konstruktoid Hardening

konstruktoid Hardening is a set of scripts that harden Ubuntu Server on systemd systems. It turns a fresh install into a locked-down baseline you can reuse as a reference image, applying secure defaults and disabling components that are not needed.

It configures UFW, auditd, sysctl, systemd, journald, resolved, logind, and timesyncd, and can disable selected kernel modules. SSH access, log rotation, and many other settings are exposed as editable values in a single ubuntu.cfg file, so the baseline is easy to tailor before applying.

It has been tested on Ubuntu 22.04 and 24.04, with a companion Ansible role for fleet rollouts and SLSA artifacts for checksum verification. Because it makes sweeping system changes, it is meant to be reviewed and tried in a non-production environment first.