server-hardening-checklist 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dargslan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,69 @@
+# 🛡️ Server Hardening Checklist
+
+[![npm](https://img.shields.io/npm/v/server-hardening-checklist)](https://www.npmjs.com/package/server-hardening-checklist)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+
+**Interactive Linux server security hardening checklist in your terminal.** Walk through 50+ security checks across 9 categories and get a security grade for your server.
+
+## Quick Start
+
+```bash
+npx server-hardening-checklist
+```
+
+## Features
+
+- 🛡️ **50+ security checks** across 9 categories
+- 🔑 **SSH Hardening** — root login, key auth, port, timeouts
+- 🛡️ **Firewall** — iptables/ufw, default deny, SYN flood protection
+- 👤 **User Management** — passwords, sudo, umask, PAM
+- 📦 **System Updates** — auto-updates, kernel, package cleanup
+- 📂 **File System** — permissions, SUID/SGID, /tmp hardening
+- 🌐 **Network** — IP forwarding, ICMP, source routing
+- 📊 **Logging & Auditing** — auditd, fail2ban, log rotation
+- ⚙️ **Services** — disable unnecessary, check listeners
+- 🕸️ **Web Server** — headers, TLS, directory listing, rate limiting
+- 🏆 **Security grade** (A-F) based on your responses
+- ⚠️ **Critical item tracking** — never miss important fixes
+- 🔧 **Check commands** — exact commands to verify each item
+- 🚀 Zero dependencies
+
+## Audit Modes
+
+| Mode | Description |
+|------|-------------|
+| Full Audit | All 50+ items across all sections |
+| Critical Only | Only critical/must-do items |
+| By Section | Focus on one category at a time |
+| View Commands | See all check commands (no interaction) |
+
+## Priority Levels
+
+- 🔴 **CRITICAL** — Must fix immediately, major security risk
+- 🟡 **RECOMMENDED** — Should implement, significant improvement
+- ⚪ **OPTIONAL** — Nice to have, depends on use case
+
+## Who Is This For?
+
+- 🖥️ **System administrators** hardening production servers
+- 🔍 **Security auditors** performing baseline checks
+- 🎓 **Students** learning server security best practices
+- 💼 **DevOps engineers** setting up new servers
+
+## More Tools
+
+- 🐧 `npx dargslan-linux-quiz` — Linux Quiz
+- ⚙️ `npx dargslan-sysadmin-quiz` — SysAdmin Quiz
+- 🐳 `npx dargslan-devops-quiz` — DevOps Quiz
+- 🔒 `npx dargslan-security-quiz` — Security Quiz
+- 📖 `npx linux-cheatsheet-cli` — Command Reference
+
+## Learn More
+
+- 📚 [210+ IT eBooks](https://dargslan.com/books)
+- 📄 [260+ Cheat Sheets](https://dargslan.com/cheat-sheets)
+- 📝 [IT Blog](https://dargslan.com/blog)
+
+## License
+
+MIT — [dargslan.com](https://dargslan.com)

package/index.js

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+
+const readline = require('readline');
+
+const c = {
+  reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+  red: '\x1b[31m', green: '\x1b[32m', yellow: '\x1b[33m',
+  blue: '\x1b[34m', magenta: '\x1b[35m', cyan: '\x1b[36m', white: '\x1b[37m',
+  bgGreen: '\x1b[42m', bgRed: '\x1b[41m', bgYellow: '\x1b[43m',
+};
+
+const SECTIONS = [
+  {
+    name: 'SSH Hardening', icon: '🔑',
+    items: [
+      { id: 'ssh-1', text: 'Disable root login (PermitRootLogin no)', priority: 'critical', config: '/etc/ssh/sshd_config', command: "grep '^PermitRootLogin' /etc/ssh/sshd_config" },
+      { id: 'ssh-2', text: 'Use key-based authentication only (PasswordAuthentication no)', priority: 'critical', config: '/etc/ssh/sshd_config', command: "grep '^PasswordAuthentication' /etc/ssh/sshd_config" },
+      { id: 'ssh-3', text: 'Change default SSH port', priority: 'recommended', config: '/etc/ssh/sshd_config', command: "grep '^Port' /etc/ssh/sshd_config" },
+      { id: 'ssh-4', text: 'Set MaxAuthTries to 3', priority: 'recommended', config: '/etc/ssh/sshd_config', command: "grep '^MaxAuthTries' /etc/ssh/sshd_config" },
+      { id: 'ssh-5', text: 'Disable X11Forwarding', priority: 'recommended', config: '/etc/ssh/sshd_config', command: "grep '^X11Forwarding' /etc/ssh/sshd_config" },
+      { id: 'ssh-6', text: 'Set LoginGraceTime to 60', priority: 'optional', config: '/etc/ssh/sshd_config', command: "grep '^LoginGraceTime' /etc/ssh/sshd_config" },
+      { id: 'ssh-7', text: 'Use SSH Protocol 2 only', priority: 'critical', config: '/etc/ssh/sshd_config', command: "grep '^Protocol' /etc/ssh/sshd_config" },
+      { id: 'ssh-8', text: 'Set idle timeout (ClientAliveInterval 300)', priority: 'recommended', config: '/etc/ssh/sshd_config', command: "grep '^ClientAliveInterval' /etc/ssh/sshd_config" },
+    ],
+  },
+  {
+    name: 'Firewall', icon: '🛡️',
+    items: [
+      { id: 'fw-1', text: 'Enable firewall (ufw/firewalld/iptables)', priority: 'critical', command: 'ufw status || firewall-cmd --state || iptables -L -n' },
+      { id: 'fw-2', text: 'Default deny incoming traffic', priority: 'critical', command: 'iptables -L INPUT | head -1' },
+      { id: 'fw-3', text: 'Allow only necessary ports (22, 80, 443)', priority: 'critical', command: 'ss -tlnp' },
+      { id: 'fw-4', text: 'Block ICMP ping (optional, depends on use case)', priority: 'optional', command: "sysctl net.ipv4.icmp_echo_ignore_all" },
+      { id: 'fw-5', text: 'Enable SYN flood protection', priority: 'recommended', command: "sysctl net.ipv4.tcp_syncookies" },
+      { id: 'fw-6', text: 'Log dropped packets', priority: 'recommended', command: 'iptables -L -n | grep LOG' },
+    ],
+  },
+  {
+    name: 'User Management', icon: '👤',
+    items: [
+      { id: 'user-1', text: 'Remove or lock unused user accounts', priority: 'critical', command: "awk -F: '$3 >= 1000 {print $1}' /etc/passwd" },
+      { id: 'user-2', text: 'Enforce strong password policy', priority: 'critical', config: '/etc/security/pwquality.conf', command: 'grep minlen /etc/security/pwquality.conf' },
+      { id: 'user-3', text: 'Set password expiration (90 days)', priority: 'recommended', config: '/etc/login.defs', command: 'grep PASS_MAX_DAYS /etc/login.defs' },
+      { id: 'user-4', text: 'Restrict sudo access to necessary users only', priority: 'critical', command: 'grep -v "^#" /etc/sudoers | grep -v "^$"' },
+      { id: 'user-5', text: 'Set umask to 027 or 077', priority: 'recommended', command: 'umask' },
+      { id: 'user-6', text: 'Disable guest account', priority: 'recommended', command: 'id guest 2>&1' },
+    ],
+  },
+  {
+    name: 'System Updates', icon: '📦',
+    items: [
+      { id: 'upd-1', text: 'Enable automatic security updates', priority: 'critical', command: 'apt list --installed 2>/dev/null | grep unattended-upgrades || dnf list installed | grep dnf-automatic' },
+      { id: 'upd-2', text: 'Check for and apply pending updates', priority: 'critical', command: 'apt list --upgradable 2>/dev/null || dnf check-update' },
+      { id: 'upd-3', text: 'Remove unnecessary packages', priority: 'recommended', command: 'apt autoremove --dry-run 2>/dev/null || dnf autoremove --assumeno' },
+      { id: 'upd-4', text: 'Check kernel version is current', priority: 'recommended', command: 'uname -r' },
+      { id: 'upd-5', text: 'Enable and check reboot-required notifications', priority: 'optional', command: 'ls /var/run/reboot-required 2>&1' },
+    ],
+  },
+  {
+    name: 'File System Security', icon: '📂',
+    items: [
+      { id: 'fs-1', text: 'Set noexec,nosuid,nodev on /tmp', priority: 'critical', command: 'mount | grep /tmp' },
+      { id: 'fs-2', text: 'Set proper permissions on /etc/shadow (640)', priority: 'critical', command: 'ls -la /etc/shadow' },
+      { id: 'fs-3', text: 'Set proper permissions on /etc/passwd (644)', priority: 'critical', command: 'ls -la /etc/passwd' },
+      { id: 'fs-4', text: 'Find and review SUID/SGID files', priority: 'recommended', command: 'find / -perm /4000 -type f 2>/dev/null | head -10' },
+      { id: 'fs-5', text: 'Disable USB storage (if not needed)', priority: 'optional', command: 'lsmod | grep usb_storage' },
+      { id: 'fs-6', text: 'Set sticky bit on world-writable directories', priority: 'recommended', command: 'find / -type d -perm -0002 -not -perm -1000 2>/dev/null | head -5' },
+    ],
+  },
+  {
+    name: 'Network Hardening', icon: '🌐',
+    items: [
+      { id: 'net-1', text: 'Disable IP forwarding (unless router)', priority: 'critical', command: 'sysctl net.ipv4.ip_forward' },
+      { id: 'net-2', text: 'Disable ICMP redirects', priority: 'recommended', command: 'sysctl net.ipv4.conf.all.accept_redirects' },
+      { id: 'net-3', text: 'Enable reverse path filtering', priority: 'recommended', command: 'sysctl net.ipv4.conf.all.rp_filter' },
+      { id: 'net-4', text: 'Disable source routing', priority: 'critical', command: 'sysctl net.ipv4.conf.all.accept_source_route' },
+      { id: 'net-5', text: 'Use DNS-over-TLS or DNS-over-HTTPS', priority: 'optional', command: "grep 'DNS=' /etc/systemd/resolved.conf 2>/dev/null" },
+    ],
+  },
+  {
+    name: 'Logging & Auditing', icon: '📊',
+    items: [
+      { id: 'log-1', text: 'Enable and configure auditd', priority: 'critical', command: 'systemctl is-active auditd 2>/dev/null || echo "auditd not installed"' },
+      { id: 'log-2', text: 'Configure log rotation (logrotate)', priority: 'recommended', command: 'ls /etc/logrotate.d/' },
+      { id: 'log-3', text: 'Send logs to remote syslog server', priority: 'recommended', command: "grep '@' /etc/rsyslog.conf 2>/dev/null | head -3" },
+      { id: 'log-4', text: 'Monitor auth.log / secure for brute force', priority: 'critical', command: 'tail -5 /var/log/auth.log 2>/dev/null || tail -5 /var/log/secure 2>/dev/null' },
+      { id: 'log-5', text: 'Install and configure fail2ban', priority: 'critical', command: 'systemctl is-active fail2ban 2>/dev/null || echo "fail2ban not installed"' },
+      { id: 'log-6', text: 'Set up login alerts (email on SSH login)', priority: 'optional', command: "grep 'login' /etc/pam.d/sshd 2>/dev/null | head -3" },
+    ],
+  },
+  {
+    name: 'Services & Processes', icon: '⚙️',
+    items: [
+      { id: 'svc-1', text: 'Disable unnecessary services', priority: 'critical', command: 'systemctl list-unit-files --state=enabled --type=service' },
+      { id: 'svc-2', text: 'Check for listening services on all interfaces', priority: 'critical', command: 'ss -tlnp | grep 0.0.0.0' },
+      { id: 'svc-3', text: 'Ensure NTP synchronization is active', priority: 'recommended', command: 'timedatectl status' },
+      { id: 'svc-4', text: 'Disable Avahi/mDNS if not needed', priority: 'recommended', command: 'systemctl is-active avahi-daemon 2>/dev/null || echo "not installed"' },
+      { id: 'svc-5', text: 'Disable Bluetooth if not needed', priority: 'recommended', command: 'systemctl is-active bluetooth 2>/dev/null || echo "not installed"' },
+    ],
+  },
+  {
+    name: 'Web Server (if applicable)', icon: '🕸️',
+    items: [
+      { id: 'web-1', text: 'Hide server version headers', priority: 'critical', command: 'curl -sI localhost | grep -i server' },
+      { id: 'web-2', text: 'Enable HTTPS with strong TLS (1.2+)', priority: 'critical', command: 'openssl s_client -connect localhost:443 -brief 2>/dev/null | head -5' },
+      { id: 'web-3', text: 'Set security headers (HSTS, CSP, X-Frame-Options)', priority: 'recommended', command: 'curl -sI localhost | grep -iE "strict|content-security|x-frame"' },
+      { id: 'web-4', text: 'Disable directory listing', priority: 'critical', command: 'curl -s localhost/nonexistent/ | head -3' },
+      { id: 'web-5', text: 'Configure rate limiting', priority: 'recommended', command: 'echo "Check nginx/apache config for rate limiting directives"' },
+    ],
+  },
+];
+
+function ask(rl, q) { return new Promise(r => rl.question(q, a => r(a.trim()))); }
+
+function priorityLabel(p) {
+  if (p === 'critical') return `${c.bgRed}${c.white}${c.bold} CRITICAL ${c.reset}`;
+  if (p === 'recommended') return `${c.bgYellow}${c.bold} RECOMMENDED ${c.reset}`;
+  return `${c.dim} OPTIONAL ${c.reset}`;
+}
+
+async function main() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const checked = {};
+
+  console.log(`\n${c.bold}${c.cyan}  ╔══════════════════════════════════════════════════╗`);
+  console.log(`  ║${c.white}   🛡️  SERVER HARDENING CHECKLIST  🔒              ${c.cyan}║`);
+  console.log(`  ║${c.dim}${c.white}   Interactive Linux security audit               ${c.cyan}║`);
+  console.log(`  ╚══════════════════════════════════════════════════╝${c.reset}`);
+  console.log(`${c.dim}  Powered by dargslan.com — 210+ IT eBooks${c.reset}\n`);
+
+  console.log(`  ${c.green}[1]${c.reset} Full Audit (all sections)`);
+  console.log(`  ${c.yellow}[2]${c.reset} Critical Items Only`);
+  console.log(`  ${c.cyan}[3]${c.reset} Choose Section`);
+  console.log(`  ${c.magenta}[4]${c.reset} View Commands Only (no interaction)\n`);
+
+  const mode = parseInt(await ask(rl, `  ${c.bold}Choice [1-4]: ${c.reset}`)) || 1;
+
+  let sections;
+  if (mode === 3) {
+    console.log('');
+    SECTIONS.forEach((s, i) => console.log(`  [${i + 1}] ${s.icon} ${s.name} (${s.items.length} items)`));
+    const si = (parseInt(await ask(rl, `\n  ${c.bold}Section [1-${SECTIONS.length}]: ${c.reset}`)) || 1) - 1;
+    sections = [SECTIONS[Math.min(si, SECTIONS.length - 1)]];
+  } else {
+    sections = SECTIONS;
+  }
+
+  let totalItems = 0;
+  let completedItems = 0;
+  let criticalMissed = 0;
+
+  for (const section of sections) {
+    console.log(`\n${c.bold}${c.cyan}  ════ ${section.icon} ${section.name.toUpperCase()} ════${c.reset}\n`);
+
+    const items = mode === 2 ? section.items.filter(i => i.priority === 'critical') : section.items;
+
+    for (const item of items) {
+      totalItems++;
+      console.log(`  ${priorityLabel(item.priority)} ${c.bold}${item.text}${c.reset}`);
+
+      if (item.config) {
+        console.log(`  ${c.dim}Config: ${item.config}${c.reset}`);
+      }
+      console.log(`  ${c.dim}Check:  ${item.command}${c.reset}`);
+
+      if (mode === 4) {
+        console.log('');
+        continue;
+      }
+
+      const answer = await ask(rl, `  ${c.bold}Done? [y/n/s(kip)]: ${c.reset}`);
+      const lower = answer.toLowerCase();
+
+      if (lower === 'y' || lower === 'yes') {
+        checked[item.id] = true;
+        completedItems++;
+        console.log(`  ${c.green}✓ Checked off${c.reset}\n`);
+      } else if (lower === 's' || lower === 'skip') {
+        console.log(`  ${c.yellow}→ Skipped${c.reset}\n`);
+      } else {
+        if (item.priority === 'critical') criticalMissed++;
+        console.log(`  ${c.red}✗ Not done — ${item.priority === 'critical' ? 'ACTION REQUIRED' : 'consider implementing'}${c.reset}\n`);
+      }
+    }
+  }
+
+  if (mode !== 4) {
+    const pct = totalItems > 0 ? Math.round(completedItems / totalItems * 100) : 0;
+    const sc = pct >= 80 ? c.green : pct >= 60 ? c.yellow : c.red;
+
+    console.log(`\n${c.bold}${c.cyan}  ═══════════ AUDIT RESULTS ═══════════${c.reset}\n`);
+    console.log(`  Completed: ${sc}${c.bold}${completedItems}/${totalItems} (${pct}%)${c.reset}`);
+
+    if (criticalMissed > 0) {
+      console.log(`  ${c.bgRed}${c.white}${c.bold} ⚠ ${criticalMissed} CRITICAL items not completed! ${c.reset}`);
+    } else {
+      console.log(`  ${c.bgGreen}${c.white}${c.bold} ✓ All critical items addressed ${c.reset}`);
+    }
+
+    const grade = pct >= 90 ? 'A' : pct >= 80 ? 'B' : pct >= 70 ? 'C' : pct >= 60 ? 'D' : 'F';
+    const gc = grade <= 'B' ? c.green : grade <= 'C' ? c.yellow : c.red;
+    console.log(`\n  Security Grade: ${gc}${c.bold}${grade}${c.reset}`);
+
+    if (pct < 80) {
+      console.log(`\n  ${c.bold}Recommended reading:${c.reset}`);
+      console.log(`  📖 Linux System Hardening\n     ${c.cyan}https://dargslan.com/book/linux-system-hardening${c.reset}`);
+      console.log(`  📖 Linux Security Essentials\n     ${c.cyan}https://dargslan.com/book/linux-security-essentials${c.reset}`);
+    } else {
+      console.log(`\n  ${c.bold}Level up your skills:${c.reset}`);
+      console.log(`  📖 Ethical Hacking\n     ${c.cyan}https://dargslan.com/book/ethical-hacking${c.reset}`);
+      console.log(`  📖 Linux Performance Tuning\n     ${c.cyan}https://dargslan.com/book/linux-performance-tuning${c.reset}`);
+    }
+  }
+
+  console.log(`\n  📚 210+ IT eBooks: ${c.cyan}https://dargslan.com/books${c.reset}`);
+  console.log(`  📄 260+ Cheat Sheets: ${c.cyan}https://dargslan.com/cheat-sheets${c.reset}`);
+  console.log(`  📝 IT Blog: ${c.cyan}https://dargslan.com/blog${c.reset}`);
+  console.log(`  🔒 Security Quiz: ${c.cyan}npx dargslan-security-quiz${c.reset}`);
+  console.log(`\n${c.dim}  Made with ❤ by Dargslan — dargslan.com${c.reset}\n`);
+
+  rl.close();
+}
+
+main().catch(console.error);

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "server-hardening-checklist",
+  "version": "1.0.0",
+  "description": "Interactive Linux server security hardening checklist in your terminal. 50+ security checks for SSH, firewall, users, updates, and more.",
+  "main": "index.js",
+  "bin": {
+    "server-hardening-checklist": "./index.js",
+    "harden": "./index.js"
+  },
+  "keywords": [
+    "security", "hardening", "server", "linux", "checklist", "terminal", "cli",
+    "ssh", "firewall", "fail2ban", "audit", "compliance", "cis-benchmark",
+    "sysadmin", "devops", "best-practices", "pentest"
+  ],
+  "author": "Dargslan <info@dargslan.com> (https://dargslan.com)",
+  "license": "MIT",
+  "homepage": "https://dargslan.com",
+  "repository": { "type": "git", "url": "https://github.com/Dargslan/server-hardening-checklist" },
+  "engines": { "node": ">=14.0.0" },
+  "files": ["index.js", "README.md", "LICENSE"]
+}