Package Details: linux-system-hardener 1.5.1-1

Git Clone URL: https://aur.archlinux.org/linux-system-hardener.git (read-only, click to copy)
Package Base: linux-system-hardener
Description: Linux security automation: scanning, hardening, and rollback across 8 domains
Upstream URL: https://github.com/tidynest/linux-system-hardener
Keywords: audit cli firewall gui hardening kernel linux linux-system-hardener pam rust security ssh
Licenses: Apache-2.0
Submitter: TidyNest
Maintainer: TidyNest
Last Packager: TidyNest
Votes: 0
Popularity: 0.000000
First Submitted: 2026-02-27 17:49 (UTC)
Last Updated: 2026-07-27 19:59 (UTC)

Latest Comments

TidyNest commented on 2026-07-27 08:27 (UTC)

1.5.0 fixes a data-loss bug: on 1.4.0 and earlier, hardener rollback against a REMOTE host over SSH could delete /etc/passwd, /etc/group, /etc/shadow, /etc/gshadow and /etc/sudoers. Local-only use was never affected. Please update. Full details are in the security advisory on the GitHub repo.

1.5.0 also fixes a silent one. Every release up to 1.4.0 wrote /etc/login.defs using "KEY = value", which that file does not accept, so PASS_MAX_DAYS, PASS_MIN_DAYS and PASS_WARN_AGE kept their old values while a later scan read the tool's own discarded line and called the host compliant. Password ageing was never actually applied.

Upgrading does not repair a host you already hardened. Re-apply:

sudo hardener apply -p pam-hardening

To confirm, ask the system instead of the tool. login.defs only supplies defaults for NEW accounts, so check with a throwaway one:

sudo useradd --no-create-home ageing-probe
sudo chage -l ageing-probe | grep -i maximum
sudo userdel ageing-probe

99999 means the policy is not in force; after re-applying it should read 90.

One known issue remains, and it is not destructive: rollback does not restore systemd unit files. The services plugin records them in the checkpoint, but rollback's allow-list does not cover the systemd unit directories, so they are skipped at restore time. Nothing is lost, but a service disabled by apply will not be re-enabled by rollback. Re-enable by hand with systemctl enable --now. It is tracked upstream and will be in a following release.

I am sorry about all of this. You install this to make a machine safer and it should not be the thing that breaks it. If any of these have cost you anything, I apologise. I would rather list known problems here, including the ones still unfixed, than have you find them the hard way.

TidyNest commented on 2026-02-27 18:01 (UTC) (edited on 2026-02-27 18:02 (UTC) by TidyNest)

Linux security automation: scanning, hardening, and rollback across 8 domains - Written in Rust.

https://github.com/tidynest/linux-system-hardener

  • Eric Jingryd (TidyNest)