I am working on building some new CentOs 6 servers and creating documentation for the installation of said servers. I would like to create a base CentOS 6 server install that would be light on the packages to reduce bloat by default. Additionally, I am looking for some common or industry practices in which to harden the server so that it can be used in production and online facing to the world. I am curious if there are any best practice guides, techniques, or steps that you use in performing such a task? Later, I would look at adding servers and sections to the documentation about using the server for web serving, database hosting, etc. For now, I am looking for a base server install.

3 Answers 3


The US National Security Agency (NSA) provides guides for hardening Linux and other operating systems which may be of some help. Since CentOS is so similar to RedHat, you may be intrested in:

  • Thank you for the posting. Would I need to be worried about the differences between CentOS v5 and v6 since I am looking at CentOS v6?
    – John
    Jan 3, 2012 at 23:34
  • For the most part, no, don't be worried about the differences. Jan 4, 2012 at 0:33

The lightest install you can do will require Kickstart with the below option:

%packages --nobase

You will need to experiment to figure out what packages you will explicitly want to include after that. At minimum you'll probably want to include these just to get started.

%packages --nobase

Regarding a secure/hardended install, DISA provides STIGs for Linux. It's hard to navigate, but it's out there... I hate linking, but it's too much to copy/paste here. Check this for a Kickstart with DISA STIGs. https://nazar.karan.org/cgit/bluecain/tree/ (secure-kickstart.cfg)

  • +1 for the secure-kickstart.cfg Jan 4, 2012 at 0:14

The bastille package helps you to harden your host step by step by asking questions and letting you make choices. It provides information about every step, so educating the user is a goal of the project, too.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .