---
title: "Check server images against a hardening · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/servers/hardening-checklist
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check server images against a hardening checklist

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Servers](https://agentwranglers.se/playbook/infrastructure/servers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Servers](https://agentwranglers.se/playbook/infrastructure/servers)
- Rule: Scan every server image against a published hardening checklist, such as a CIS Benchmark or a DISA STIG profile. Fail the image build on any failed check without a written exception.
- How: Run a scanner that reads the checklist, such as OpenSCAP or the Ubuntu Security Guide. Pick one profile per kind of server, such as Level 1 Server. Apply the fixes in the image build or the configuration code, never by hand on a running server. Store the scan report with the image. Skip checks only through the scanner's tailoring file. Give every skipped check a reason, an owner and an end date, as [Let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions) requires.
- Check: Every image build runs the scan and keeps its report. The report shows 0 failed checks outside the exception list. Turn on SSH password logins in a test image, and the build fails.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# Ubuntu: audit against the CIS Level 1 Server profile. HTML and XML reports land in /var/lib/usg/.
sudo usg audit cis_level1_server
# Apply the profile's fixes in the image build, then audit again.
sudo usg fix cis_level1_server
```

## Sources

- [NIST SP 800-70 Rev. 5 National Checklist Program for IT Products](https://csrc.nist.gov/pubs/sp/800/70/r5/final)
- [Ubuntu Security Guide CIS compliance](https://ubuntu.com/security/certifications/docs/usg/cis/compliance)
- [Ubuntu Security Guide CIS audit](https://ubuntu.com/security/certifications/docs/usg/cis/audit)

## Related rules

- [Let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/servers/hardening-checklist">Agent Wranglers infrastructure playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Remove services the server does not need](https://agentwranglers.se/playbook/infrastructure/servers/minimal-services)
- [Servers](https://agentwranglers.se/playbook/infrastructure/servers)