Loading_
Loading_
Applies CIS Level 1 controls to RHEL and Ubuntu with an audit-only mode and per-control rollback notes.
#!/usr/bin/env bash# ─────────────────────────────────────────────────────────────────────────# AIInfraEngine — CIS Level 1 hardening for RHEL 8/9 and Ubuntu 22.04/24.04## ./cis-harden.sh --audit # report only, changes nothing# ./cis-harden.sh --apply # apply low-risk controls# ./cis-harden.sh --apply --force # include access-affecting controls## Every change is backed up to /var/backups/aiinfraengine-hardening/<timestamp>/# Version: 4.3.0# ─────────────────────────────────────────────────────────────────────────set -Eeuo pipefail readonly SCRIPT_NAME="${0##*/}"readonly TIMESTAMP="$(date +%Y%m%d-%H%M%S)"readonly BACKUP_DIR="/var/backups/aiinfraengine-hardening/${TIMESTAMP}"readonly LOG_FILE="/var/log/aiinfraengine-hardening.log" MODE="audit"FORCE=0PASS=0FAIL=0FIXED=0 # ── Output helpers ───────────────────────────────────────────────────────c_red=$'\033[0;31m'; c_grn=$'\033[0;32m'; c_ylw=$'\033[0;33m'c_cyn=$'\033[0;36m'; c_rst=$'\033[0m'245 more lines behind the library licence
cis-harden.sh · 8.7 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
CIS benchmarks are long, and most hardening scripts apply everything blindly — which is how you end up locking yourself out of a host at 3am.
This script separates audit from remediation. Run it with `--audit` first to see which controls fail; run it with `--apply` to fix them. Every remediation writes a backup of what it changed to `/var/backups/aiinfraengine-hardening/`.
Controls that carry real operational risk (SSH root login, firewall default policy) require `--force` in addition to `--apply`, so an unattended run cannot cut off your own access.
| Name | Type | Required | Description |
|---|---|---|---|
--audit | flag | Optional | Report only. Default mode. |
--apply | flag | Optional | Remediate low-risk controls. |
--force | flag | Optional | Also remediate access-affecting controls. |
The platform turns any script into a governed automation — versioned, gated, audited and reversible.