Infrastructure hardening

Doctrine

• Hardening posture is tracked per host role and environment.
• Exceptions are time-bound, approved, and auditable by owner.
• Baseline drift must trigger alerts before operational impact.
• Rollback plans are defined before broad control changes.

Decision tree

1. Is current host posture below baseline?
   • Yes → open a remediating hardening ticket and include owner.
   • No → verify no hidden exceptions and close out drift loop.
2. Can exceptions be justified?
   • Yes → set expiry, approver, and monitoring action.
   • No → deny and keep strict default controls.
3. Can rollback be performed safely?
   • Yes → execute with post-change verification.
   • No → delay and isolate high-risk changes to maintenance windows.

Diagnostics pathway

1. Collect hardening drift diff:

   git diff -- /etc/ssh/sshd_config /etc/login.defs

2. Check SSH security-critical values:

   rg -n "PermitRootLogin|PasswordAuthentication|MaxAuthTries|AllowUsers|AllowGroups" /etc/ssh/sshd_config

3. Audit critical file permissions:

   ls -l /etc/shadow /etc/sudoers /etc/ssh/sshd_config

4. Verify exception/waiver trails:

   rg -n "waiver|exception|temporary|expires" /var/log/security/*.log

Operational checks

• Perform a monthly hardening audit and report findings to platform owner.
• Ensure all exception records include hard stop date and revalidation date.
• Test rollback command set before large policy rollout.

Related routes