Day 21: Practice: System hardening toolkit

This topic matters because it deals with host drift and dangerous defaults across Linux systems using Bash and the native Linux tooling already on the box.

The pattern

#!/usr/bin/env bash
            set -euo pipefail
            while IFS= read -r mp; do echo "$mp -> $(findmnt -n -o OPTIONS "$mp")"; done < <(printf '%s
' /tmp /var/tmp /dev/shm)

I keep the shell layer thin and obvious, then let the actual host commands produce the evidence. That gives me checks that fail closed and leave obvious findings behind with far less operational risk than a giant opaque script.

The concrete evidence I want to preserve usually comes from find, stat, chmod, sysctl, and baseline files under /etc. If a tool says a control is healthy, I want the line, path, or command output that justified that statement right next to it.

The Bash habit worth keeping

Use strict defaults, name the files and services you touch, and make inconclusive checks visible. Bash is still a strong security tool when it behaves like a disciplined operator note rather than a magic trick.