بسم الله، والحمد لله، والصلاة والسلام على رسول الله وعلى آله وصحبه ومن اهتدى بهداه.

This is the overview of the Debian 13 server CIS hardening project.

A Debian 13 server, directly exposed to the internet, was fully hardened against the CIS Debian Linux 13 Benchmark, resulting in a hardened server image documented publicly across a twelve part series.

Scope #

The hardening effort covers a Debian 13 server directly exposed to the internet.

Standard applied:

• Benchmark: CIS Debian Linux 13 Benchmark
• Version: v1.0.0
• Publication date: 16-12-2025
• Length: 1063 pages
• Profiles implemented: Level 1 and Level 2, in full

Execution #

• Introduction
• Level 1:
  • Initial Setup
  • Services
  • Network
  • Host Based Firewall
  • Access Control
  • Logging and Auditing
  • System Maintenance
• Level 2:
  • Initial Setup
  • Services to Access Control
  • Logging and Auditing
• Conclusion
• External Publications:
  • Post-Install Repartitioning

Outcomes #

The primary outcome is a fully hardened Debian 13 server image, built in accordance with the CIS Debian Linux 13 Benchmark v1.0.0. The entire process was documented publicly as a twelve part series, covering every implemented section of the benchmark in detail.

Secondary outcomes include:

• A dedicated log receiver server configured to accept forwarded logs over TLS, including the setup of a private certificate authority.
• A set of discrepancies identified within the benchmark’s text, particularly relevant to hardening automation.
• Lynis audit runs recorded after the completion of each section.
• “Post-Install Repartitioning for CIS Hardening Compliance”, a tutorial authored for Hetzner’s community documentation.

والله ولي التوفيق.