctl hardening, blocked kernel modules and password policy, with the DISA rules under --profile stig.

    Released 2026-10-19.

    Added

    • Phase 7, kernel: six sysctl controls (kernel.dmesg_restrict,
      net.ipv4.tcp_syncookies, kernel.randomize_va_space from the STIG;
      kernel.kptr_restrict, fs.protected_symlinks, fs.protected_hardlinks
      in baseline). Fixes go in /etc/sysctl.d/99-zz-hardline.conf;
      rollback restores the previous running values.
    • Phase 7 blocks kernel modules: usb-storage (STIG) plus dccp, rds, tipc
      (baseline) via /etc/modprobe.d/hardline.conf.
    • Phase 8, accounts: empty passwords, libpam-pwquality, and in stig the
      DISA password rules, password ages, INACTIVE=35 and sudo NOPASSWD. Config
      files are edited in place, so only the managed lines change.

    Install

    Prebuilt binaries are published for the latest release only. Use the latest release, or build this tag from source:

    git clone --branch v0.2.0 https://git.sudosecurity.org/sudosecurity/hardline.git && cd hardline
cargo build --release --locked

    Full changelog: https://git.sudosecurity.org/sudosecurity/hardline/compare/v0.1.0...v0.2.0

    Downloads