Frequently Asked Questions.
Khodshima Sumn Assist LTD
Everything you need to know about our Linux server hardening scripts, turnkey installation, zero-downtime safety, security audits, and enterprise warranty policies.
Safety & Continuous Uptime
Will the hardening process cause downtime for our live websites or APIs?
No. Our scripts and installation procedures are designed with staged rollout mechanisms. We test configurations in sandbox dry-run modes before reloading services (such as Nginx, SSH, or firewall rules), ensuring live traffic and APIs remain completely uninterrupted.
Can the hardening process lock me out of my own server?
No. Before we apply any SSH daemon alterations or firewall rules, we keep multiple active secondary shell sessions alive and verify connectivity thoroughly. Root direct login is restricted only after your designated sudoer user and Ed25519 key are fully tested and functional.
How are credentials handled after the work is finished?
We operate under a strict Ephemeral Key Lifecycle policy. All temporary Ed25519 public keys added for the session are cleanly revoked, sudo caches are flushed, and a verification audit confirming full access revocation is provided in the final handover.
What rollback mechanisms exist if something unexpected occurs?
Before modifying any configuration file (/etc/ssh/sshd_config, /etc/sysctl.conf, /etc/nftables.conf, /etc/pam.d/*), our automated toolkit creates timestamped atomic backups in an isolated recovery directory (/var/backups/khodshima-pre-hardening/).
Environments & Stacks
Which Linux distributions and server environments are supported?
We support all major enterprise and standard Linux distributions: Ubuntu 20.04/22.04/24.04 LTS, Debian 11/12, AlmaLinux 8/9, Rocky Linux 8/9, RHEL, CentOS Stream, and Amazon Linux 2/2023. We work across bare-metal, VPS, and cloud hosts (AWS, Hetzner, DigitalOcean, OVH, Linode, Hostinger, GCP, Azure).
Does your hardening work with web control panels like cPanel, Plesk, or CloudPanel?
Yes. For servers with control panels, we adapt firewall and web server templates so they do not conflict with panel-managed vhosts, automated SSL cert renewals (Lets Encrypt / Certbot), or custom port bindings.
Can we apply hardening to Docker / Kubernetes container nodes?
Yes. We harden the host OS kernel, Docker daemon socket (/var/run/docker.sock permissions), iptables/nftables forwarding chains, sysctl memory limits, and unprivileged user namespaces to prevent container breakout attacks.
Do you configure databases like PostgreSQL, MySQL, and Redis?
Yes. In the 250 €, 500 €, and Enterprise packages, we bind databases strictly to localhost or private VPC networks, disable dangerous commands (such as FLUSHALL or CONFIG in Redis), and enforce strict socket permissions.
Pricing & Contracts
What is the difference between the 100 €, 250 €, 500 €, and Enterprise tiers?
The 100 € pack is a DIY bundle of scripts and guides for experienced sysadmins. The 250 € pack includes full turnkey remote installation with a 30-day warranty. The 500 € pack adds deep Lynis vulnerability diagnostics, CIS Benchmark scoring (95+), an executive PDF report, and 60 days warranty. The Enterprise Contract tier is designed for multi-node clusters with custom SLAs, DPA agreements, and continuous support.
Can I upgrade from the 100 € script pack to the installation package later?
Yes. If you start with the 100 € DIY scripts pack and later decide you want our senior engineers to install or perform a full audit, you only pay the price difference (150 € to upgrade to Turnkey, or 400 € to upgrade to the 500 € Complete Defense tier).
What payment methods do you accept and do you issue UK invoices?
We accept bank wire transfers (SEPA / UK BACS), major corporate credit cards, and online invoicing. An official commercial invoice from Khodshima Sumn Assist LTD (Company No. 16202450) with VAT breakdown is issued with every purchase.
What happens if we need adjustments during the warranty period?
The 250 € tier includes 30 days and the 500 € tier includes 60 days of direct engineering warranty. If you deploy a new service, change domain ports, or need firewall/fail2ban adjustments, our engineers assist you at no extra charge.
Do you offer ongoing retainer contracts and custom SLAs?
Yes. Through our Custom Contract & SLA tier, we provide enterprise clients with ongoing quarterly vulnerability assessments, patch management, dedicated incident response channels, and signed Data Processing Agreements (DPA).
Compliance & Benchmarks
What is CIS Benchmark compliance and what score do you achieve?
Center for Internet Security (CIS) Benchmarks are the global standard for secure OS configuration. Following our hardening and audit in the 500 € tier, we provide a verified Lynis CIS compliance score of 95+ (out of 100).
Will your hardening help us pass PCI-DSS compliance audits?
Yes. Our configurations directly address PCI-DSS Section 2 requirements: removing vendor defaults, enforcing strong SSH cryptography, disabling unnecessary daemons, and hardening kernel network parameters.
How does your service assist with GDPR / UK DPA data security requirements?
Article 32 of the GDPR requires implementing appropriate technical measures to ensure security. Our kernel parameters, firewall isolation, and Auditd event logging satisfy these technical mandate criteria for server storage.
Still have a Specific Technical Question?
Our senior infrastructure security team is ready to review your server setup and answer any custom architectural questions.