About Hardline
Why SudoSecurity built Hardline, the principles behind it (security without lockouts, speed, no telemetry), the roadmap, license and how to contribute.
Hardline is SudoSecurity's open-source server hardening tool. We built it because hardening guides are long, scripts are scary, and the most common way to "secure" a server is to lock yourself out of it.
Why we built it
Most people who run a VPS know they should turn off password logins, enable a firewall and tighten the kernel. Few do, because one wrong line in sshd_config means a support ticket and a rescue console. Hardline removes that fear: it shows you exactly what it would change, validates it, and takes it back on its own if you can't log in again.
What it stands for
Security first
No shell, no unsafe code, a fixed list of programs, and every risky change guarded and reversible.
Performance
One small Rust binary. A full audit takes about 0.15 seconds and 15 MB of memory. No daemon.
Honest
It only claims systems it's tested on, refuses everything else, and never calls itself a certification.
Yours
No account, no telemetry, no network calls. MIT OR Apache-2.0, free for any use.
Where it's going
- More distributions, each one only after it passes the full lockout and rollback test suite on real VMs.
- More controls, each with a STIG reference or a written reason it's baseline-only.
- Better ways to see your fleet's state from the JSON report and
hardline watch.
Contribute
Bug reports, new controls and distro testing are all welcome. Read CONTRIBUTING.md before opening a pull request, and report security issues privately, as described on the security page.
About SudoSecurity
SudoSecurity is a community for developers and security people: articles on Linux, self-hosting and security, plus forums where you can ask about Hardline or anything else.