thehardwarestore.ai

hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.

This repository is a documentation/runbook, not a software application. It teaches how to secure a Linux server through a long, well-organized markdown guide aimed primarily at Debian-based systems. The content covers SSH key authentication and sshd_config hardening, PAM-based 2FA/MFA and password quality, UFW firewall configuration including Docker interactions, intrusion detection/prevention with fail2ban, CrowdSec, and PSAD, and auditing tools such as AIDE, ClamAV, rkhunter, chkrootkit, logwatch, Lynis, and OSSEC. It also includes a separate kernel sysctl hardening reference table and a short nginx security headers guide. In production, the repository itself does not run anything; its value is the curated collection of copy-paste-ready shell commands, configuration snippets, and operational guidance that a human administrator applies to a server. The architecture is a set of static markdown files with a consistent section pattern (Why, How It Works, Goals, Steps, References), backup-before-edit conventions, and validation steps after changes. The main README is effectively an evolving security runbook with a detailed table of contents, while the auxiliary markdown files serve as standalone reference assets. Recent updates show active maintenance: the guide has been revised for Debian 13 systemd-timesyncd, OpenSSH 9.1 RSA size enforcement, Docker and UFW bypass caveats, and CrowdSec installation. However, some older recommendations remain dated—for example, certain sysctl keys in the hardening table are obsolete or no longer present in modern kernels, and several linked references are from 2018-2019. Because this is a documentation repository rather than executable code, quality assessment focuses on information architecture, practical utility, and reusability rather than software engineering structure.