Show HN: Lockdown.sh Simple shell script for locking down new linux installs

> [top of readme] lockdown a newly installed linux os

> [bottom of readme] Supported OS: Debian

Not all Linux is Debian or a Debian derivative.

> Remounts /tmp /proc /dev /run to be more restrictive

Unfortunately it only appears to remount, which will not persist across reboots (unless I’m missing something).

> Restrict access to compilers

Is this actually meaningful from a security perspective? If one can get some source onto a machine and execute a compiler and then execute that binary, how is that substantially different than them just getting a binary onto the machine and executing that instead?

    # Add legal banner
    echo "
    Unauthorized access to this server is prohibited.
    Legal action will be taken. Disconnect now.
    " > /etc/issue

Heh.

We already have sensible OS level and app level baselines in CIS workbenches. There's also code to apply the policies and check the policies. It's nice that this is an attempt to set some kind of sanity in a single shell script but unless the author is a known quantity expert in this area, it's not a good idea to use this, unless you are also capable of vetting this code, in which case you probably don't need it.

Wow nice! This will be useful both for expert users who can go through and learn about various security options and apply manually, but also useful for non-expert users who can just run the script.

This is a reasonable jumping off point for someone newly interested in hardening a bare-metal Debian deployment. [1,2] are also quite good.

[1] https://github.com/Whonix/security-misc

[2] https://forums.whonix.org/t/fixing-the-desktop-linux-securit...

Would love to see this as an interactive informing and asking leaving you with the parts you want.