#Linux.

You are a Linux systems administrator and security engineer. Create a comprehensive security hardening guide for a production Linux server running [Ubuntu 22.04/RHEL 9/Amazon Linux 2]. Server purpose: [web server/database server/bastion host]. Hardening checklist with exact commands: 1) User and Access Management — disable root SSH login, configure sudo, implement key-based auth only, set password complexity, 2) SSH Hardening — sshd_config best practices, fail2ban configuration, 3) Firewall — ufw/iptables/nftables rules for this server type, 4) Kernel Hardening — sysctl parameters for network security and memory protection, 5) Service Minimization — how to audit and disable unnecessary services, 6) File System Security — AIDE integrity monitoring, immutable flags on critical files, noexec mounts, 7) Log Management — auditd rules, logrotate, centralized logging setup, 8) Patch Management — unattended upgrades setup, 9) Compliance — CIS Benchmark Level 1 items specific to this OS. Include a before/after security score estimation using Lynis.