WARNING: Run these commands on a new system or in a test environment first. Some steps are disruptive. Always have backups and console access.

#1 Mindset: You are the administrator. Understand what each command does.

# View this command's manual before running it
man [command_name]

1. 1 Update & Minimize:

   # Debian/Ubuntu
   sudo apt update && sudo apt upgrade -y
   sudo apt autoremove --purge -y
   
   # RHEL/CentOS/Fedora
   sudo yum update -y
   sudo yum autoremove -y

2. 2 Create Your Admin User:

   sudo adduser sysadmin
   sudo usermod -aG sudo sysadmin  # Debian/Ubuntu
   # sudo usermod -aG wheel sysadmin # RHEL/CentOS

3. 3 Secure SSH (On Your Local Machine):

   ssh-keygen -t ed25519 -f ~/.ssh/server_access -C "sysadmin@$(hostname)"

4. 4 Copy Key & Lock SSH:

   # ON YOUR LOCAL MACHINE, copy the key to the server
   ssh-copy-id -i ~/.ssh/server_access.pub sysadmin@YOUR_SERVER_IP
   
   # SSH into the server as 'sysadmin', then run:
   sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
   sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
   sudo sed -i 's/^#*PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
   echo "AllowUsers sysadmin" | sudo tee -a /etc/ssh/sshd_config
   sudo systemctl reload sshd

5. 5 Setup Firewall (UFW):

   sudo ufw --force enable
   sudo ufw default deny incoming
   sudo ufw default allow outgoing
   sudo ufw allow 22/tcp comment 'SSH'  # CHANGE PORT if you modified SSH
   sudo ufw status verbose

6. 6 Harden Password Policy:

   # Install password quality module
   sudo apt install libpam-pwquality -y  # Debian/Ubuntu
   # sudo yum install libpwquality -y    # RHEL/CentOS
   
   # Edit PAM config (might differ slightly by distro)
   echo "password requisite pam_pwquality.so retry=3 minlen=12 difok=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1" | sudo tee -a /etc/pam.d/common-password
   sudo sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   90/' /etc/login.defs
   sudo sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS   7/' /etc/login.defs
   sudo sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE   14/' /etc/login.defs

7. 7 Enable Automatic Security Updates:

   # Debian/Ubuntu
   sudo apt install unattended-upgrades -y
   sudo dpkg-reconfigure --priority=low unattended-upgrades
   
   # RHEL/CentOS 8+
   sudo dnf install dnf-automatic -y
   sudo sed -i 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
   sudo systemctl enable --now dnf-automatic.timer

8. 8 Secure Shared Memory:

   echo "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" | sudo tee -a /etc/fstab

9. 9 Disable Vulnerable Services:

   sudo systemctl disable --now avahi-daemon cups bluetooth

10. 10 Install & Configure Auditd:

    sudo apt install auditd -y  # or sudo yum install audit
    sudo systemctl enable --now auditd
    # Add a rule to monitor sudo commands
    echo "-w /var/log/auth.log -p wa -k sudo_log" | sudo tee -a /etc/audit/rules.d/sudo.rules
    sudo auditctl -R /etc/audit/rules.d/sudo.rules

11. 11 Install Intrusion Detection (AIDE):

    sudo apt install aide -y  # or sudo yum install aide
    sudo aideinit
    sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
    # Create a daily check cron job
    echo "0 2 * * * /usr/bin/aide --check" | sudo crontab -

12. 12 Check for Listening Ports:

    sudo ss -tulpn | grep LISTEN

13. 13 Review Sudo Logs:

    sudo grep -E 'COMMAND' /var/log/auth.log | tail -20

14. 14 Kernel Hardening (sysctl):

    # Add to /etc/sysctl.conf
    echo "
    # IP Spoofing protection
    net.ipv4.conf.all.rp_filter = 1
    net.ipv4.conf.default.rp_filter = 1
    
    # Ignore ICMP redirects
    net.ipv4.conf.all.accept_redirects = 0
    net.ipv6.conf.all.accept_redirects = 0
    
    # Log Martian packets
    net.ipv4.conf.all.log_martians = 1
    
    # Ignore send redirects
    net.ipv4.conf.all.send_redirects = 0
    
    # Restrict core dumps
    fs.suid_dumpable = 0
    " | sudo tee -a /etc/sysctl.conf
    sudo sysctl -p

15. 15 Install & Run Security Scanner:

    curl -L https://github.com/CISOfy/lynis/archive/master.tar.gz | tar xz
    cd lynis-master/
    sudo ./lynis audit system --quick

16. 16 Mandatory Access Control (AppArmor):

    # Ubuntu/Debian
    sudo apt install apparmor apparmor-profiles -y
    sudo systemctl enable apparmor
    sudo aa-enforce /etc/apparmor.d/*
    
    # RHEL/CentOS (SELinux)
    sudo yum install policycoreutils-python-utils -y
    sudo setenforce 1
    sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

17. Test Your Firewall From External Host:

nmap -sS -p- YOUR_SERVER_IP  # Run from another machine

18. Create Your Personal Command Log:

echo "# $(date) - Server Hardening Complete" >> ~/server_hardening.log
history | tail -50 >> ~/server_hardening.log

19. THE MOST IMPORTANT COMMAND:

sudo reboot

---