awesome-security-hardening: a curated list of hardening guides, benchmarks and tools

awesome-security-hardening (about 6,600 stars on GitHub) is a curated list of resources for hardening systems, started in 2019 by Philippe Lagadec (decalage2), who also maintains the oletools suite for analysing Office documents. It is a single README of links grouped by what you are trying to protect, each with a short description, and it continues to receive updates. Commitpedia lists it here in place of trimstray/the-book-of-secret-knowledge, the famous collection of sysadmin and security tools and one-liners with about 250,000 stars, which has not been updated since late 2024; that list is still worth reading, but this one is maintained.

How it is organised

• Security hardening guides and best practices: general guides, then sections for Linux distributions, Windows, macOS, network devices, virtualisation, containers and Kubernetes, and cloud providers.
• Benchmarks and standards: the CIS Benchmarks, DISA STIGs, the ANSSI and BSI guides, NIST publications and vendor hardening documents.
• Application and service hardening: web servers, databases, mail, SSH, DNS, Active Directory and authentication.
• Tools: auditing scripts such as Lynis, configuration scanners, compliance checkers and automated remediation playbooks.
• Books, training and related awesome lists for going deeper.

How to use it

Open the section for the system you are about to deploy, read the one or two primary guides it points to (usually a CIS Benchmark or a vendor document), and then use a tool from the tools section to check how far your configuration already matches. The list does not rank entries and does not rate their quality, so check the date and maintenance status of each linked resource. Because it is one Markdown file, searching it in the browser or in a local clone is the fastest way to find a topic:

git clone --depth 1 https://github.com/decalage2/awesome-security-hardening.git
grep -i "ssh" awesome-security-hardening/README.md

Credit

awesome-security-hardening is maintained by Philippe Lagadec and the contributors listed on GitHub, who propose additions through issues and pull requests. The repository does not carry a separate licence file; treat it as a directory of links to the original sources, each under its own terms.