Linux server hardening: SSH with FIDO2/YubiKey and CrowdSec

┌─────────────────────────────────────────────────────────────┐
│                  FIDO2 challenge-response                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   ┌──────────────┐       ┌──────────┐      ┌──────────────┐ │
│   │  SSH client  │       │  YubiKey │      │  SSH server  │ │
│   └──────┬───────┘       └────┬─────┘      └──────┬───────┘ │
│          │                    │                   │         │
│          │ Challenge (random) │                   │         │
│          │ ──────────────────>│                   │         │
│          │                    │  PIN / Touch      │         │
│          │                    │ ────────── (User) │         │
│          │                    │                   │         │
│          │ Signature(Chall.)  │                   │         │
│          │ <───────────────── │                   │         │
│          │                    │                   │         │
│          │ Challenge + sig.   │                   │         │
│          │ ──────────────────────────────────────>│         │
│          │                    │                   │         │
│          │                    │ Verify(PubKey,Sig)│         │
│          │                    │ ───────────────── │         │
│          │                    │                   │         │
│          │ Access granted     │                   │         │
│          │ <──────────────────────────────────────│         │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Install YubiKey Manager (Debian/Ubuntu)
sudo apt install yubikey-manager -y

# Set the FIDO2 PIN (default PIN is empty)
ykman fido access change-pin

# Check whether the YubiKey is detected
ykman fido info

Applications: FIDO2
    slots: 2
     pin: true
     pin retries: 3

# Generate a FIDO2 SSH key
ssh-keygen -t ed25519-sk -C "admin@server"

# Without touch (PIN only)
ssh-keygen -t ed25519-sk -O no-touch-required

# With a custom filename
ssh-keygen -t ed25519-sk -f ~/.ssh/id_yubikey -C "admin@server"

# Transfer the public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519-sk.pub user@server

# Manual installation
cat ~/.ssh/id_ed25519-sk.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Check the installed key
cat ~/.ssh/authorized_keys | grep "sk@"

sudo nano /etc/ssh/sshd_config

# Allow FIDO2 keys (default: yes)
PubkeyAuthentication yes

# Allow SSH keys only (disable passwords)
PasswordAuthentication no

# Forbid root login
PermitRootLogin no

# Maximum of 3 authentication attempts
MaxAuthTries 3

# Cap grace time at 30 seconds
LoginGraceTime 30

# Minimise information disclosure
DebianBanner no
Banner none

# Keepalive for long-running sessions
ClientAliveInterval 300
ClientAliveCountMax 2

# Accept only verified FIDO2 keys
PubkeyAuthOptions verify-required

sudo systemctl restart sshd

# Login with the FIDO2 key
ssh -i ~/.ssh/id_ed25519-sk user@server

# Check which method was used
ssh -v user@server 2>&1 | grep "Offering"

# Generate the CA key pair
sudo mkdir -p /etc/ssh/ca
sudo ssh-keygen -t ed25519 -f /etc/ssh/ca/server-ca -C "SSH CA"

# On every server: register the CA public key as a TrustedKey
echo "cert-authority $(cat /etc/ssh/ca/server-ca.pub)" >> /etc/ssh/authorized_keys.d/trusted-ca

# Sign the FIDO2 key (creates a certificate)
sudo ssh-keygen -s /etc/ssh/ca/server-ca \
    -I "admin-fido2" \
    -n admin \
    -V +52w \
    ~/.ssh/id_ed25519-sk.pub

# Server definition with FIDO2 key
Host server
    HostName 192.168.1.100
    User admin
    IdentityFile ~/.ssh/id_ed25519-sk
    IdentitiesOnly yes

# Jump host for internal servers
Host internal-server
    HostName 10.0.0.50
    User admin
    ProxyJump server
    IdentityFile ~/.ssh/id_ed25519-sk
    IdentitiesOnly yes

# Start ssh-agent (optional for FIDO2)
eval $(ssh-agent -s)

# Add the key (touch is requested on every login)
ssh-add ~/.ssh/id_ed25519-sk

# Check whether FIDO2 is supported on the SSH server
ssh -V  # OpenSSH_8.9 or higher

# Check the server configuration
sudo sshd -T | grep pubkeyauth

# ssh-agent is running and trying to sign the key
# Fix: specify the key explicitly or disable the agent
ssh -i ~/.ssh/id_ed25519-sk user@server

# Check whether the YubiKey is detected
lsusb | grep Yubico

# Check whether the FIDO2 module is loaded
ls /dev/hidraw*

# Set or reset the FIDO2 PIN manually
ykman fido access change-pin

# Check logs
journalctl -u sshd -f

# Recognise successful FIDO2 logins
journalctl -u sshd | grep "Accepted publickey"

# Add the repository (Debian/Ubuntu)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash

# Install CrowdSec
sudo apt install crowdsec -y

# Bouncer for nftables/iptables
sudo apt install crowdsec-firewall-bouncer-nftables -y

sudo systemctl status crowdsec
sudo systemctl status crowdsec-firewall-bouncer

● crowdsec.service - CrowdSec SIEM
     Loaded: loaded (/lib/systemd/system/crowdsec.service; enabled)
     Active: active (running) since Mon 2026-08-26 12:00:00 UTC

sudo cscli decisions list

sudo cscli scenarios list

sudo nano /etc/crowdsec/scenarios/custom-ssh-aggressive.yaml

type: leak
name: ssh-aggressive-scan
description: "Aggressive SSH scans with many failed logins"
labels:
  service: ssh
  remediation: true
filter:
  LABELS.service == "ssh" && MSG.ContainerName == "sshd"
groupby: LABELS.source_ip
capacity: 5
leakspeed: 1m
blackhole: 1m
certainty: 75
for: 10m

# Reload scenarios
sudo cscli scenarios list | grep custom

# Simulate a test scenario
sudo cscli scenarios install --local /etc/crowdsec/scenarios/custom-ssh-aggressive.yaml

# Check whether the bouncer is active
sudo cscli bouncers list

Name       │ IP Address │ Valid Until │ Type
───────────┼────────────┼─────────────┼──────
firewall   │ 127.0.0.1  │ 2027-01-01  │ nftables

# Check the CrowdSec chain in nftables
sudo nft list chain inet crowdsec-crowdsec-block

table inet crowdsec-crowdsec {
    chain crowdsec-block {
        type filter hook input priority filter; policy accept;
        ip saddr @crowdsec-blacklist-jump drop
        ip6 saddr @crowdsec-blacklist6-jump drop
    }
}

sudo nano /etc/crowdsec/parsers/s02-enrich/whitelist.yaml

filter: "Meta.IP != ''"
whitelist:
  reason: "Local address"
  expression: "Ip('127.0.0.1') || Ip('::1')"
  expression: "Ip('192.168.0.0/16')"
  expression: "Ip('10.0.0.0/8')"

# Whitelist a single IP
sudo cscli decisions add --ip 192.168.1.100 --duration 0 --type whitelist --reason "Monitoring"

# Whitelist an IP range
sudo cscli decisions add --range 192.168.1.0/24 --duration 0 --type whitelist --reason "Local network"

# Show dashboard credentials
sudo cscli console status

# Check the metrics endpoint
curl -s http://localhost:6060/metrics | head -20

# Important metrics
crowdsec_decisions_total{source_ip="...",scenario="..."}
crowdsec_alerts_total{scenario="..."}
crowdsec_bouncers_total{type="..."}

sudo nano /etc/crowdsec/notifications/email.yaml

type: email
name: email_default
log_level: info
 # Email configuration
smtp_host: "smtp.example.com"
smtp_port: 587
smtp_username: "alert@example.com"
smtp_password: "YOUR_PASSWORD"
smtp_from: "crowdsec@example.com"
smtp_to:
  - "admin@example.com"
smtp_subject: "CrowdSec Alert: {scenario}"
format: |
  CrowdSec detected an attack.
  Scenario: {scenario}
  Source IP: {source_ip}
  Decision: {decision}
  Time: {created_at}

# Check notifications
sudo cscli notifications list

# Send a test notification
sudo cscli alert inspect --id 1

┌─────────────────────────────────────────────────────────────┐
│              CrowdSec multi-server architecture             │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   ┌─────────┐        ┌─────────┐        ┌─────────┐         │
│   │ Server1 │        │ Server2 │        │ Server3 │         │
│   │ Agent   │        │ Agent   │        │ Agent   │         │
│   └────┬────┘        └────┬────┘        └────┬────┘         │
│        │                  │                  │              │
│        ▼                  ▼                  ▼              │
│   ┌─────────────────────────────────────────────────────┐   │
│   │                Local API (central)                  │   │
│   │                http://central:8080                  │   │
│   └──────────────────────────┬──────────────────────────┘   │
│                              │                              │
│                              ▼                              │
│   ┌─────────────────────────────────────────────────────┐   │
│   │                 Community database                  │   │
│   │                 (shared decisions)                  │   │
│   └─────────────────────────────────────────────────────┘   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

sudo nano /etc/crowdsec/config.yaml

api:
  client:
    insecure_skip_verify: false
  server:
    listen_uri: http://127.0.0.1:8080

# Check logs
sudo journalctl -u crowdsec -f

# Common cause: port 8080 occupied
sudo ss -tulnp | grep 8080

# Check the bouncer API token
sudo cscli bouncers list

# Regenerate the token
sudo cscli bouncers add my-bouncer --auto

# Check the whitelist
sudo cscli decisions list --type whitelist

# Add the local IP to the whitelist
sudo cscli decisions add --ip 192.168.1.100 --duration 0 --type whitelist --reason "Own server"

# Check active decisions
sudo cscli decisions list

# Check the agent logs
sudo journalctl -u crowdsec | grep "decision"

sudo nano /etc/sysctl.d/99-hardening.conf

# Prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1

# Log martian packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Address space layout randomisation
kernel.randomize_va_space = 2

# Restrict dmesg (root only)
kernel.dmesg_restrict = 1

# Hide kernel pointers
kernel.kptr_restrict = 2

# Restrict BPF
kernel.unprivileged_bpf_disabled = 1

# Restrict user namespaces (for containers)
kernel.unprivileged_userns_clone = 0

# Prevent loading further modules (after boot)
kernel.modules_disabled = 1

sudo sysctl -p /etc/sysctl.d/99-hardening.conf

# Check whether parameters are set
sysctl net.ipv4.conf.all.rp_filter
sysctl kernel.randomize_va_space

net.ipv4.conf.all.rp_filter = 1
kernel.randomize_va_space = 2

# /tmp is often already a tmpfs; check with:
mount | grep tmp

# Put this in /etc/fstab (with a separate /tmp partition)
# UUID=... /tmp ext4 defaults,noexec,nosuid,nodev 0 2

# Lock down critical directories
sudo chmod 700 /root
sudo chmod 600 /etc/shadow
sudo chmod 600 /etc/gshadow
sudo chmod 644 /etc/passwd
sudo chmod 644 /etc/group

# SSH directory
sudo chmod 700 /root/.ssh
sudo chmod 600 /root/.ssh/authorized_keys

# Check SUID bits on standard tools
find / -perm -4000 -type f 2>/dev/null

# Only if the programs do not need to be SUID
sudo chmod u-s /usr/bin/newgrp
sudo chmod u-s /usr/bin/chsh
sudo chmod u-s /usr/bin/chfn

# Show every running service
systemctl list-units --type=service --state=running

# Services often unnecessary on a server
systemctl list-units --type=service --state=running | grep -E "cups|bluetooth|avahi|modem"

# Printer service (not needed on a server)
sudo systemctl stop cups
sudo systemctl disable cups
sudo systemctl mask cups

# Bluetooth (not needed on a server)
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
sudo systemctl mask bluetooth

# mDNS/Avahi (service discovery — unnecessary on a server)
sudo systemctl stop avahi-daemon
sudo systemctl disable avahi-daemon
sudo systemctl mask avahi-daemon

# Show the security score for a service
systemd-analyze security sshd.service

→ Overall exposure level for sshd.service: 9.6 OK

sudo apt install auditd -y
sudo systemctl enable auditd

# Watch the SSH configuration
sudo auditctl -w /etc/ssh/sshd_config -p wa -k sshd_config

# Watch authorized_keys
sudo auditctl -w /root/.ssh/authorized_keys -p wa -k ssh_keys

# Watch the sudo configuration
sudo auditctl -w /etc/sudoers -p wa -k sudoers
sudo auditctl -w /etc/sudoers.d/ -p wa -k sudoers

# Watch crontab
sudo auditctl -w /etc/crontab -p wa -k cron
sudo auditctl -w /var/spool/cron/ -p wa -k cron

sudo nano /etc/audit/rules.d/hardening.rules

# SSH
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /root/.ssh/authorized_keys -p wa -k ssh_keys

# Sudo
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers

# Cron
-w /etc/crontab -p wa -k cron
-w /var/spool/cron/ -p wa -k cron

# User changes
-w /etc/passwd -p wa -k user_change
-w /etc/shadow -p wa -k user_change
-w /etc/group -p wa -k group_change

# List rules
sudo auditctl -l

# Search audits for a key
sudo ausearch -k sshd_config --interpret

# Create an audit report
sudo aureport --auth

sudo apt install aide -y

# Initialise the database
sudo aideinit

# Move the new database into place
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

sudo nano /etc/cron.d/aide-check

# Daily check at 03:00
0 3 * * * root /usr/bin/aide --check | mail -s "AIDE Report" admin@example.com

# Run a manual check
sudo aide --check

# Expected output on a clean system:
# AIDE found NO differences between database and filesystem.

# Install automatic updates and the restart checker
sudo apt install unattended-upgrades needrestart -y

# Activate the configuration
sudo dpkg-reconfigure -plow unattended-upgrades

// Install security updates automatically only
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

// Automatically remove orphaned dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Automatic reboot on kernel updates at 04:00
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

# Dry run without changes
sudo unattended-upgrade --dry-run --debug

sudo aa-status

apparmor module is loaded.
XX profiles are in enforce mode.
0 processes are unconfined but have a profile defined.

# Activate profiles and enforce them strictly
sudo apt install apparmor-utils -y
sudo aa-enforce /etc/apparmor.d/*

# Show current tables
sudo nft list ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        # Rules here
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
    }
    chain output {
        type filter hook output priority filter; policy accept;
    }
}

sudo nano /etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        # Allow established connections
        ct state established,related accept

        # Allow loopback
        iif lo accept

        # Allow ICMP (ping)
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        # Allow SSH (port 22)
        tcp dport 22 accept

        # Allow HTTP/HTTPS (if a web server)
        tcp dport { 80, 443 } accept

        # Logging for dropped traffic
        log prefix "nft-drop: " counter drop
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

sudo systemctl enable nftables
sudo systemctl start nftables

# SSH rate limit: at most 5 connections per minute
sudo nft add rule inet filter input tcp dport 22 meter ssh-rate { limit rate 5/minute burst 5 packets } accept

# Check active rules
sudo nft list ruleset

# Check connections
sudo ss -tulnp | grep -E "22|80|443"

# Check drops in the logs
sudo journalctl -k | grep "nft-drop"

# Show CrowdSec-specific chains
sudo nft list chain inet crowdsec-crowdsec-block

table inet crowdsec-crowdsec {
    chain crowdsec-block {
        type filter hook input priority filter; policy accept;
        ip saddr @crowdsec-blacklist-jump drop
        ip6 saddr @crowdsec-blacklist6-jump drop
    }
}

┌─────────────────────────────────────────────────────────────┐
│                    Firewall traffic flow                    │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│   [Inbound traffic]                                         │
│          │                                                  │
│          ▼                                                  │
│   ┌──────────────────┐                                      │
│   │  CrowdSec check  │  ◀── Whitelist? ──▶ ACCEPT           │
│   │  (blacklist)     │  ◀── Ban? ────────▶ DROP + LOG       │
│   └────────┬─────────┘                                      │
│            │                                                │
│            ▼                                                │
│   ┌──────────────────┐                                      │
│   │  Firewall rules  │  ◀── SSH/HTTP ────▶ ACCEPT           │
│   │  (nftables)      │  ◀── Rest ────────▶ DROP             │
│   └────────┬─────────┘                                      │
│            │                                                │
│            ▼                                                │
│   ┌──────────────────┐                                      │
│   │  CrowdSec agent  │  ◀── Analyse logs                    │
│   │  (log analysis)  │  ◀── Create decisions                │
│   └──────────────────┘                                      │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Install Certbot
sudo apt install certbot -y

# Request a certificate (Nginx)
sudo certbot --nginx -d example.com

# Request a certificate (Apache)
sudo certbot --apache -d example.com

sudo nano /etc/nginx/snippets/ssl-params.conf

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;

# Security headers
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options DENY always;

# Cron job for automatic renewal
sudo crontab -e

# Daily at 02:30, renew the certificate if needed
30 2 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

# Test the TLS configuration
openssl s_client -connect example.com:443 -tls1_3

# Check certificate details
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

sudo apt install unbound -y

sudo nano /etc/unbound/unbound.conf.d/hardening.conf

server:
    interface: 127.0.0.1
    access-control: 127.0.0.0/8 allow

    # Enable DNSSEC
    auto-trust-anchor-file: /var/lib/unbound/root.key

    # Privacy
    hide-identity: yes
    hide-version: yes

    # Performance
    msg-cache-slabs: 8
    rrset-cache-slabs: 8
    infra-cache-slabs: 8
    key-cache-slabs: 8

forward-zone:
    name: "."
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 9.9.9.9@853#dns.quad9.net
    forward-tls-upstream: yes

sudo systemctl enable unbound
sudo systemctl start unbound

# Test DNS resolution
dig example.com @127.0.0.1

# DNSSEC test
dig dnssec-failed.org @127.0.0.1
# Expectation: SERVFAIL (DNSSEC breaker recognised correctly)

# Test DNS-over-HTTPS
curl -v https://cloudflare-dns.com/dns-query?name=example.com 2>&1 | grep "HTTP/2"

mkdir -p ~/ansible-hardening/{roles,inventory,group_vars}

nano ~/ansible-hardening/inventory/hosts.ini

[production]
server1 ansible_host=192.168.1.100
server2 ansible_host=192.168.1.101

[homelab]
server3 ansible_host=192.168.10.50

[all:vars]
ansible_user=admin
ansible_python_interpreter=/usr/bin/python3

nano ~/ansible-hardening/hardening.yml

---
- name: Linux server hardening
  hosts: all
  become: yes
  vars:
    ssh_port: 22
    allowed_users:
      - admin
    enable_crowdsec: true
    enable_aide: true

  tasks:
    # System updates
    - name: Update the system
      apt:
        update_cache: yes
        upgrade: dist

    # SSH hardening
    - name: Harden SSH configuration
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      loop:
        - { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication no' }
        - { regexp: '^#?MaxAuthTries', line: 'MaxAuthTries 3' }
        - { regexp: '^#?LoginGraceTime', line: 'LoginGraceTime 30' }
      notify: restart sshd

    # Sysctl hardening
    - name: Set sysctl parameters
      sysctl:
        name: "{{ item.name }}"
        value: "{{ item.value }}"
        state: present
        reload: yes
      loop:
        - { name: 'net.ipv4.conf.all.rp_filter', value: '1' }
        - { name: 'net.ipv4.conf.all.accept_redirects', value: '0' }
        - { name: 'kernel.randomize_va_space', value: '2' }
        - { name: 'kernel.dmesg_restrict', value: '1' }

    # Unnecessary services
    - name: Disable unnecessary services
      systemd:
        name: "{{ item }}"
        state: stopped
        enabled: no
        masked: yes
      loop:
        - cups
        - bluetooth
        - avahi-daemon

    # Audit logging
    - name: Install auditd
      apt:
        name: auditd
        state: present

    - name: Deploy audit rules
      copy:
        src: files/audit-rules.rules
        dest: /etc/audit/rules.d/hardening.rules
      notify: restart auditd

  handlers:
    - name: restart sshd
      systemd:
        name: sshd
        state: restarted

    - name: restart auditd
      systemd:
        name: auditd
        state: restarted

cd ~/ansible-hardening
ansible-playbook -i inventory/hosts.ini hardening.yml

# Check whether every server is reachable
ansible all -i inventory/hosts.ini -m ping

# Check SSH configuration
ansible all -i inventory/hosts.ini -m shell -a "sshd -T | grep permitrootlogin"

server1 | CHANGED | rc=0 >>
permitrootlogin no

server2 | CHANGED | rc=0 >>
permitrootlogin no

sudo apt install libopenscap8 scap-security-guide -y

# Show available profiles
oscap info /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml | grep "Profile"

# CIS Level 1 scan
sudo oscap xccdf eval \
    --profile cis_level1_server \
    --results cis-results.xml \
    --report cis-report.html \
    /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

# Copy the report to the local machine and open it
scp admin@server:/tmp/cis-report.html ~/Desktop/

# Only if you understand the impact
sudo oscap xccdf generate fix \
    --profile cis_level1_server \
    --fix-type ansible \
    --output cis-remediation.yml \
    /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

# Check the score
oscap xccdf generate report cis-results.xml > /dev/null
grep -E "score|pass|fail" cis-results.xml | tail -10