Summary¶

To start with I used SSH to login to my fresh install of Linux Mint. I was able to perform all the analysis on the VM through SSH without and issue. When I started the hardening phase I ran into some issues, since I was trying to activate the firewall, mess with ports and SSH it was giving me issues through the SSH connection.

So, I ran the hardening scripts on my own local machine since I am using Linux Mint. I did not need to worry about breaking connection with my VM so the issues I had before were gone. I could just run the scripts locally and harden my own system.

After I hardened my own system it did not make sense to run the analysis again on my own computer, so I modified the analysis and helper scripts to be run locally instead of through SSH. I then got all the scripts onto my fresh Linux Mint OS, good thing I made a snapshot, then ran the baseline analysis, most importantly the health analysis report, then ran all the hardening scripts and then finally ran the health analysis script again so I could see how the health score had changed by running the hardening tools.

Baseline Health Analysis report¶

=================================
 Security Health Summary
=================================

Date: 2026-07-15T21:55:32+00:00
Hostname: mint-VM
Operating system: Linux Mint 22.3
Kernel: 6.14.0-37-generic

Security checks
---------------------------------
[FAIL] UFW firewall is installed but inactive.
[FAIL] Automatic security-update support is not installed.
[PASS] AppArmor is enabled in the kernel.
[PASS] AppArmor service is active.
[PASS] OpenSSH server is not installed.
[FAIL] Root filesystem encryption was not detected.
[WARN] System is using Legacy BIOS; Secure Boot is unavailable.
[PASS] Only root has UID 0.
[PASS] No empty-password accounts were detected.
[FAIL] 385 package upgrades are pending.
[FAIL] 1 CPU vulnerability entries are reported as vulnerable.

Summary
---------------------------------
Passed:   5
Warnings: 1
Failed:   5
Health score: 45/100

Overall status: HARDENING REQUIRED

See the individual analysis reports for detailed evidence.

Health score from the baseline, clean fresh untouched Linux Mint was 45/100

The health score was checking things that the analysis scripts were analyzing, not necessarily a legit security “health” score.

Hardened Health Analysis report¶

=================================
 Security Health Summary
=================================

Date: 2026-07-15T22:40:39+00:00
Hostname: mint-VM
Operating system: Linux Mint 22.3
Kernel: 6.17.0-40-generic

Security checks
---------------------------------
[PASS] UFW firewall is active.
[PASS] Automatic unattended upgrades are enabled.
[PASS] AppArmor is enabled in the kernel.
[PASS] AppArmor service is active.
[WARN] SSH is listening on TCP port 22.
[PASS] SSH password authentication is disabled.
[PASS] Direct SSH root login is disabled.
[PASS] SSH empty passwords are prohibited.
[FAIL] Root filesystem encryption was not detected.
[WARN] System is using Legacy BIOS; Secure Boot is unavailable.
[PASS] Only root has UID 0.
[PASS] No empty-password accounts were detected.
[PASS] No package upgrades are currently listed as pending.
[FAIL] 1 CPU vulnerability entries are reported as vulnerable.

Summary
---------------------------------
Passed:   10
Warnings: 2
Failed:   2
Health score: 71/100

Overall status: HARDENING REQUIRED

See the individual analysis reports for detailed evidence.

Health score after running hardening scripts went up to 71/100

The health score started at 45/100 before doing anything, this is the health score given to a clean fresh Linux Mint. After running the hardening scripts the health score jumped up to 71/100. There are still things that could be hardened to make the system even more secure but at least the hardening scripts improved the security of the system.

In Conclusion¶

Analysis¶

I performed analyses by running 12 separate scripts getting status information and reports on:

AppArmor
Boot
CPU Vulenarability
Encryption
Firewall
Packages
Ports
Services
SSH
Updates
Users
Health score, which was basically a summary of all the other analyses

Hardenings¶

I ran 4 hardening scripts that were aimed at hardening the system and improve the health score. The scripts were:

Package upgrades (upgrade all packages that were outdated)
Configure Firewall (install if not present and activate ufw firewall with firewall rules)
Automatic security upgrades (run automatic security upgrades)
SSH (install SSH-server for SSH access, but only through public/private keys) - Installing SSH-server is not really a security upgrade but doing it this way was a secure way to install SSH-server
Extra - Not really an OS upgrade and did not affect the OS health score but created a gpg encryption wizard that users without knowledge of gpg can easily encrypt and decrypt files.

The hardening scripts were made to be wizards, guiding users through the configurations so it would be easier for non-tech savvy people to navigate. I also created the encryptionwizard tool that makes it easy to encrypt and decrypt files. This did not affect the health score but I think it did imporve the cyber awareness or cyber resilience for normal people. People can now easily run analysis on their own machines and see what is going on and they can also easily configure their system to be a bit more safe without having to know the actual commands behind the configurations.

Analysis and Hardening toolkit¶

Here is the full list of the Analysis and Hardening toolkit. it contains three helper scripts, 12 analysis scripts, 4 hardening scripts, and 1 encryption tool

analysis_hardening_toolkit
                        ├── analysis
                        │   ├── check_apparmor.sh
                        │   ├── check_boot.sh
                        │   ├── check_cpu.sh
                        │   ├── check_encryption.sh
                        │   ├── check_firewall.sh
                        │   ├── check_health.sh
                        │   ├── check_packages.sh
                        │   ├── check_ports.sh
                        │   ├── check_services.sh
                        │   ├── check_ssh.sh
                        │   ├── check_updates.sh
                        │   └── check_users.sh
                        ├── hardening
                        │   ├── apply_package_upgrades.sh
                        │   ├── configure_firewall.sh
                        │   ├── enable_automatic_security_updates.sh
                        │   ├── install_encryptionwizard.sh
                        │   └── setup_secure_ssh_server.sh
                        ├── lib
                        │   ├── analysis_common.sh
                        │   └── hardening_common.sh
                        ├── reports
                        │   ├── baseline
                        │   └── hardened
                        ├── run_all_analysis.sh
                        ├── run_analysis.sh
                        └── run_hardening.sh

7 directories, 22 files

Download the full Analysis and Hardening toolkit here

How to use the toolkit¶

To run a single analysis script you simply open a terminal in the toolkit folder and run for example ./run_analysis.sh analysis/check_boot.sh

To run all analysis scripts at the same time you run ./run_all_analysis.sh baseline to run baseline analysis before hardening, then you can run ./run_all_analysis.sh hardened to see how the analysis reports and health score changed.

The hardening scripts are run one at a time. To run a single hardening you run ./run_hardening.sh analysis/configure_firewall.sh and follow the wizard to finish the configuration/hardening.

To install the Encryption Wizard, you cd into the hardening folder and run ./install_encryptionwizard.sh, which installs shell aliases that let users open the encryption wizard and encrypt or decrypt files using simple commands such as encryptionwizard, encrypt, and decrypt, making it easier and more visual for people not used to gpg.

Future work¶

For the next spiral I want to run Lynis - Security auditing and hardening tool for Linux/Unix and use that to strengthen the security of the system. Lynis gives the system a security score, it would be interesting to run Lynis before and after using my toolkit, then run also run industry standard security upgrades such as listed here.