This is the first entry in the series documenting the Debian 13 server CIS hardening project.

The Standard #

The standard applied throughout this series is “CIS Debian Linux 13 Benchmark v1.0.0”, published by the Center for Internet Security in December 2025.

Infrastructure #

• Hetzner CX23 Cloud VPS: 2 vCPU, 4 GB RAM, 40 GB disk

• Debian 13 image
• SSH key authentication configured at provisioning
• Hetzner Cloud Firewall configured with a restrictive inbound rule set

• A second server, used as a dedicated log receiver, was provisioned later in the series

Basic Initial Configuration #

Before any benchmark recommendation was applied, the following baseline steps were carried out. These are standard preparatory measures and are documented here for completeness and reproducibility.

apt update && apt upgrade -y
adduser sharaf
usermod -aG sudo sharaf
mkdir /home/sharaf/.ssh
cp /root/.ssh/authorized_keys /home/sharaf/.ssh/
chown -R sharaf:sharaf /home/sharaf/.ssh
chmod 700 /home/sharaf/.ssh
chmod 600 /home/sharaf/.ssh/authorized_keys

/etc/ssh/sshd_config was updated with the following directives:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 4
LoginGraceTime 30

The SSH daemon was restarted to apply the changes:

sudo systemctl restart ssh

PS1 was changed to a more minimal prompt in /home/sharaf/.bashrc and /etc/bash.bashrc for both the standard user and root, using distinct colors to visually separate privilege levels:

# sharaf
PS1="\[\e[38;5;67m\]\W \$ \[\e[0m\]"

# root
PS1="\[\e[38;5;88m\]\W # \[\e[0m\]"

Lynis Baseline Audit #

With the basic configuration above in place, and before applying any CIS Benchmark recommendations, a baseline audit was recorded using Lynis.

Installed as the standard user:

$ cd /usr/local
$ git clone https://github.com/CISOfy/lynis

Executed as root:

# cd /usr/local/lynis
# ./lynis audit system > /home/sharaf/lynis_baseline_$(printf "%(%Y%m%d_%H%M%S)T\n" "-1").log

Result saved to /home/sharaf/lynis_baseline_20260627_183840.log, hardening index: 65.

================================================================================

  Lynis security scan details:

  Scan mode:
  Normal [▆]  Forensics [ ]  Integration [ ]  Pentest [ ]

  Lynis modules:
  - Compliance status      [?]
  - Security audit         [V]
  - Vulnerability scan     [V]

  Details:
  Hardening index : 65 [#############       ]
  Tests performed : 272
  Plugins enabled : 2

  Software components:
  - Firewall               [V]
  - Intrusion software     [X]
  - Malware scanner        [X]

  Files:
  - Test and debug information      : /var/log/lynis.log
  - Report data                     : /var/log/lynis-report.dat

================================================================================

Lynis scans in this project are approached as a side experiment and are not used as a validation or evaluation metric. Compliance verification, in every section, relies solely on the benchmark’s own audit procedures.

Execution Plan #

This series addresses the benchmark in two passes. The first pass covers all Level 1 recommendations, organized by benchmark section. Level 2 recommendations are addressed in a second pass following the same section order. Recommendations are applied and verified manually throughout, without automated remediation tooling.