Audit, harden, and monitor Linux servers — guided, automated, auditable.
hardbox is an open-source CLI toolkit that transforms Linux server hardening into a guided, auditable, and repeatable workflow. Audit your system against industry benchmarks, preview every change, apply hardening automatically, and roll back if needed — all from the command line.
21 hardening modules. 12 compliance profiles. 200+ checks. 7 Linux distros.
# Clone and build (requires Go 1.22+)
git clone https://github.com/jackby03/hardbox
cd hardbox
go build -o hardbox ./cmd/hardbox
sudo mv hardbox /usr/local/bin/
# Audit — no changes made
sudo hardbox audit --profile cis-level1 --format html -o audit.html
# Preview changes before applying
sudo hardbox apply --profile production --dry-run
# Apply hardening with rollback safety
sudo hardbox apply --profile production
# CI / headless mode
sudo hardbox apply --config /etc/hardbox/config.yaml --non-interactive
# Compare two audit reports, fail on regressions
hardbox diff before.json after.jsonSee the full command reference: hardbox --help
| Category | Capabilities |
|---|---|
| Hardening | 21 modules: SSH, firewall, kernel, users, filesystem, auditd, crypto, AppArmor/SELinux, NTP, updates, containers, boot, storage, integrity, malware, shells, processes, and more |
| Compliance | 12 built-in profiles: cis-level1, cis-level2, pci-dss, stig, hipaa, nist-800-53, iso27001, cloud-aws, cloud-gcp, cloud-azure, production, development |
| Safety | Dry-run mode, atomic file writes, one-command rollback, snapshot/restore |
| Reports | JSON, HTML, Markdown, Text, SARIF — CI/CD-friendly and human-readable |
| Operations | hardbox watch daemon, hardbox fleet multi-host over SSH, hardbox serve web dashboard, hardbox diff audit comparison |
| Integrations | Ansible role, Terraform provider, cloud-init templates, Slack/HTTP webhook alerts |
| Platforms | Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, Amazon Linux, Fedora |
| Extensibility | Plugin SDK for custom modules, YAML-based profiles with extends inheritance |
Full module reference:
docs/MODULES.md| Compliance mappings:docs/COMPLIANCE.md
| Version | What shipped |
|---|---|
| v0.4 ✅ | Core engine, 15 modules, 12 profiles, fleet, diff, serve, plugin SDK |
| v0.5 ✅ | Watch daemon, Slack/webhook alerts, SARIF export, profile inheritance, fleet dashboard, trend sparklines |
| v0.6 ✅ | 6 new modules (boot, storage, integrity, malware, shells, processes) — 21 total, all with remediation |
| v0.7 | 4 modules: hardware (USB/bluetooth), nameservices (DNS), webserver (Apache/nginx), databases (MySQL/PG) |
| v0.8 | Custom YAML checks, compliance PDFs, native .deb/.rpm, plugin SDK freeze, full docs |
| v1.0 | 300+ checks, 25+ modules, GA stable release |
Full roadmap with SaaS/enterprise deferrals: docs/ROADMAP.md
| Resource | Link |
|---|---|
| Contributing | CONTRIBUTING.md |
| Module development | docs/MODULES.md |
| Integrations (Ansible, Terraform, cloud-init) | docs/INTEGRATIONS.md |
| Watch daemon | docs/WATCH.md |
| Web dashboard | docs/SERVE.md |
| DevSecOps & CI | docs/DEVSECOPS.md |
| Changelog | CHANGELOG.md |
git clone https://github.com/jackby03/hardbox
cd hardbox
go mod download && go build ./...PRs welcome. See CONTRIBUTING.md and our Code of Conduct.
hardbox is free software licensed under AGPL v3.
For commercial use without AGPL obligations: jackby03@protonmail.com
Built for engineers who know that security is not a feature — it's a foundation.