Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Security Hardening Using FABRIC: Implementing a Unified Compliance Aggregator for Linux Servers

Sheldon Paul, Izzat Alsmadi

TL;DR

Addressing fragmented Linux security assessments, the paper introduces the Unified Compliance Aggregator (UCA) to unify outputs from Lynis, OpenSCAP, and AIDE on the FABRIC testbed. UCA normalizes disparate metrics, applies a weighted aggregate, and supports a custom rule engine for organization-specific policies. Through 108 audits on three Ubuntu 22.04 nodes at baseline, partial, and full hardening, the study shows OpenSCAP compliance and custom rule compliance rise markedly with stronger hardening, while Lynis and AIDE reflect complementary dimensions. The work demonstrates that open-source, reproducible aggregation can provide clearer, more actionable security posture assessments in programmable testbeds, enabling systematic evaluation of hardening strategies.

Abstract

This paper presents a unified framework for evaluating Linux security hardening on the FABRIC testbed through aggregation of heterogeneous security auditing tools. We deploy three Ubuntu 22.04 nodes configured at baseline, partial, and full hardening levels, and evaluate them using Lynis, OpenSCAP, and AIDE across 108 audit runs. To address the lack of a consistent interpretation across tools, we implement a Unified Compliance Aggregator (UCA) that parses tool outputs, normalizes scores to a common 0--100 scale, and combines them into a weighted metric augmented by a customizable rule engine for organization-specific security policies. Experimental results show that full hardening increases OpenSCAP compliance from 39.7 to 71.8, while custom rule compliance improves from 39.3\% to 83.6\%. The results demonstrate that UCA provides a clearer and more reproducible assessment of security posture than individual tools alone, enabling systematic evaluation of hardening effectiveness in programmable testbed environments.

Security Hardening Using FABRIC: Implementing a Unified Compliance Aggregator for Linux Servers

TL;DR

Addressing fragmented Linux security assessments, the paper introduces the Unified Compliance Aggregator (UCA) to unify outputs from Lynis, OpenSCAP, and AIDE on the FABRIC testbed. UCA normalizes disparate metrics, applies a weighted aggregate, and supports a custom rule engine for organization-specific policies. Through 108 audits on three Ubuntu 22.04 nodes at baseline, partial, and full hardening, the study shows OpenSCAP compliance and custom rule compliance rise markedly with stronger hardening, while Lynis and AIDE reflect complementary dimensions. The work demonstrates that open-source, reproducible aggregation can provide clearer, more actionable security posture assessments in programmable testbeds, enabling systematic evaluation of hardening strategies.

Abstract

This paper presents a unified framework for evaluating Linux security hardening on the FABRIC testbed through aggregation of heterogeneous security auditing tools. We deploy three Ubuntu 22.04 nodes configured at baseline, partial, and full hardening levels, and evaluate them using Lynis, OpenSCAP, and AIDE across 108 audit runs. To address the lack of a consistent interpretation across tools, we implement a Unified Compliance Aggregator (UCA) that parses tool outputs, normalizes scores to a common 0--100 scale, and combines them into a weighted metric augmented by a customizable rule engine for organization-specific security policies. Experimental results show that full hardening increases OpenSCAP compliance from 39.7 to 71.8, while custom rule compliance improves from 39.3\% to 83.6\%. The results demonstrate that UCA provides a clearer and more reproducible assessment of security posture than individual tools alone, enabling systematic evaluation of hardening effectiveness in programmable testbed environments.
Paper Structure (39 sections, 1 equation, 6 figures, 4 tables)

This paper contains 39 sections, 1 equation, 6 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Problem Statement
  3. Choice of Reference Architecture
  4. Contributions
  5. Related Work
  6. Security Metric Aggregation
  7. Linux Security Auditing Tools
  8. Lynis for System Hardening
  9. OpenSCAP for Compliance Validation
  10. Multi-Tool Integration and Aggregation
  11. Comparison to This Work
  12. System Architecture
  13. Overview
  14. Measurement Probes
  15. Metric Repository
  16. ...and 24 more sections

Figures (6)

  • Figure 1: High--level architecture of the Unified Compliance Aggregator.
  • Figure 2: Average Lynis, OpenSCAP and AIDE scores for baseline, partial and full nodes.
  • Figure 3: Progression of tool scores across hardening levels on the FABRIC nodes.
  • Figure 4: Standard UCA scores compared to extended UCA scores that include custom rule results.
  • Figure 5: Custom rule compliance scores for baseline, partial and full nodes.
  • ...and 1 more figures