Agent WranglersFor AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.
Recommended
Check server images against a hardening checklist
Scan every server image against a published hardening checklist, such as a CIS Benchmark or a DISA STIG profile. Fail the image build on any failed check without a written exception.
How to do it
Run a scanner that reads the checklist, such as OpenSCAP or the Ubuntu Security Guide. Pick one profile per kind of server, such as Level 1 Server. Apply the fixes in the image build or the configuration code, never by hand on a running server. Store the scan report with the image. Skip checks only through the scanner's tailoring file. Give every skipped check a reason, an owner and an end date, as Let every exception expire requires.
Examples
Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.
Shell example
# Ubuntu: audit against the CIS Level 1 Server profile. HTML and XML reports land in /var/lib/usg/.
sudo usg audit cis_level1_server
# Apply the profile's fixes in the image build, then audit again.
sudo usg fix cis_level1_serverHow to check
Every image build runs the scan and keeps its report. The report shows 0 failed checks outside the exception list. Turn on SSH password logins in a test image, and the build fails.
Sources
- NIST SP 800-70 Rev. 5 National Checklist Program for IT Products
- Ubuntu Security Guide CIS compliance
- Ubuntu Security Guide CIS audit
Related rules
- Let every exception expire in Infrastructure
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/servers/hardening-checklist">Agent Wranglers infrastructure playbook</a>. In code you write, add a comment next to it with the same link.