A solid starting point for locking down Linux boxes with CIS-aligned configs. Covers the usual suspects: SSH hardening (no root login, key-based auth only), firewall rules via UFW or iptables, kernel parameter tweaks in sysctl, and auditd for tracking changes to sensitive files. The examples are copy-paste ready, which is helpful when you're setting up a new production server or trying to pass a compliance audit. It won't do everything for you, but it gives you the essential commands and config snippets in one place. Pair it with fail2ban and SELinux/AppArmor as suggested and you've got a reasonable baseline for most deployments.
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill linux-hardening