RHEL CIS Benchmark Compliance/Remediation Script
Budget / Salary$30–250
TypeFreelance project
LocationRemote
Posted3 hours ago
Project: RHEL 8/9/10 CIS Benchmark Compliance & Remediation Script
I’m looking for an experienced Linux security engineer to develop a CIS Benchmark compliance script for Red Hat Enterprise Linux (RHEL) 8, 9, and 10.
Project Requirements
The solution should be a modular Bash-based compliance and remediation framework that can audit and harden RHEL systems according to the applicable CIS RHEL Benchmark.
The script must support:
- RHEL 8, 9, and 10
- Detection of the RHEL version and execution of the appropriate controls
- Running all controls or selecting specific controls
- Ability to apply or skip individual controls
- A clear configuration file or command-line options to enable/disable controls
- Safe execution with appropriate error handling
- Logging of every action and its result
- Ability to run in audit/check-only mode without making changes
- Ability to run in remediation mode and apply the required changes
- Backup of important configuration files before modification where appropriate
- Idempotent controls, so running the script multiple times does not unnecessarily modify the system
Control Documentation
Every CIS control implemented in the script must have a clear description containing:
1. CIS Control ID
2. Control title
3. Description – what the control is intended to achieve
4. Current configuration/check – what the script checks
5. Remediation – what the script changes when remediation is enabled
6. Security effect/impact – how the change improves security
7. Potential operational impact – what services, applications, or functionality could potentially be affected
8. Rollback information, where applicable
For example:
«Control: Configure SSH settings
Description: Verifies that SSH is configured according to the applicable CIS requirements.
Action: Updates the relevant SSH configuration parameters when remediation is enabled.
Security Effect: Reduces the risk associated with insecure SSH configuration.
Operational Impact: Some older SSH clients or applications may no longer be able to connect if they depend on deprecated algorithms or authentication methods.»
Control Selection
I need the ability to execute the script in different ways, for example:
./cis-rhel.sh --audit
./cis-rhel.sh --remediate
./cis-rhel.sh --control 1.1.1
./cis-rhel.sh --skip 1.1.1,5.2.1
./cis-rhel.sh --remediate --skip 5.2.1
The exact command-line interface can be proposed by the developer, but it must be possible to selectively execute or skip controls.
Compliance Results / Reporting
A separate audit/reporting function or script is also required.
It should be able to run against the system and produce a clear report showing:
- CIS control ID
- Control description
- Expected configuration
- Actual configuration
- PASS / FAIL / NOT APPLICABLE / SKIPPED
- Remediation status
- Date/time of the check
- RHEL version
- Hostname
- Any relevant error or warning
The report should preferably be available in human-readable HTML/text format, with an option for CSV or JSON if practical.
Example:
CIS RHEL Compliance Report
Host: rhel-server01
OS: RHEL 9
Date: 2026-08-15
Control Status Description
----------------------------------------------------------
1.1.1 PASS Filesystem configuration
1.2.1 FAIL Package management configuration
2.1.1 PASS Service configuration
5.2.1 SKIPPED SSH configuration
6.1.1 PASS User and group configuration
Important Requirements
The implementation should not blindly modify the server. Each remediation should be clearly documented and designed to minimize the possibility of breaking existing applications or services.
The solution should also distinguish between:
- Controls that can be fully automated
- Controls requiring manual verification
- Controls that are not applicable to a particular system
- Controls intentionally skipped by the administrator
The implementation should follow the applicable CIS Benchmark version for each RHEL release, rather than assuming that the same settings apply identically to RHEL 8, 9, and 10.
Deliverables
1. Main CIS remediation/audit script
2. Control definitions/configuration
3. Separate compliance/reporting functionality
4. Documentation for every implemented control
5. Installation and usage instructions
6. Example configuration showing how to enable/disable/skip controls
7. Sample audit and remediation reports
8. Testing results for RHEL 8, RHEL 9, and RHEL 10
9. Rollback/backup mechanism where applicable
The final solution should be maintainable and extensible, so additional CIS controls and future CIS Benchmark revisions can be added without rewriting the entire script.
Experience with RHEL, Bash, Linux hardening, CIS Benchmarks, SELinux, systemd, SSH, PAM, auditd, firewalld, sudo, filesystem permissions, and security compliance automation is highly preferred.
Please provide examples of similar Linux hardening or CIS compliance automation projects you have completed.
I’m looking for an experienced Linux security engineer to develop a CIS Benchmark compliance script for Red Hat Enterprise Linux (RHEL) 8, 9, and 10.
Project Requirements
The solution should be a modular Bash-based compliance and remediation framework that can audit and harden RHEL systems according to the applicable CIS RHEL Benchmark.
The script must support:
- RHEL 8, 9, and 10
- Detection of the RHEL version and execution of the appropriate controls
- Running all controls or selecting specific controls
- Ability to apply or skip individual controls
- A clear configuration file or command-line options to enable/disable controls
- Safe execution with appropriate error handling
- Logging of every action and its result
- Ability to run in audit/check-only mode without making changes
- Ability to run in remediation mode and apply the required changes
- Backup of important configuration files before modification where appropriate
- Idempotent controls, so running the script multiple times does not unnecessarily modify the system
Control Documentation
Every CIS control implemented in the script must have a clear description containing:
1. CIS Control ID
2. Control title
3. Description – what the control is intended to achieve
4. Current configuration/check – what the script checks
5. Remediation – what the script changes when remediation is enabled
6. Security effect/impact – how the change improves security
7. Potential operational impact – what services, applications, or functionality could potentially be affected
8. Rollback information, where applicable
For example:
«Control: Configure SSH settings
Description: Verifies that SSH is configured according to the applicable CIS requirements.
Action: Updates the relevant SSH configuration parameters when remediation is enabled.
Security Effect: Reduces the risk associated with insecure SSH configuration.
Operational Impact: Some older SSH clients or applications may no longer be able to connect if they depend on deprecated algorithms or authentication methods.»
Control Selection
I need the ability to execute the script in different ways, for example:
./cis-rhel.sh --audit
./cis-rhel.sh --remediate
./cis-rhel.sh --control 1.1.1
./cis-rhel.sh --skip 1.1.1,5.2.1
./cis-rhel.sh --remediate --skip 5.2.1
The exact command-line interface can be proposed by the developer, but it must be possible to selectively execute or skip controls.
Compliance Results / Reporting
A separate audit/reporting function or script is also required.
It should be able to run against the system and produce a clear report showing:
- CIS control ID
- Control description
- Expected configuration
- Actual configuration
- PASS / FAIL / NOT APPLICABLE / SKIPPED
- Remediation status
- Date/time of the check
- RHEL version
- Hostname
- Any relevant error or warning
The report should preferably be available in human-readable HTML/text format, with an option for CSV or JSON if practical.
Example:
CIS RHEL Compliance Report
Host: rhel-server01
OS: RHEL 9
Date: 2026-08-15
Control Status Description
----------------------------------------------------------
1.1.1 PASS Filesystem configuration
1.2.1 FAIL Package management configuration
2.1.1 PASS Service configuration
5.2.1 SKIPPED SSH configuration
6.1.1 PASS User and group configuration
Important Requirements
The implementation should not blindly modify the server. Each remediation should be clearly documented and designed to minimize the possibility of breaking existing applications or services.
The solution should also distinguish between:
- Controls that can be fully automated
- Controls requiring manual verification
- Controls that are not applicable to a particular system
- Controls intentionally skipped by the administrator
The implementation should follow the applicable CIS Benchmark version for each RHEL release, rather than assuming that the same settings apply identically to RHEL 8, 9, and 10.
Deliverables
1. Main CIS remediation/audit script
2. Control definitions/configuration
3. Separate compliance/reporting functionality
4. Documentation for every implemented control
5. Installation and usage instructions
6. Example configuration showing how to enable/disable/skip controls
7. Sample audit and remediation reports
8. Testing results for RHEL 8, RHEL 9, and RHEL 10
9. Rollback/backup mechanism where applicable
The final solution should be maintainable and extensible, so additional CIS controls and future CIS Benchmark revisions can be added without rewriting the entire script.
Experience with RHEL, Bash, Linux hardening, CIS Benchmarks, SELinux, systemd, SSH, PAM, auditd, firewalld, sudo, filesystem permissions, and security compliance automation is highly preferred.
Please provide examples of similar Linux hardening or CIS compliance automation projects you have completed.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.