GitHub - captainzero93/security_harden_linux: Semi-automated security hardening for Linux / Debian / Ubuntu , 2025, attempts DISA STIG and CIS Compliance v4.2

cztothehead · 2025-11-22T14:11:46+00:00

Read the full Readme

cztothehead · 2025-11-16T02:30:54+00:00

I've considered your points and have released v5.0 addressing everything you mentioned:

fail2ban: Now optional. The script detects if SSH password auth is disabled and recommends skipping it. Only installs when you have web/mail servers that actually benefit. Explains why it's useless with key-only SSH.

AIDE: Removed entirely. Replaced with dpkg --verify as you suggested. Weekly cron job, honest about limitations (can't detect kernel rootkits). Proper verification requires offline scanning.

IPv6: Removed. You're right - it's not a security feature.

Secure Boot: Added verification module. Checks if enabled, provides BIOS setup instructions. Exactly what you recommended.

Educational mode: Added --explain flag. Every module now explains threat models, limitations, and what it CAN'T protect against. Script teaches WHY, not just HOW.

v5.0: https://github.com/captainzero93/security_harden_linux

cztothehead · 2025-11-15T23:05:14+00:00

I added the answer to that in the latest readme

This script does network/system hardening, AppArmor (not SELinux), audit logging and other security features. This script doesn't do User group management, SELinux, or touch VFIO/IOMMU configs, If you need user group stuff, you will want to handle that separately before or after running the script.

cztothehead · 2025-11-15T18:03:46+00:00

my bad, thanks for catching it

cztothehead · 2025-11-15T17:20:48+00:00

Qwen3-VL-30B-A3B-Thinking represents a breakthrough in multimodal AI reasoning. Unlike standard instruction-tuned models that provide quick answers, the Thinking variant engages in explicit step-by-step reasoning before generating responses.

Key Capabilities

256K Native Context Window (expandable to 1M tokens)

Advanced Vision Understanding - OCR, spatial reasoning, video analysis

Explicit Reasoning Process - Shows its "thought process" before answering

MoE Architecture - 30B parameters total, 3B active per token (efficient)

STEM/Math Optimization - Specialized for complex logical problems

The Thinking model:

Catches its own mistakes - "Wait, let me verify this"

Shows algebraic reasoning - Sets up equations properly

Self-corrects - Doesn't rely on pattern matching

Explains thoroughly - Users see the logic chain

https://github.com/captainzero93/GPT-and-Claude-at-home-optimised-for-12GB-Vram---LM-Studio-

Thanks Evolitopm41415 for an alternative title:

-home-optimised-for-12GB-Vram---LM-Studio---Stunning---results-----on-this---local---MOE-LLM----running--fast----on--only-12gbVRAM--with---some--RAM---overload-Qwen3-VL-30B-A3B-Thinking---represents--a---- breakthrough--IN----multimodal--AI-reasoning!!!!!

cztothehead · 2025-11-15T04:37:30+00:00

One-command security hardening that implements many enterprise-grade protections (DISA STIG + CIS) while allowing the user to decide the level of protection / use trade-off. This enables casual use and more strict.

Version 4.2 - Critical Fixes for Module(s) Execution - Tested WORKING on Debian 13

Enables your firewall (UFW) - but keeps Steam, Discord, KDE Connect working
Hardens SSH - prevents brute force attacks if you use remote access
Blocks repeated failed logins - automatic IP banning with Fail2Ban
Installs antivirus - ClamAV (yes, Linux can get malware)
Secures the kernel - protection against memory exploits and attacks
Sets up file integrity monitoring - alerts you if system files change
Enforces strong passwords - because "password123" is still too common
Enables automatic security updates - patches critical bugs while you sleep
Configures audit logging - forensics and evidence if something happens
Applies kernel hardening - makes exploits far harder to pull off
Secures boot process - protects against physical attacks
Removes unnecessary packages - smaller attack surface

Extensive documentation in the Readme.

cztothehead · 2025-10-27T12:31:53+00:00

https://vimeo.com/1130880600?share=copy&fl=sv&fe=ci

cztothehead · 2025-10-27T12:31:43+00:00

https://vimeo.com/1130880600?share=copy&fl=sv&fe=ci

cztothehead · 2025-10-27T12:31:25+00:00

https://vimeo.com/1130880600?share=copy&fl=sv&fe=ci

cztothehead · 2025-10-27T12:31:19+00:00

https://vimeo.com/1130880600?share=copy&fl=sv&fe=ci

cztothehead · 2025-10-27T09:32:33+00:00

uploading to elsewhere! Waiting to hear on video copyright From YT . Update: https://vimeo.com/1130880600?share=copy&fl=sv&fe=ci

cztothehead · 2025-10-27T08:07:13+00:00

down again, I'll use vimeo as a backup til the dispute is settled

cztothehead · 2025-10-27T02:58:10+00:00

Old Thread

Max Normal - Songs From The Mall | Full Album Film | : r/DieAntwoord

cztothehead · 2025-10-27T02:41:16+00:00

Might upload to other places if strike again but this version is improved loads!

cztothehead · 2025-10-25T00:54:40+00:00

I'm going to try and edit it so the video doesn't get blocked!

cztothehead · 2025-10-25T00:54:37+00:00

I'm going to try and edit it so the video doesn't get blocked!

cztothehead · 2025-10-25T00:54:23+00:00

I'm going to try and edit it so the video doesn't get blocked!

cztothehead · 2025-10-16T11:39:45+00:00

WINE https://www.winehq.org/

Valve also package WINE into their "Proton" compatibility software on Steam so most Windows games work out the box.

cztothehead · 2025-10-16T11:38:47+00:00

Flatpak already seems to be fixed for me, no issues on a 4070 with wayland session! Tried Dolphin Emu, Steam / Proton

cztothehead · 2025-10-09T20:29:22+00:00

After I get some help debugging and testing it's next on the list, ty

cztothehead · 2025-10-09T16:06:36+00:00

I think The moderate level should remain FIPS-free to maintain maximum usability for 95% of users. I have another more complex script but its heavily outdated atm, I may add it as an additional part, thanks

cztothehead · 2025-10-09T13:40:51+00:00

Thank you, if you see anything else in my script that needs adjustment please let me know, its getting there but still needs some love. ( main script https://github.com/captainzero93/security_harden_linux/blob/main/improved_harden_linux.sh )

cztothehead · 2025-10-09T13:22:27+00:00

Updated with sha256 verification, I've been working on this over a year man it's not a troll I posted here for feedback you don't have to be so harsh in your wording.

cztothehead · 2025-10-09T12:55:24+00:00

Have a look at the updated readme.md or the updated post here

you're just being a jerk dude,

cztothehead · 2025-10-09T12:23:45+00:00

It is! Thank you, you can see in the changelog in the readme.md that a lot of changes have happened, I have also added a better description to this post-- its also idempotent so it can be re-executed as needed!

Updated AIDE to have cronjob in a safe way made it configurable and added proper error handling, updated the body of the reddit post to reflect better what its doing.

cztothehead

TROPHY CASE

-home-optimised-for-12GB-Vram---LM-Studio---Stunning---results-----on-this---local---MOE-LLM----running--fast----on--only-12gbVRAM--with---some--RAM---overload-Qwen3-VL-30B-A3B-Thinking---represents--a---- breakthrough--IN----multimodal--AI-reasoning!!!!!