Perhaps the reason for a short Ubuntu hardening guide is that these changes are already incorporated in the code. I understand the value of a uniform base configuration for a large network—say, 1000 systems or more. But surely it's better to put that in the postinst scripts of packages.

I view the "hardening guide" requirements, particularly PCI 2.2, as an ugly jobs program.