Will it harden my server?

No. It only reads copied files and writes a report. You apply fixes.

What if I only have sshd_config?

SSH controls score; the rest SKIP. Total denominator only counts non-SKIP controls.

Is this CIS certified?

No. "CIS-style" means the themes match common CIS Linux recommendations.

Export enabled units with `systemctl list-unit-files --state=enabled > services`.

RHEL vs Debian PAM paths?

Drop whatever you have under `pam.d/` (common-password, system-auth, …) — both are recognized.

linux cis style config auditor

Example session with this skill installed

I copied /etc/ssh/sshd_config, sysctl, login.defs, pam.d, fstab, audit rules and systemctl list-unit-files --state=enabled from a VPS. How far off CIS-style hardening are we?

Read your context and instructions
Compiled the linux cis style

Answer: 0 / 14 (0%) — 11 FAIL, 0 PASS on the sample "bad host" dump.

SSH-1/2/3: PermitRootLogin yes, PasswordAuthentication yes, X11Forwarding yes, MaxAuthTries 10 → fix lines printed for each

SYSCTL-1/2: net.ipv4.ip_forward=1, syncookies off, ICMP redirects unset
LOGIN-1: PASS_MAX_DAYS 99999, PASS_MIN_DAYS 0
PAM-1/2: no pam_pwquality / pam_faillock in the password/auth stacks
AUDIT-1: audit.rules has no passwd/shadow/sudoers watches
FSTAB-1: /tmp and /dev/shm missing nodev,nosuid,noexec; /home missing nodev
SVC-1: telnet and avahi-daemon enabled

Deliverables: weighted score, PASS/FAIL/SKIP per control, a paste-ready fix: line for every FAIL, optional cis.md + JSON.

Next steps: apply the fix lines on a staging host, re-copy the configs, re-run until the score is acceptable. SKIP only means a file wasn't in the dump — not a pass. Not a certified CIS Benchmark assessment.

(Real run on bundled examples/host/.)

Connects securely to your tools. The creator never sees your data.

About this skill

A CIS-style hardening score from the config files you already copied off a host.

Drops in copies of sshd_config, sysctl.conf, login.defs, PAM stacks, audit rules, fstab and an enabled-services list. Returns PASS/FAIL/SKIP per control with a weighted score and a one-line fix for every FAIL. Covers SSH root/password, network sysctl, password aging, pam_pwquality/faillock, audit identity watches, fstab nodev/nosuid/noexec, and risky services (telnet, avahi, …).

Not a certified CIS Benchmark assessment — it's an agent-readable first pass.

What's included

SKILL.md, scripts/cislinux.py, sample "bad host" dump, references.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

linux cis style config auditor