RCW IT Training← Back to catalogue
FREE TOOL • CIS BENCHMARK HARDENING • RUNS FROM WINDOWS

RCW-NixFort v1.0.0

Harden Linux servers to CIS Benchmark compliance from a Windows workstation. RCW-NixFort connects over SSH, auto-detects the distribution and version, audits 140+ controls, applies standards-based remediations with backups and one-command rollback — and exports a full hardening report. Single .exe, no installation, no internet required.

Download RCW-NixFort.exe (5.5 MB)How it works

Detect → audit → harden → report

You don't hand-edit sysctl, sshd or PAM files one server at a time. Run RCW-NixFort from Windows against any Linux host: it fingerprints the OS (Ubuntu, RHEL, Debian, Rocky, Alma, Amazon Linux…), selects the matching CIS benchmark profile (Level 1 / Level 2), and evaluates filesystems, kernel, services, network, logging, auditd, PAM, sudo and SSH controls.

C:\> RCW-NixFort.exe scan --host 10.0.0.51 --user admin --askpass [*] connected to 10.0.0.51:22 as admin [*] detected Ubuntu 22.04.4 LTS (family: debian) benchmark: CIS Ubuntu Linux 22.04 LTS Benchmark (Level 1 - Server) [*] phase 1/2: auditing 143 controls (Level 1 profile)... ✓ 3.5.9 Ensure TCP SYN cookies are enabled ✗ 5.6.6 Ensure SSH root login is disabled ● 1.4.1 Ensure bootloader password is set [manual] ... PASS 74 FAIL 50 MANUAL 12 compliance score: 60% [*] report exported: reports\RCW-NixFort_10.0.0.51_20260824-045704_scan.html

Then harden. Every change is shown first, backed up on the server, and reversible by run id:

C:\> RCW-NixFort.exe apply --host 10.0.0.51 --user admin [*] phase 2/2: 10 controls need hardening: 5.4.1 Ensure password expiration is 365 days or less 5.6.3 Ensure SSH MaxAuthTries is 4 or less ... type HARDEN to continue, anything else to abort: HARDEN ✚ 5.4.1 PASS_MAX_DAYS = 99999 -> fixed ✚ 5.6.3 maxauthtries 6 -> fixed (sshd -t validated, reloaded, re-verified) [*] 12 changes applied and journaled. rollback with: RCW-NixFort rollback --host 10.0.0.51 --user admin --run-id 20260824-045426-uq5c compliance score: 100%
Ubuntu 20.04 / 22.04 / 24.04Debian 11 / 12 / 13RHEL 8 / 9Rocky & AlmaLinuxOracle LinuxAmazon Linux 2 / 2023SLES 15

Reports you can hand to an auditor

Every run exports a self-contained HTML dashboard (filter by status, search evidence) plus JSON, CSV and Markdown — with the detected distro, applied benchmark, per-control evidence, what was fixed, and the rollback run id.

How it works

  1. Install nothing — copy the exe to any Windows 10/11 machine and open cmd/PowerShell. The target server just needs SSH and a sudo-capable user (or root).
  2. Audit first: RCW-NixFort.exe scan --host 10.0.0.51 --user admin --askpass — detects the distro, runs the CIS control set and exports the report.
  3. Preview or apply: add --dry-run to see every planned fix, or run apply and type HARDEN at the confirmation. Scope with --profile 2, --families network,access, --controls 5.6.6, --exclude.
  4. Undo anything: RCW-NixFort.exe rollback --host 10.0.0.51 --user admin --latest restores files, permissions, sysctls, services and packages from the server-side journal.
Note: control IDs map to the structure of the CIS Benchmarks for each detected distribution; verify exact section numbering against the official CIS benchmark for your distro/version. RCW-NixFort applies standard CIS Level 1/2 remediations but is not affiliated with or certified by CIS. Always review changes and test on non-production systems first.

What it hardens

Safety model