Linux access hardening, checked twice
A controlled before/after review of fabricated SSH and password-policy settings, using an upstream-authored Linux CIS auditor. The scanner was not written for this portfolio; the fixtures, verification runner and case analysis are separate work.
17 failing checks became passes · 10% → 95% on 23 selected synthetic checks
What changed in the synthetic review
The first fixture produced 2 PASS, 18 FAIL and 3 SKIP. After changing the fabricated SSH, PAM and login-policy files, the same scanner produced 19 PASS, 1 FAIL and 3 SKIP. Its score for the non-skipped selected controls rose from 10% to 95%.
- Restrict SSH access. Added a fictional allowlisted user, disabled root login and X11 forwarding, reduced authentication attempts to four, and removed weak cipher, MAC and key-exchange entries.
- Strengthen password controls. Added illustrative quality and lockout PAM entries, limited maximum password age to 365 days, required at least one day between changes, and raised expiry warning to seven days.
- Keep the unresolved findings visible. The cron daemon check
5.1.1still failed; three cron permission controls were skipped because their fixture paths were absent.
How the test was performed
The imported Bash auditor was run twice against isolated directory trees using --test-root, --categories 5 and --format json. No real host or external target was scanned. Both reports were retained after removing only runner hostname and timestamp metadata.
A small Python verifier repeats both executions, checks all saved control statuses and confirms 17 FAIL → PASS transitions. It also asserts the remaining failure. The third-party source was kept unchanged; this case evaluates its behavior on the authored fixtures.
Open the evidence and source credit
Original tool: ©AngelaMos / CarterPerez-dev, AGPL-3.0-or-later. The source copy is credited and version-pinned. The synthetic fixtures and comparison report are not upstream-authored scanner code.
What this does not establish
This is a synthetic educational run assisted by automation, not an owner-operated production engagement, an approved system change, or a full CIS benchmark certification. The auditor evaluated 23 controls in its section-5 subset, not the whole benchmark.
Two apparent passes in test mode do not verify SSH file or host-key permissions. The illustrative PAM configuration was not activated or tested through a real authentication stack. A production decision would require service-level tests, environment-specific review, change approval and rollback.