Baseline Linux Hardening
SSH hardening drop-in, sysctl security profile, login banner, and time sync. Original, live-tested (Molecule) role.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-10 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o ansible-base-hardening-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/ansible-base-hardening/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle ansible-base-hardening-1.0.0.sigstore.json \
ansible-base-hardening-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "499ffcfb9c914592d7a00990f26ec560337266c87f282972040b07413566a3a0 ansible-base-hardening-1.0.0.tar.gz" | sha256sum -cDocumentation
base-hardening
Baseline Linux hardening as an idempotent Ansible role: an SSH hardening drop-in, a sysctl security profile, a login banner, and time sync (chrony). Original work — not derived from a third-party role.
Live-tested with Molecule + podman (converge + idempotence) on the Rocky Linux 10 image; supports EL 9/10, Ubuntu, and Debian.
License
Commercial — IaC Bazaar EULA. © IaC Bazaar.
Usage code & full reference unlock after purchase
The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.
- Variables
- Test