Are there any proven concepts or "installers" to get up and running based on the best practices securing and locking down a CentOS installation?

I'm hoping for an automated tool that would scan the system, give suggestions, change security settings, install a good network intrusion detection, and have some simple admin panel to check.

Is there such thing or is this just a fantasy?


I doubt you will find a One-Stop-Shop kind of solution that actually works well. Your best bet will be to review one of the excellent hardening guidelines and implement what makes sense for you.

That being said, you should probably check out two projects

  1. Bastille
  2. Tiger

If you have a little more resources available some vulnerability assessment products can do configuration audits. For instance, ProfessionalFeed subscribers to Nessus have a large number of configuration audits available, including many CIS benchmarks.

All of these will inspect your install and make some recommendations on what to change or tell you how this install deviates from the standard. However, their base rulesets may very well not work for you. You really need to modify their checks to match how you want your environment to look.

  • Very Nice I found out about Bastille a while later Tiger haven't heard of that one yet. Are there also some tools like that to have network intrusion detection and firewall setup based on a guidance installer on best practice? Going to look into both options, install fresh centOS 6 today! Thx – Rubytastic Oct 20 '11 at 12:18
  • Bastille looks awesome, but hasn't been in active development since about 7 years if I gather the information from their site correctly. – user857990 May 15 '13 at 10:49
  • @user857990 That sounds about right. Tiger isn't exactly daily releases either but unfortunately we don't really have many choices in this area. – Scott Pack May 15 '13 at 11:50
  • CIS also has their own commercial offering called CIS-CAT ! – atdre Dec 16 '14 at 20:37

I think Scott Pack has a great answer. Probably also worth noting that you should at least have some passing familarity with the DISA STIGs here are some specific to RedHat. They will at least give you some idea on wrapping your mind around what you need to do as far as technical controls.

STIGs are mostly impractical to implement everything, but its not a bad starting point molding your own technical policy around.

  • You need to have a process
  • Realize it is going to take some time

Our brightest minds get it wrong all of the time. Alas, such is the way when your adversaries have the distinct advantage they have.


There is a new tool by David 'Rel1k' that not only applies to centOS but to all other Linux distros, have a look at Artillery on TrustedSec or Artillery on Github.

Tool name is Artillery! Easy to install and I think might do what you need! It gets constant updates and if you have any questions you can ask on Twitter about it to Dave Kennedy (ReL1K) @HackingDave

  • This is a very different way to look at the problem! Kudos to this answer!! Threat intelligence feeds such as ThreatRecon are making the rounds, supported by tools such as CRITs, PizzaCat, and Maltego. Other free options include OpenDNS, PassiveTotal, and totalhash -- with may other demos from the commercial cyber threat intelligence offerings – atdre Dec 16 '14 at 22:05

Two tools that do the checking/scanning bit, from the view of an attacker (which I find very helpful for hardening):

The second one is fairly new.

  • These are wonderful tools and I'm happy to "suggest" that there are Windows equivalents! Google for them! – atdre Dec 16 '14 at 20:38

Both LSAT and YASAT had active development in 2014. The other suggestions here have been great, you may see me upvote some of them!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.