Harden any Linux server. Without locking yourself out.
Hardline audits your server, grades it A–F, and fixes what's weak, one phase at a time. If a change would cut off your SSH access, it undoes itself.
$ sudo hardline auditPhase 1 · SSH FAIL ssh-x11-forwarding Disable SSH X11 forwarding FAIL ssh-permit-root-login No direct SSH login as root PASS ssh-password-authentication …Grade F (42%) · 14/36 controls pass (baseline)Next: sudo hardline apply --phase 1 (dry run; add --commit to change anything)
$ sudo hardline apply --phase 1 --commitApplying phase 1 (SSH) fix ssh-x11-forwarding Disable SSH X11 forwarding fix ssh-permit-root-login No direct SSH login as root write /etc/ssh/sshd_config.d/10-hardline.conf +X11Forwarding no +PermitRootLogin noPhase 1 applied and waiting for confirmation.If you can't log in, do nothing: the change reverts itself in 120 seconds, or at the next boot.
$ sudo hardline confirm# run from a NEW ssh session, so you know you can still get inPhase 1 confirmed. Undo any time with: sudo hardline rollback --phase 1 # … phases 1–8 later:Grade B (82%) · 30/36 controls pass (baseline)
$ sudo hardline rollback --phase 1Phase 1 rolled back. Restored: /etc/ssh/sshd_config.d/10-hardline.confEvery write is snapshotted first, so undo puts back the exact bytes.
How a change happens
- AuditRead-only. 102 controls across 8 phases, graded by severity.
- Preview
applywithout--commitprints the exact diff and touches nothing. - CommitSnapshot, atomic write, validate, then a revert timer starts for SSH and firewall.
- ConfirmFrom a new login. No confirm, or a reboot, and it rolls itself back.
rollback.Built for people who can't afford a lockout
Can't lock you out
SSH and firewall changes are validated first, then undo themselves unless you confirm from a new login. A reboot undoes them too.
Audit first, always
audit changes nothing. apply is a dry run showing the exact diff until you add --commit.
A grade you can share
A–F, weighted by severity. hardline report writes one HTML file: no scripts, no network, safe to email.
Watches for drift
hardline watch re-audits on a timer and fails a systemd unit when anything gets worse, so your alerts fire.
Small, fast, and quiet
Measured: median of 5 runs of hardline audit (102 controls) on 1-vCPU VMs: 0.67 s on Ubuntu 24.04 (15 MB peak memory), including one walk of all 86,000 files for the permission checks. Runs on Ubuntu 26.04, Ubuntu 24.04, Ubuntu 22.04, Debian 13, Debian 12 and RHEL 9 / Rocky Linux 9 / AlmaLinux 9.
Try it in 30 seconds
sudo hardline audit # read-only, safe anytime
sudo hardline apply --phase 1 # dry run: shows the diff
sudo hardline apply --phase 1 --commit # write it, start a 2-min timer
sudo hardline confirm # from a NEW ssh sessionEvery finding hardline audit prints links to its entry in the controls reference. Read how Hardline keeps your server safe or how it works inside.
What it hardens
Hardline works outside in: the doors first (SSH, firewall), then who can do what, what gets logged, and finally the kernel and accounts. Run any phase alone, or apply --all for the lot with one confirm.
Every check, with why it matters and the exact fix: controls reference.
Questions people ask
Will it break my apps?
Probably not, but that's why apply is a dry run first. You see every line it would write before anything changes. The firewall phase allows every port that's listening right now, so running services stay reachable. Anything you need to keep on purpose, skip it in /etc/hardline/config.toml with a reason.
What if I lose my connection halfway through?
Nothing bad. The revert timer lives in systemd, not in your SSH session, so it keeps running when your Wi‑Fi drops. Two minutes later the old SSH and firewall config is back. A reboot before you confirm does the same thing through the boot guard.
Does it phone home?
No. No telemetry, no account, no daemon. The only network calls are ones you ask for, like self-update and watch --notify webhooks.
Is it a compliance certification?
No. The cis and stig profiles map checks to real rule IDs, and report --audit gives you a clean evidence table, but an auditor still signs off. Think of it as doing 80% of the boring part for you.
Can I undo everything?
Yes. Every phase snapshots each file (content, SHA-256, mode, owner) before it touches it. sudo hardline rollback --phase N puts them back, and hardline diff shows anything that changed outside Hardline since.
How is this different from a hardening script?
A script runs once and hopes. Hardline audits before it changes anything, validates every config before reloading, can't lock you out, undoes itself on failure, and keeps watching for drift afterwards. It also never runs a shell.
Harden your first server today
Free and open source under MIT OR Apache-2.0. One binary, no account, no telemetry.