# Open-source Linux hardening

11 open-source Linux hardening rated against public privacy criteria.

1. [AppArmor](https://privacyratings.com/linux-hardening/apparmor/): B (80/100). A Linux kernel security module that confines programs with per-application profiles restricting file access, network access and capabilities. It is enabled by default on Ubuntu and Debian.
2. [ClamTk](https://privacyratings.com/linux-hardening/clamtk/): B (80/100). A graphical front end for the ClamAV antivirus engine that runs on-demand virus scans on Linux. The project is no longer maintained.
3. [Fail2Ban](https://privacyratings.com/linux-hardening/fail2ban/): B (80/100). A daemon that scans log files for repeated failed logins and other abuse, and bans the offending IP addresses through firewall rules for a set time.
4. [Firejail](https://privacyratings.com/linux-hardening/firejail/): B (80/100). Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.
5. [Lynis](https://privacyratings.com/linux-hardening/lynis/): B (80/100). A command-line security auditing tool from CISOfy that scans Linux, macOS and other Unix-like systems and suggests hardening steps.
6. [Rootkit Hunter](https://privacyratings.com/linux-hardening/rkhunter/): B (80/100). A shell-script scanner that checks Unix-like systems for rootkits, backdoors and local exploits by comparing file hashes and looking for suspicious files and settings. It has had no new release since version 1.4.6.
7. [Snort](https://privacyratings.com/linux-hardening/snort/): B (80/100). Open source intrusion prevention system capable of real-time traffic analysis and packet logging.
8. [SysWarden](https://privacyratings.com/linux-hardening/syswarden/): B (80/100). Open-source, host-local Linux security orchestrator combining nftables enforcement, system telemetry, threat-intelligence feeds, out-of-band WAAP log analysis and a terminal dashboard.
9. [USBGuard](https://privacyratings.com/linux-hardening/usbguard/): B (80/100). A Linux daemon that blocks or allows USB devices based on a policy of device attributes, protecting against rogue USB devices such as BadUSB.
10. [BleachBit](https://privacyratings.com/linux-hardening/bleachbit/): F (30/100). A disk cleaner that deletes caches, cookies, logs, temporary files and other traces left by applications, and can shred files and wipe free space.
11. [chkrootkit](https://privacyratings.com/linux-hardening/chkrootkit/): F (30/100). A set of shell scripts and small programs that locally check a Unix-like system for signs of known rootkits.

Source: https://privacyratings.com/open-source/linux-hardening/