Xor290/ansible-mln
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8e36acd81246e2ef330f04cb65bca0c66565e884
ansible-mln/files/wazuh-sca/cis_ubuntu24-04.yml
T
Xor290 8e36acd812 chore: update
2026-08-08 12:04:57 +02:00

5446 lines
487 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Security Configuration Assessment
# CIS Checks for Ubuntu Linux 22.04 LTS
# Copyright (C) 2024, Wazuh Inc.
#
# This program is free software; you can redistribute it
# and/or modify it under the terms of the GNU General Public
# License (version 2) as published by the FSF - Free Software
# Foundation
#
# SCA policy for Ubuntu Linux 24.04 LTS based on Center for Internet Security Ubuntu Linux 24.04 LTS Benchmark v1.0.0 - 08-26-2024
policy:
id: "cis_ubuntu24-04"
file: "cis_ubuntu24-04.yml"
name: "CIS Ubuntu Linux 24.04 LTS Benchmark v1.0.0."
description: "This document provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 24.04 LTS based on CIS benchmark for Ubuntu Linux 24.04 LTS."
references:
- https://www.cisecurity.org/cis-benchmarks/
requirements:
title: "Check Ubuntu version."
description: "Requirements for running the SCA scan against Ubuntu Linux 24.04 LTS"
condition: all
rules:
- "f:/etc/os-release -> r:Ubuntu 24.04"
- "f:/proc/sys/kernel/ostype -> Linux"
# variables:
checks:
# 1.1.1.1 Ensure cramfs kernel module is not available (Automated)
- id: 35500
title: "Ensure mounting of cramfs filesystems is disabled."
description: "The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
remediation: "Run the following script to unload and disable the freevxfs module: - IF - the freevxfs kernel module is available in ANY installed kernel: - Create a file ending in .conf with install freevxfs /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist freevxfs in the /etc/modprobe.d/ directory - Run modprobe -r freevxfs 2>/dev/null; rmmod freevxfs 2>/dev/null to remove freevxfs from the kernel - IF - the freevxfs kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env bash."
compliance:
- cis: ["1.1.1.1"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v cramfs -> r:^install /bin/false"
- "not c:lsmod -> r:cramfs"
# 1.1.1.2 Ensure freevxfs kernel module is not available. (Automated)
- id: 35501
title: "Ensure freevxfs kernel module is not available."
description: "The freevxfs filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP-UX operating systems."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
remediation: "Run the following steps to unload and disable the freevxfs module, if available. If the freevxfs kernel module is present in any installed kernel Create a configuration file in the /etc/modprobe.d/ directory."
compliance:
- cis: ["1.1.1.2"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v freevxfs -> r:^install /bin/false"
- "not c:lsmod -> r:freevxfs"
# 1.1.1.3 Ensure hfs kernel module is not available. (Automated)
- id: 35502
title: "Ensure hfs kernel module is not available."
description: "The hfs filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
remediation: "Run the following script to unload and disable the hfs module: - IF - the hfs kernel module is available in ANY installed kernel: - Create a file ending in .conf with install hfs /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist hfs in the /etc/modprobe.d/ directory - Run modprobe -r hfs 2>/dev/null; rmmod hfs 2>/dev/null to remove hfs from the kernel."
compliance:
- cis: ["1.1.1.3"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v hfs -> r:^install /bin/false"
- "not c:lsmod -> r:hfs"
# 1.1.1.4 Ensure hfsplus kernel module is not available. (Automated)
- id: 35503
title: "Ensure hfsplus kernel module is not available."
description: "The hfsplus filesystem type is a hierarchical filesystem designed to replace hfs that allows you to mount Mac OS filesystems."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
remediation: "Run the following script to unload and disable the hfsplus module: - IF - the hfsplus kernel module is available in ANY installed kernel: - Create a file ending in .conf with install hfsplus /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist hfsplus in the /etc/modprobe.d/ directory."
compliance:
- cis: ["1.1.1.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v hfsplus -> r:^install /bin/false"
- "not c:lsmod -> r:hfsplus"
# 1.1.1.5 Ensure jffs2 kernel module is not available. (Automated)
- id: 35504
title: "Ensure jffs2 kernel module is not available."
description: "The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
remediation: "Run the following script to unload and disable the jffs2 module: - IF - the jffs2 kernel module is available in ANY installed kernel: - Create a file ending in .conf with install jffs2 /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist jffs2 in the /etc/modprobe.d/ directory - Run modprobe -r jffs2 2>/dev/null; rmmod jffs2 2>/dev/null to remove jffs2 from the kernel - IF - the jffs2 kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary."
compliance:
- cis: ["1.1.1.5"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v jffs2 -> r:^install /bin/false"
- "not c:lsmod -> r:jffs2"
# 1.1.1.6 Ensure overlayfs kernel module is not available. (Automated)
- id: 35505
title: "Ensure overlayfs kernel module is not available."
description: "overlayfs is a Linux filesystem that layers multiple filesystems to create a single unified view which allows a user to \"merge\" several mount points into a unified filesystem."
rationale: "The overlayfs has known CVE's: CVE-2023-32629, CVE-2023-2640, CVE-2023-0386. Disabling the overlayfs reduces the local attack surface by removing support for unnecessary filesystem types and mitigates potential risks associated with unauthorized execution of setuid files, enhancing the overall system security."
impact: "WARNING: If Container applications such as Docker, Kubernetes, Podman, Linux Containers (LXC), etc. are in use proceed with caution and consider the impact on containerized workloads, as disabling the overlayfs may severely disrupt containerization."
remediation: "Run the following script to unload and disable the overlayfs module: - IF - the overlayfs kernel module is available in ANY installed kernel: - Create a file ending in .conf with install overlayfs /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist overlayfs in the /etc/modprobe.d/ directory - Run modprobe -r overlayfs 2>/dev/null; rmmod overlayfs 2>/dev/null to remove overlayfs from the kernel - IF - the overlayfs kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env bash."
references:
- 'https://docs.kernel.org/filesystems/overlayfs.html'
- 'https://wiki.archlinux.org/title/Overlay_filesystem'
- 'https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=overlayfs'
compliance:
- cis: ["1.1.1.6"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v overlayfs -> r:^install /bin/false"
- "not c:lsmod -> r:overlayfs"
# 1.1.1.7 Ensure squashfs kernel module is not available. (Automated)
- id: 35506
title: "Ensure squashfs kernel module is not available."
description: "The squashfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A squashfs image can be used without having to first decompress the image."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
impact: "As Snap packages utilize squashfs as a compressed filesystem, disabling squashfs will cause Snap packages to fail. Snap application packages of software are self-contained and work across a range of Linux distributions. This is unlike traditional Linux package management approaches, like APT or RPM, which require specifically adapted packages per Linux distribution on an application update and delay therefore application deployment from developers to their software's end-user. Snaps themselves have no dependency on any external store (\"App store\"), can be obtained from any source and can be therefore used for upstream software deployment."
remediation: "Run the following script to unload and disable the udf module: - IF - the squashfs kernel module is available in ANY installed kernel: - Create a file ending in .conf with install squashfs /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist squashfs in the /etc/modprobe.d/ directory - Run modprobe -r squashfs 2>/dev/null; rmmod squashfs 2>/dev/null to remove squashfs from the kernel - IF - the squashfs kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary."
compliance:
- cis: ["1.1.1.7"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v squashfs -> r:^install /bin/false"
- "not c:lsmod -> r:squashfs"
# 1.1.1.8 Ensure udf kernel module is not available. (Automated)
- id: 35507
title: "Ensure udf kernel module is not available."
description: "The udf filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats."
rationale: "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
impact: "Microsoft Azure requires the usage of udf. udf should not be disabled on systems run on Microsoft Azure."
remediation: "Run the following script to unload and disable the udf module: - IF - the udf kernel module is available in ANY installed kernel: - Create a file ending in .conf with install udf /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist udf in the /etc/modprobe.d/ directory - Run modprobe -r udf 2>/dev/null; rmmod udf 2>/dev/null to remove udf from the kernel - IF - the udf kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary."
compliance:
- cis: ["1.1.1.8"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:/sbin/modprobe -n -v udf -> r:^install /bin/false"
- "not c:lsmod -> r:udf"
# 1.1.1.9 Ensure usb-storage kernel module is not available. (Automated)
- id: 35508
title: "Ensure usb-storage kernel module is not available."
description: "USB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment."
rationale: "Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware."
impact: "Disabling the usb-storage module will disable any usage of USB storage devices. If requirements and local site policy allow the use of such devices, other solutions should be configured accordingly instead. One example of a commonly used solution is USBGuard."
remediation: "Run the following script to unload and disable the usb-storage module: - IF - the usb-storage kernel module is available in ANY installed kernel: - Create a file ending in .conf with install usb-storage /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist usb-storage in the /etc/modprobe.d/ directory - Run modprobe -r usb-storage 2>/dev/null; rmmod usb-storage 2>/dev/null to remove usb-storage from the kernel - IF - the usb-storage kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary."
compliance:
- cis: ["1.1.1.9"]
- cis_csc_v8: ["10.3"]
- cis_csc_v7: ["13.7"]
- cmmc_v2.0: ["MP.L2-3.8.7"]
- hipaa: ["164.310(d)(1)"]
- iso_27001-2013: ["A.8.3.1"]
- mitre_mitigations: ["M1034"]
- mitre_tactics: ["TA0001", "TA0010"]
- mitre_techniques: ["T1052", "T1052.001", "T1091", "T1200"]
condition: all
rules:
- "c:modprobe -n -v usb-storage -> r:^install /bin/false"
- "not c:lsmod -> r:usb-storage"
# 1.1.1.10 Ensure unused filesystems kernel modules are not available. (Manual)
- id: 35509
title: "Ensure unused filesystems kernel modules are not available."
description: "Filesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls."
rationale: "While loadable filesystem kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of loadable filesystem kernel modules in this way. Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it. The following filesystem kernel modules have known CVE's and should be made unavailable if no dependencies exist: - afs - CVE-2022-37402 - ceph - CVE-2022-0670 - cifs - CVE-2022-29869 - exfat CVE-2022-29973 - ext CVE-2022-1184 - fat CVE-2022-22043 - fscache CVE-2022-3630 - fuse CVE-2023-0386 - gfs2 CVE-2023-3212 - nfs_common CVE-2023-6660 - nfsd CVE-2022-43945 - smbfs_common CVE-2022-2585."
impact: "This list may be quite extensive and covering all edges cases is difficult. Therefore, it's crucial to carefully consider the implications and dependencies before making any changes to the filesystem kernel module configurations."
remediation: "- IF - the module is available in the running kernel: - Unload the filesystem kernel module from the kernel - Create a file ending in .conf with install filesystem kernel modules /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with deny list filesystem kernel modules in the /etc/modprobe.d/ directory WARNING: unloading, disabling or denylisting filesystem modules that are in use on the system maybe FATAL. It is extremely important to thoroughly review the filesystems returned by the audit before following the remediation procedure. Example of unloading the gfs2kernel module: # modprobe -r gfs2 2>/dev/null # rmmod gfs2 2>/dev/null Example of fully disabling the gfs2 kernel module."
references:
- 'https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=filesystem'
compliance:
- cis: ["1.1.1.10"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:modprobe -n -v afs -> r:^install /bin/false"
- "not c:lsmod -> r:afs"
- "c:modprobe -n -v ceph -> r:^install /bin/false"
- "not c:lsmod -> r:ceph"
- "c:modprobe -n -v cifs -> r:^install /bin/false"
- "not c:lsmod -> r:cifs"
- "c:modprobe -n -v exfat -> r:^install /bin/false"
- "not c:lsmod -> r:exfat"
- "c:modprobe -n -v ext -> r:^install /bin/false"
- "not c:lsmod -> r:ext"
- "c:modprobe -n -v fat -> r:^install /bin/false"
- "not c:lsmod -> r:fat"
- "c:modprobe -n -v fscache -> r:^install /bin/false"
- "not c:lsmod -> r:fscache"
- "c:modprobe -n -v fuse -> r:^install /bin/false"
- "not c:lsmod -> r:fuse"
- "c:modprobe -n -v gfs2 -> r:^install /bin/false"
- "not c:lsmod -> r:gfs2"
- "c:modprobe -n -v nfs_common -> r:^install /bin/false"
- "not c:lsmod -> r:nfs_common"
- "c:modprobe -n -v nfsd -> r:^install /bin/false"
- "not c:lsmod -> r:nfsd"
- "c:modprobe -n -v smbfs_common -> r:^install /bin/false"
- "not c:lsmod -> r:smbfs_common"
# 1.3.1.1 Ensure AppArmor is installed. (Automated)
- id: 35536
title: "Ensure AppArmor is installed."
description: "AppArmor provides Mandatory Access Controls."
rationale: "Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available."
remediation: "Install AppArmor. # apt install apparmor apparmor-utils."
compliance:
- cis: ["1.3.1.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1068", "T1565", "T1565.001", "T1565.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "c:dpkg-query -s apparmor -> r:^Status: install ok installed"
- "c:dpkg-query -s apparmor-utils -> r:^Status: install ok installed"
# 1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration. (Automated)
- id: 35537
title: "Ensure AppArmor is enabled in the bootloader configuration."
description: "Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters. Note: This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings."
rationale: "AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden."
remediation: "Edit /etc/default/grub and add the apparmor=1 and security=apparmor parameters to the GRUB_CMDLINE_LINUX= line GRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\" Run the following command to update the grub2 configuration: # update-grub."
compliance:
- cis: ["1.3.1.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1068", "T1565", "T1565.001", "T1565.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "f:/etc/default/grub -> r:security=apparmor"
- "f:/etc/default/grub -> r:apparmor=1"
# 1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode. (Automated)
- id: 35538
title: "Ensure all AppArmor Profiles are in enforce or complain mode."
description: "AppArmor profiles define what resources applications are able to access."
rationale: "Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated."
remediation: "Run the following command to set all profiles to enforce mode: # aa-enforce /etc/apparmor.d/* - OR - Run the following command to set all profiles to complain mode: # aa-complain /etc/apparmor.d/* Note: Any unconfined processes may need to have a profile created or activated for them and then be restarted."
compliance:
- cis: ["1.3.1.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1497"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- c:apparmor_status -> n:^(\p*\d+)\s+profiles\s+are\s+loaded compare > 0
- c:apparmor_status -> n:^(\p*\d+)\s+profiles\s+are\s+in\s+enforce\s+mode compare > 0
- c:apparmor_status -> n:^(\p*\d+)\s+profiles\s+are\s+in\s+kill\s+mode compare == 0
- c:apparmor_status -> n:^(\p*\d+)\s+profiles\s+are\s+in\s+unconfined\s+mode compare == 0
- c:apparmor_status -> n:^(\p*\d+)\s*profiles\s+are\s+in\s+complain\s+mode compare == 0
- c:apparmor_status -> n:^(\p*\d+)\s*processes\s+are\s+unconfined compare == 0
# 1.3.1.4 Ensure all AppArmor Profiles are enforcing. (Automated)
- id: 35539
title: "Ensure all AppArmor Profiles are enforcing."
description: "AppArmor profiles define what resources applications are able to access."
rationale: "Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated."
remediation: "Run the following command to set all profiles to enforce mode: # aa-enforce /etc/apparmor.d/* Note: Any unconfined processes may need to have a profile created or activated for them and then be restarted."
compliance:
- cis: ["1.3.1.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1048"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1068", "T1565", "T1565.001", "T1565.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:apparmor_status -> n:^(\d+)\s+profiles\s+are\s+loaded compare > 0'
- 'c:apparmor_status -> n:^(\d+)\s+profiles\s+are\s+in\s+enforce\s+mode compare > 0'
- 'c:apparmor_status -> r:^0\s+profiles\s+are\s+in\s+kill\s+mode'
- 'c:apparmor_status -> r:^0\s+profiles\s+are\s+in\s+unconfined\s+mode'
- 'c:apparmor_status -> r:^0\s*profiles\s+are\s+in\s+complain\s+mode'
- 'c:apparmor_status -> r:^0\s*processes\s+are\s+unconfined'
# 1.4.1 Ensure bootloader password is set. (Automated)
- id: 35540
title: "Ensure bootloader password is set."
description: "Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters."
rationale: "Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. turning off AppArmor at boot time)."
impact: "If password protection is enabled, only the designated superuser can edit a GRUB 2 menu item by pressing \"e\" or access the GRUB 2 command line by pressing \"c\" If GRUB 2 is set up to boot automatically to a password-protected menu entry the user has no option to back out of the password prompt to select another menu entry. Holding the SHIFT key will not display the menu in this case. The user must enter the correct username and password. If unable to do so, the configuration files will have to be edited via a LiveCD or other means to fix the problem You can add --unrestricted to the menu entries to allow the system to boot without entering a password. A password will still be required to edit menu items. More Information: https://help.ubuntu.com/community/Grub2/Passwords."
remediation: "Create an encrypted password with grub-mkpasswd-pbkdf2: # grub-mkpasswd-pbkdf2 --iteration-count=600000 --salt=64 Enter password: <password> Reenter password: <password> PBKDF2 hash of your password is <encrypted-password> Add the following into a custom /etc/grub.d configuration file: cat <<EOF exec tail -n +2 $0 set superusers=\"<username>\" password_pbkdf2 <username> <encrypted-password> EOF The superuser/user information and password should not be contained in the /etc/grub.d/00_header file as this file could be overwritten in a package update. If there is a requirement to be able to boot/reboot without entering the password, edit /etc/grub.d/10_linux and add --unrestricted to the line CLASS= Example: CLASS=\"--class gnu-linux --class gnu --class os --unrestricted\" Run the following command to update the grub2 configuration: # update-grub."
compliance:
- cis: ["1.4.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1046"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1542"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "f:/boot/grub/grub.cfg -> r:^\\s*\\t*set superusers="
- "f:/boot/grub/grub.cfg -> r:^\\s*\\t*password_pbkdf2\\s*\\t*\\w+"
# 1.4.2 Ensure access to bootloader config is configured. (Automated)
- id: 35541
title: "Ensure access to bootloader config is configured."
description: "The grub configuration file contains information on boot settings and passwords for unlocking boot options."
rationale: "Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them."
remediation: "Run the following commands to set permissions on your grub configuration: # chown root:root /boot/grub/grub.cfg # chmod u-x,go-rwx /boot/grub/grub.cfg."
compliance:
- cis: ["1.4.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005", "TA0007"]
- mitre_techniques: ["T1542"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /boot/grub/grub.cfg -> r:Access: \(0400/-r--------\) && r:Uid:\s+\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s+\t*\(\s*\t*0/\s*\t*root\)'
# 1.5.1 Ensure address space layout randomization is enabled. (Automated)
- id: 35542
title: "Ensure address space layout randomization is enabled."
description: "Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process."
rationale: "Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting."
remediation: "Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - kernel.randomize_va_space = 2 Example: # printf \"%s\\n\" \"kernel.randomize_va_space = 2\" >> /etc/sysctl.d/60- kernel_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w kernel.randomize_va_space=2 Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
references:
- "http://manpages.ubuntu.com/manpages/focal/man5/sysctl.d.5.html"
compliance:
- cis: ["1.5.1"]
- cis_csc_v8: ["10.5"]
- cis_csc_v7: ["8.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1068"]
- nist_sp_800-53: ["SI-16"]
- pci_dss_v3.2.1: ["1.4"]
- soc_2: ["CC6.8"]
condition: any
rules:
- 'c:sysctl kernel.randomize_va_space -> r:^\s*kernel.randomize_va_space\s*=\s*2'
- 'f:/etc/sysctl.conf -> r:^\s*kernel.randomize_va_space\s*=\s*2'
- 'd:/etc/sysctl.d/ -> r:\.+ -> r:^\s*kernel.randomize_va_space\s*=\s*2'
# 1.5.2 Ensure ptrace_scope is restricted. (Automated) - Not Implemented
# 1.5.3 Ensure core dumps are restricted. (Automated)
- id: 35543
title: "Ensure core dumps are restricted."
description: "A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user."
rationale: "Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see limits.conf(5) ). In addition, setting the fs.suid_dumpable variable to 0 will prevent setuid programs from dumping core."
remediation: "Add the following line to /etc/security/limits.conf or a /etc/security/limits.d/* file: * hard core 0 Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - fs.suid_dumpable = 0 Example: # printf \"\\n%s\" \"fs.suid_dumpable = 0\" >> /etc/sysctl.d/60-fs_sysctl.conf Run the following command to set the active kernel parameter: # sysctl -w fs.suid_dumpable=0 Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten -IF- systemd-coredump is installed: edit /etc/systemd/coredump.conf and add/modify the following lines: Storage=none ProcessSizeMax=0 Run the command: systemctl daemon-reload."
compliance:
- cis: ["1.5.3"]
- mitre_mitigations: ["M1057"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1005"]
condition: all
rules:
- "c:sysctl fs.suid_dumpable -> r:^fs.suid_dumpable = 0"
- "c:systemctl is-enabled coredump.service -> r:enabled|masked|disabled"
- 'c:grep -Rh "fs.suid_dumpable" /etc/sysctl.conf /etc/sysctl.d/ -> !r:^\s*\t*# && r:fs.suid_dumpable = 0'
- 'c:grep -Rh "hard core 0" /etc/security/limits.conf /etc/security/limits.d/ -> !r:^\s*\t*# && r:\p hard core 0'
# 1.5.4 Ensure prelink is not installed. (Automated)
- id: 35544
title: "Ensure prelink is not installed."
description: "prelink is a program that modifies ELF shared libraries and ELF dynamically linked binaries in such a way that the time needed for the dynamic linker to perform relocations at startup significantly decreases."
rationale: "The prelinking feature can interfere with the operation of AIDE, because it changes binaries. Prelinking can also increase the vulnerability of the system if a malicious user is able to compromise a common library such as libc."
remediation: "Run the following command to restore binaries to normal: # prelink -ua Uninstall prelink using the appropriate package manager or manual installation: # apt purge prelink."
compliance:
- cis: ["1.5.4"]
- cis_csc_v8: ["3.14"]
- cis_csc_v7: ["14.9"]
- cmmc_v2.0: ["AC.L2-3.1.7"]
- hipaa: ["164.312(b)", "164.312(c)(1)", "164.312(c)(2)"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1050"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1055", "T1055.009", "T1065", "T1065.001"]
- nist_sp_800-53: ["AC-6(9)"]
- pci_dss_v3.2.1: ["10.2.1", "11.5"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1"]
- soc_2: ["CC6.1"]
condition: any
rules:
- c:dpkg-query -s prelink -> r:package 'prelink' is not installed
- c:dpkg-query -W -f='${binary:Package}\t${Status}\t${db:Status-Status}\\n' prelink -> r:prelink\\s*\\t*unknown\\s*\\t*ok\\s*\\t*not-installed\\s*\\t*not-installed|no packages found matching prelink
# 1.5.5 Ensure Automatic Error Reporting is not enabled. (Automated)
- id: 35545
title: "Ensure Automatic Error Reporting is not enabled."
description: "The Apport Error Reporting Service automatically generates crash reports for debugging."
rationale: "Apport collects potentially sensitive data, such as core dumps, stack traces, and log files. They can contain passwords, credit card numbers, serial numbers, and other private material."
remediation: "Edit /etc/default/apport and add or edit the enabled parameter to equal 0: enabled=0 Run the following commands to stop and mask the apport service # systemctl stop apport.service # systemctl mask apport.service - OR - Run the following command to remove the apport package: # apt purge apport."
compliance:
- cis: ["1.5.5"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:systemctl is-enabled apport.service -> r:disabled"
- "not f:/etc/default/apport -> n:enabled=(\\d+) compare != 0"
- "not c:systemctl is-active apport.service -> r:active"
# 1.6.1 Ensure message of the day is configured properly. (Automated)
- id: 35546
title: "Ensure message of the day is configured properly."
description: "The contents of the /etc/motd file are displayed to users after login and function as a message of the day for authenticated users. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \\m - machine architecture \\r - operating system release \\s - operating system name \\v - operating system version."
rationale: "Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" uname -a \" command once they have logged in."
remediation: "Edit the /etc/motd file with the appropriate contents according to your site policy, remove any instances of \\m , \\r , \\s , \\v or references to the OS platform - OR - - IF - the motd is not used, this file can be removed. Run the following command to remove the motd file: # rm /etc/motd."
compliance:
- cis: ["1.6.1"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1082", "T1592", "T1592.004"]
condition: any
rules:
- 'not f:/etc/motd -> r:\\v|\\r|\\m|\\s|Debian|Ubuntu'
- "not f:/etc/motd"
# 1.6.2 Ensure local login warning banner is configured properly. (Automated)
- id: 35547
title: "Ensure local login warning banner is configured properly."
description: "The contents of the /etc/issue file are displayed to users prior to login for local terminals. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \\m - machine architecture \\r - operating system release \\s - operating system name \\v - operating system version - or the operating system's name."
rationale: "Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" uname -a \" command once they have logged in."
remediation: "Edit the /etc/issue file with the appropriate contents according to your site policy, remove any instances of \\m , \\r , \\s , \\v or references to the OS platform Example: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue."
compliance:
- cis: ["1.6.2"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1082", "T1592", "T1592.004"]
condition: none
rules:
- 'f:/etc/issue -> r:\\v|\\r|\\m|\\s|Debian|Ubuntu'
# 1.6.3 Ensure remote login warning banner is configured properly. (Automated)
- id: 35548
title: "Ensure remote login warning banner is configured properly."
description: "The contents of the /etc/issue.net file are displayed to users prior to login for remote connections from configured services. Unix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If mingetty(8) supports the following options, they display operating system information: \\m - machine architecture \\r - operating system release \\s - operating system name \\v - operating system version."
rationale: "Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" uname -a \" command once they have logged in."
remediation: "Edit the /etc/issue.net file with the appropriate contents according to your site policy, remove any instances of \\m , \\r , \\s , \\v or references to the OS platform Example: # echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue.net."
compliance:
- cis: ["1.6.3"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1018", "T1082", "T1592", "T1592.004"]
condition: none
rules:
- 'f:/etc/issue.net -> r:\\v|\\r|\\m|\\s|Debian|Ubuntu'
# 1.6.4 Ensure access to /etc/motd is configured. (Automated)
- id: 35549
title: "Ensure access to /etc/motd is configured."
description: "The contents of the /etc/motd file are displayed to users after login and function as a message of the day for authenticated users."
rationale: "- IF - the /etc/motd file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."
remediation: "Run the following commands to set mode, owner, and group on /etc/motd: # chown root:root $(readlink -e /etc/motd) # chmod u-x,go-wx $(readlink -e /etc/motd) - OR - Run the following command to remove the /etc/motd file: # rm /etc/motd."
compliance:
- cis: ["1.6.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: any
rules:
- 'c:stat /etc/motd -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*0/\s*root\)\s*\t*Gid:\s*\(\s*0/\s*root\)'
- "not f:/etc/motd"
# 1.6.5 Ensure access to /etc/issue is configured. (Automated)
- id: 35550
title: "Ensure access to /etc/issue is configured."
description: "The contents of the /etc/issue file are displayed to users prior to login for local terminals."
rationale: "- IF - the /etc/issue file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."
remediation: "Run the following commands to set mode, owner, and group on /etc/issue: # chown root:root $(readlink -e /etc/issue) # chmod u-x,go-wx $(readlink -e /etc/issue)."
compliance:
- cis: ["1.6.5"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/issue -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*0/\s*root\)\s*\t*Gid:\s*\(\s*0/\s*root\)'
# 1.6.6 Ensure access to /etc/issue.net is configured. (Automated)
- id: 35551
title: "Ensure access to /etc/issue.net is configured."
description: "The contents of the /etc/issue.net file are displayed to users prior to login for remote connections from configured services."
rationale: "- IF - the /etc/issue.net file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."
remediation: "Run the following commands to set mode, owner, and group on /etc/issue.net: # chown root:root $(readlink -e /etc/issue.net) # chmod u-x,go-wx $(readlink -e /etc/issue.net)."
compliance:
- cis: ["1.6.6"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/issue.net -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*0/\s*root\)\s*\t*Gid:\s*\(\s*0/\s*root\)'
# 2.1.1 Ensure autofs services are not in use. (Automated)
- id: 35561
title: "Ensure autofs services are not in use."
description: "autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives."
rationale: "With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in the filesystem even if they lacked permissions to mount it themselves."
impact: "The use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting. There may be packages that are dependent on the autofs package. If the autofs package is removed, these dependent packages will be removed as well. Before removing the autofs package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the autofs.service leaving the autofs package installed."
remediation: "Run the following commands to stop autofs.service and remove the autofs package: # systemctl stop autofs.service # apt purge autofs - OR - - IF - the autofs package is required as a dependency: Run the following commands to stop and mask autofs.service: # systemctl stop autofs.service # systemctl mask autofs.service."
compliance:
- cis: ["2.1.1"]
- cis_csc_v8: ["10.3"]
- cis_csc_v7: ["8.5"]
- cmmc_v2.0: ["MP.L2-3.8.7"]
- hipaa: ["164.310(d)(1)"]
- iso_27001-2013: ["A.12.2.1"]
- mitre_techniques: ["T1068", "T1203", "T1211", "T1212"]
condition: any
rules:
- "c:dpkg-query -s autofs -> r:package 'autofs' is not installed"
- "not c:systemctl show autofs.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.2 Ensure avahi daemon services are not in use. (Automated)
- id: 35562
title: "Ensure avahi daemon services are not in use."
description: "Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plug a computer into a network and Avahi automatically finds printers to print to, files to look at and people to talk to, as well as network services running on the machine."
rationale: "Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface."
impact: "There may be packages that are dependent on the avahi package. If the avahi package is removed, these dependent packages will be removed as well. Before removing the avahi package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the avahi-daemon.socket and avahi-daemon.service leaving the avahi package installed."
remediation: "Run the following commands to stop avahi-daemon.socket and avahi-daemon.service and remove the avahi-daemon package # systemctl stop avahi-daemon.socket avahi-daemon.service # apt purge avahi-daemon OR IF the avahi-daemon package is required as a dependency: Run the following commands to stop and mask the avahi-daemon.socket and avahi-daemon.service # systemctl stop avahi-daemon.socket avahi-daemon.service # systemctl mask avahi-daemon.socket avahi-daemon.service."
compliance:
- cis: ["2.1.2"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s avahi-daemon -> r:package 'avahi-daemon' is not installed"
- "not c:systemctl show avahi-daemon.socket avahi-daemon.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.3 Ensure dhcp server services are not in use. (Automated)
- id: 35563
title: "Ensure dhcp server services are not in use."
description: "The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol DHCPv4 and DHCPv6. At startup the server may be started for one or the other via the -4 or -6 arguments."
rationale: "Unless a system is specifically set up to act as a DHCP server, it is recommended that this package be removed to reduce the potential attack surface."
impact: "There may be packages that are dependent on the isc-dhcp-server package. If the isc-dhcp-server package is removed, these dependent packages will be removed as well. Before removing the isc-dhcp-server package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the isc-dhcp-server.service and isc-dhcp-server6.service leaving the isc-dhcp-server package installed."
remediation: "Run the following commands to stop isc-dhcp-server.service and isc-dhcp-server6.service and remove the isc-dhcp-server package: # systemctl stop isc-dhcp-server.service isc-dhcp-server6.service # apt purge isc-dhcp-server - OR - - IF - the isc-dhcp-server package is required as a dependency: Run the following commands to stop and mask isc-dhcp-server.service and isc-dhcp-server6.service: # systemctl stop isc-dhcp-server.service isc-dhcp-server6.service # systemctl mask isc-dhcp-server isc-dhcp-server6.service."
references:
- 'http://www.isc.org/software/dhcp.'
compliance:
- cis: ["2.1.3"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s isc-dhcp-server -> r:package 'isc-dhcp-server' is not installed"
- "not c:systemctl show isc-dhcp-server.service isc-dhcp-server6.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.4 Ensure dns server services are not in use. (Automated)
- id: 35564
title: "Ensure dns server services are not in use."
description: "The Domain Name System (DNS) is a hierarchical naming system that maps names to IP addresses for computers, services and other resources connected to a network. Note: bind9 is the package and bind.service is the alias for named.service."
rationale: "Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface."
impact: "There may be packages that are dependent on the bind9 package. If the bind9 package is removed, these dependent packages will be removed as well. Before removing the bind9 package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask named.service leaving the bind9 package installed."
remediation: "Run the following commands to stop named.service and remove the bind9 package: # systemctl stop named.service # apt purge bind9 - OR - - IF - the bind9 package is required as a dependency: Run the following commands to stop and mask bind9.service: # systemctl stop named.service # systemctl mask named.service."
compliance:
- cis: ["2.1.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s bind9 -> r:package 'bind9' is not installed"
- "not c:systemctl show named.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.5 Ensure dnsmasq services are not in use. (Automated)
- id: 35565
title: "Ensure dnsmasq services are not in use."
description: "dnsmasq is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services."
rationale: "Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface."
impact: "There may be packages that are dependent on the dnsmasq package. If the dnsmasq package is removed, these dependent packages will be removed as well. Before removing the dnsmasq package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the dnsmasq.service leaving the dnsmasq package installed."
remediation: "Run the following commands to stop dnsmasq.service and remove dnsmasq package: # systemctl stop dnsmasq.service # apt purge dnsmasq - OR - - IF - the dnsmasq package is required as a dependency: Run the following commands to stop and mask the dnsmasq.service: # systemctl stop dnsmasq.service # systemctl mask dnsmasq.service."
compliance:
- cis: ["2.1.5"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s dnsmasq -> r:package 'dnsmasq' is not installed"
- "not c:systemctl show dnsmasq.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.6 Ensure ftp server services are not in use. (Automated)
- id: 35566
title: "Ensure ftp server services are not in use."
description: "The File Transfer Protocol (FTP) provides networked computers with the ability to transfer files. vsftpd is the Very Secure File Transfer Protocol Daemon."
rationale: "FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface."
impact: "There may be packages that are dependent on the vsftpd package. If the vsftpd package is removed, these dependent packages will be removed as well. Before removing the vsftpd package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the vsftpd.service leaving the vsftpd package installed."
remediation: "Run the following commands to stop vsftpd.service and remove the vsftpd package: # systemctl stop vsftpd.service # apt purge vsftpd - OR - - IF - the vsftpd package is required as a dependency: Run the following commands to stop and mask the vsftpd.service: # systemctl stop vsftpd.service # systemctl mask vsftpd.service Note: Other ftp server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service should be stopped and masked."
compliance:
- cis: ["2.1.6"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s vsftpd -> r:package 'vsftpd' is not installed"
- "not c:systemctl show vsftpd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.7 Ensure ldap server services are not in use. (Automated)
- id: 35567
title: "Ensure ldap server services are not in use."
description: "The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."
rationale: "If the system will not need to act as an LDAP server, it is recommended that the software be removed to reduce the potential attack surface."
impact: "There may be packages that are dependent on the slapd package. If the slapd package is removed, these dependent packages will be removed as well. Before removing the slapd package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the slapd.service leaving the slapd package installed."
remediation: "Run the following commands to stop slapd.service and remove the slapd package: # systemctl stop slapd.service # apt purge slapd - OR - - IF - the slapd package is required as a dependency: Run the following commands to stop and mask slapd.service: # systemctl stop slapd.service # systemctl mask slapd.service."
references:
- 'http://www.openldap.org.'
compliance:
- cis: ["2.1.7"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s slapd -> r:package 'slapd' is not installed"
- "not c:systemctl show slapd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.8 Ensure message access server services are not in use. (Automated)
- id: 35568
title: "Ensure message access server services are not in use."
description: "dovecot-imapd and dovecot-pop3d are an open source IMAP and POP3 server for Linux based systems."
rationale: "Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the package be removed to reduce the potential attack surface. Note: Several IMAP/POP3 servers exist and can use other service names. These should also be audited and the packages removed if not required."
impact: "There may be packages that are dependent on dovecot-imapd and/or dovecot-pop3d packages. If dovecot-imapd and dovecot-pop3d packages are removed, these dependent packages will be removed as well. Before removing dovecot-imapd and/or dovecot-pop3d packages, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask dovecot.socket and dovecot.service leaving dovecot-imapd and/or dovecot-pop3d packages installed."
remediation: "Run one of the following commands to remove dovecot-imapd and dovecot-pop3d: Run the following commands to stop dovecot.socket and dovecot.service, and remove the dovecot-imapd and dovecot-pop3d packages: # systemctl stop dovecot.socket dovecot.service # apt purge dovecot-imapd dovecot-pop3d - OR - - IF - a package is installed and is required for dependencies: Run the following commands to stop and mask dovecot.socket and dovecot.service: # systemctl stop dovecot.socket dovecot.service # systemctl mask dovecot.socket dovecot.service."
compliance:
- cis: ["2.1.8"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "not c:dpkg-query -s dovecot-imapd dovecot-pop3d -> r:^Status: install ok installed"
- "not c:systemctl show dovecot-imapd.socket dovecot.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.9 Ensure network file system services are not in use. (Automated)
- id: 35569
title: "Ensure network file system services are not in use."
description: "The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network."
rationale: "If the system does not export NFS shares, it is recommended that the nfs-kernel-server package be removed to reduce the remote attack surface."
impact: "There may be packages that are dependent on the nfs-kernel-server package. If the nfs-kernel-server package is removed, these dependent packages will be removed as well. Before removing the nfs-kernel-server package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the nfs-server.service leaving the nfs-kernel-server package installed."
remediation: "Run the following command to stop nfs-server.service and remove nfs-kernel- server package: # systemctl stop nfs-server.service # apt purge nfs-kernel-server - OR - - IF - the nfs-kernel-server package is required as a dependency: Run the following commands to stop and mask the nfs-server.service: # systemctl stop nfs-server.service # systemctl mask nfs-server.service."
compliance:
- cis: ["2.1.9"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1005", "T1039", "T1083", "T1135", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s nfs-kernel-server -> r:package 'nfs-kernel-server' is not installed"
- "not c:systemctl show nfs-server.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.10 Ensure nis server services are not in use. (Automated)
- id: 35570
title: "Ensure nis server services are not in use."
description: "The Network Information Service (NIS) (formally known as Yellow Pages) is a client-server directory service protocol for distributing system configuration files. The NIS server is a collection of programs that allow for the distribution of configuration files. The NIS client (ypbind) was used to bind a machine to an NIS server and receive the distributed configuration files."
rationale: "ypserv.service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that ypserv.service be removed and other, more secure services be used."
impact: "There may be packages that are dependent on the ypserv package. If the ypserv package is removed, these dependent packages will be removed as well. Before removing the ypserv package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the ypserv.service leaving the ypserv package installed."
remediation: "Run the following commands to stop ypserv.service and remove ypserv package: # systemctl stop ypserv.service # apt purge ypserv - OR - - IF - the ypserv package is required as a dependency: Run the following commands to stop and mask ypserv.service: # systemctl stop ypserv.service # systemctl mask ypserv.service."
compliance:
- cis: ["2.1.10"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s ypserv -> r:package 'ypserv' is not installed"
- "not c:systemctl show ypserv.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.11 Ensure print server services are not in use. (Automated)
- id: 35571
title: "Ensure print server services are not in use."
description: "The Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administration capability."
rationale: "If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface."
impact: "Removing the cups package, or disabling cups.socket and/or cups.service will prevent printing from the system, a common task for workstation systems. There may be packages that are dependent on the cups package. If the cups package is removed, these dependent packages will be removed as well. Before removing the cups package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask cups.socket and cups.service leaving the cups package installed."
remediation: "Run the following commands to stop cups.socket and cups.service, and remove the cups package: # systemctl stop cups.socket cups.service # apt purge cups - OR - - IF - the cups package is required as a dependency: Run the following commands to stop and mask the cups.socket and cups.service: # systemctl stop cups.socket cups.service # systemctl mask cups.socket cups.service."
references:
- 'http://www.cups.org'
compliance:
- cis: ["2.1.11"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s cups -> r:package 'cups' is not installed"
- "not c:systemctl show cups.socket cups.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.12 Ensure rpcbind services are not in use. (Automated)
- id: 35572
title: "Ensure rpcbind services are not in use."
description: "The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts rpcbind on the server with a particular RPC program number. The rpcbind.service redirects the client to the proper port number so it can communicate with the requested service. Portmapper is an RPC service, which always listens on tcp and udp 111, and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port number on the server. When a remote host makes an RPC call to that server, it first consults with portmap to determine where the RPC server is listening."
rationale: "A small request (~82 bytes via UDP) sent to the Portmapper generates a large response (7x to 28x amplification), which makes it a suitable tool for DDoS attacks. If rpcbind is not required, it is recommended to remove rpcbind package to reduce the potential attack surface."
impact: "Many of the libvirt packages used by Enterprise Linux virtualization, and the nfs-utils package used for The Network File System (NFS), are dependent on the rpcbind package. If the rpcbind package is removed, these dependent packages will be removed as well. Before removing the rpcbind package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the rpcbind.socket and rpcbind.service leaving the rpcbind package installed."
remediation: "Run the following commands to stop rpcbind.socket and rpcbind.service, and remove the rpcbind package: # systemctl stop rpcbind.socket rpcbind.service # apt purge rpcbind - OR - - IF - the rpcbind package is required as a dependency: Run the following commands to stop and mask the rpcbind.socket and rpcbind.service: # systemctl stop rpcbind.socket rpcbind.service # systemctl mask rpcbind.socket rpcbind.service."
compliance:
- cis: ["2.1.12"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1498", "T1498.002", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s rpcbind -> r:package 'rpcbind' is not installed"
- "not c:systemctl show rpcbind.socket rpcbind.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.13 Ensure rsync services are not in use. (Automated)
- id: 35573
title: "Ensure rsync services are not in use."
description: "The rsync service can be used to synchronize files between systems over network links."
rationale: "rsync.service presents a security risk as the rsync protocol is unencrypted. The rsync package should be removed to reduce the attack area of the system."
impact: "There may be packages that are dependent on the rsync package. If the rsync package is removed, these dependent packages will be removed as well. Before removing the rsync package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask rsync.service leaving the rsync package installed."
remediation: "Run the following commands to stop rsync.service, and remove the rsync package: # systemctl stop rsync.service # apt purge rsync - OR - - IF - the rsync package is required as a dependency: Run the following commands to stop and mask rsync.service: # systemctl stop rsync.service # systemctl mask rsync.service."
compliance:
- cis: ["2.1.13"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1105", "T1203", "T1210", "T1543", "T1543.002", "T1570"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s rsync -> r:package 'rsync' is not installed"
- 'not c:systemctl show rsync.service -> r:^LoadState=loaded|^ActiveState=active'
# 2.1.14 Ensure samba file server services are not in use. (Automated)
- id: 35574
title: "Ensure samba file server services are not in use."
description: "The Samba daemon allows system administrators to configure their Linux systems to share file systems and directories with Windows desktops. Samba will advertise the file systems and directories via the Server Message Block (SMB) protocol. Windows desktop users will be able to mount these directories and file systems as letter drives on their systems."
rationale: "If there is no need to mount directories and file systems to Windows systems, then this service should be deleted to reduce the potential attack surface."
impact: "There may be packages that are dependent on the samba package. If the samba package is removed, these dependent packages will be removed as well. Before removing the samba package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the smbd.service leaving the samba package installed."
remediation: "Run the following commands to stop smbd.service and remove samba package: # systemctl stop smbd.service # apt purge samba - OR - - IF - the samba package is required as a dependency: Run the following commands to stop and mask the smbd.service: # systemctl stop smbd.service # systemctl mask smbd.service."
compliance:
- cis: ["2.1.14"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1005", "T1039", "T1083", "T1135", "T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s samba -> r:package 'samba' is not installed"
- "not c:systemctl show smbd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.15 Ensure snmp services are not in use. (Automated)
- id: 35575
title: "Ensure snmp services are not in use."
description: "Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment, computer equipment and devices like UPSs. Net-SNMP is a suite of applications used to implement SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901-1908), and SNMPv3 (RFCs 3411-3418) using both IPv4 and IPv6. Support for SNMPv2 classic (a.k.a. \"SNMPv2 historic\" - RFCs 1441-1452) was dropped with the 4.0 release of the UCD-snmp package. The Simple Network Management Protocol (SNMP) server is used to listen for SNMP commands from an SNMP management system, execute the commands or collect the information and then send results back to the requesting system."
rationale: "The SNMP server can communicate using SNMPv1, which transmits data in the clear and does not require authentication to execute commands. SNMPv3 replaces the simple/clear text password sharing used in SNMPv2 with more securely encoded parameters. If the the SNMP service is not required, the snmpd package should be removed to reduce the attack surface of the system. Note: If SNMP is required: - The server should be configured for SNMP v3 only. User Authentication and Message Encryption should be configured. If SNMP v2 is absolutely necessary, modify the community strings' values. -."
impact: "There may be packages that are dependent on the snmpd package. If the snmpd package is removed, these packages will be removed as well. Before removing the snmpd package, review any dependent packages to determine if they are required on the system. If a dependent package is required, stop and mask the snmpd.service leaving the snmpd package installed."
remediation: "Run the following commands to stop snmpd.service and remove the snmpd package: # systemctl stop snmpd.service # apt purge snmpd - OR - If the package is required for dependencies: Run the following commands to stop and mask the snmpd.service: # systemctl stop snmpd.service # systemctl mask snmpd.service."
compliance:
- cis: ["2.1.15"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s snmpd -> r:package 'snmpd' is not installed"
- "not c:systemctl show snmpd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.16 Ensure tftp server services are not in use. (Automated)
- id: 35576
title: "Ensure tftp server services are not in use."
description: "Trivial File Transfer Protocol (TFTP) is a simple protocol for exchanging files between two TCP/IP machines. TFTP servers allow connections from a TFTP Client for sending and receiving files."
rationale: "Unless there is a need to run the system as a TFTP server, it is recommended that the package be removed to reduce the potential attack surface. TFTP does not have built-in encryption, access control or authentication. This makes it very easy for an attacker to exploit TFTP to gain access to files."
impact: "TFTP is often used to provide files for network booting such as for PXE based installation of servers. There may be packages that are dependent on the tftpd-hpa package. If the tftpd-hpa package is removed, these dependent packages will be removed as well. Before removing the tftpd-hpa package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask tftpd-hpa.service leaving the tftpd-hpa package installed."
remediation: "Run the following commands to stop tftpd-hpa.service, and remove the tftpd-hpa package: # systemctl stop tftpd-hpa.service # apt purge tftpd-hpa - OR - - IF - the tftpd-hpa package is required as a dependency: Run the following commands to stop and mask tftpd-hpa.service: # systemctl stop tftpd-hpa.service # systemctl mask tftpd-hpa.service."
compliance:
- cis: ["2.1.16"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s tftpd-hpa -> r:package 'tftpd-hpa' is not installed"
- "not c:systemctl show tftpd-hpa.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.17 Ensure web proxy server services are not in use. (Automated)
- id: 35577
title: "Ensure web proxy server services are not in use."
description: "Squid is a standard proxy server used in many distributions and environments."
rationale: "Unless a system is specifically set up to act as a proxy server, it is recommended that the squid package be removed to reduce the potential attack surface. Note: Several HTTP proxy servers exist. These should be checked and removed unless required."
impact: "There may be packages that are dependent on the squid package. If the squid package is removed, these dependent packages will be removed as well. Before removing the squid package, review any dependent packages to determine if they are required on the system. - IF - a dependent package is required: stop and mask the squid.service leaving the squid package installed."
remediation: "Run the following commands to stop squid.service and remove the squid package: # systemctl stop squid.service # apt purge squid - OR - If the squid package is required as a dependency: Run the following commands to stop and mask the squid.service: # systemctl stop squid.service # systemctl mask squid.service."
compliance:
- cis: ["2.1.17"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s squid -> r:package 'squid' is not installed"
- "not c:systemctl show squid.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.18 Ensure web server services are not in use. (Automated)
- id: 35578
title: "Ensure web server services are not in use."
description: "Web servers provide the ability to host web site content."
rationale: "Unless there is a local site approved requirement to run a web server service on the system, web server packages should be removed to reduce the potential attack surface."
impact: "Removal of web server packages will remove that ability for the server to host web services. - IF - the web server package is required for a dependency, any related service or socket should be stopped and masked. Note: If the remediation steps to mask a service are followed and that package is not installed on the system, the service and/or socket will still be masked. If the package is installed due to an approved requirement to host a web server, the associated service and/or socket would need to be unmasked before it could be enabled and/or started."
remediation: "Run the following commands to stop httpd.socket, httpd.service, and nginx.service, and remove apache2 and nginx packages: # systemctl stop apache2.socket apache2.service nginx.service # apt purge apache2 nginx - OR - - IF - a package is installed and is required for dependencies: Run the following commands to stop and mask apache2.socket, apache2.service, and nginx.service: # systemctl stop apache2.socket apache2.service nginx.service # systemctl mask apache2.socket apache2.service nginx.service Note: Other web server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service and socket should be stopped and masked."
compliance:
- cis: ["2.1.18"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "not c:dpkg-query -s apache2 nginx -> r:^Status: install ok installed"
- "not c:systemctl show apache2.socket apache2.service nginx.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.19 Ensure xinetd services are not in use. (Automated)
- id: 35579
title: "Ensure xinetd services are not in use."
description: "The eXtended InterNET Daemon (xinetd) is an open source super daemon that replaced the original inetd daemon. The xinetd daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests."
rationale: "If there are no xinetd services required, it is recommended that the package be removed to reduce the attack surface are of the system. Note: If an xinetd service or services are required, ensure that any xinetd service not required is stopped and masked."
impact: "There may be packages that are dependent on the xinetd package. If the xinetd package is removed, these dependent packages will be removed as well. Before removing the xinetd package, review any dependent packages to determine if they are required on the system. -IF- a dependent package is required: stop and mask xinetd.service leaving the xinetd package installed."
remediation: "Run the following commands to stop xinetd.service, and remove the xinetd package: # systemctl stop xinetd.service # apt purge xinetd -OR- -IF- the xinetd package is required as a dependency: Run the following commands to stop and mask the xinetd.service: # systemctl stop xinetd.service # systemctl mask xinetd.service."
compliance:
- cis: ["2.1.19"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1210", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: any
rules:
- "c:dpkg-query -s xinetd -> r:package 'xinetd' is not installed"
- "not c:systemctl show xinetd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.1.21 Ensure mail transfer agent is configured for local-only mode. (Automated)
- id: 35581
title: "Ensure mail transfer agent is configured for local-only mode."
description: "Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail."
rationale: "The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems."
remediation: "Edit /etc/postfix/main.cf and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below: inet_interfaces = loopback-only Run the following command to restart postfix: # systemctl restart postfix Note: - This recommendation is designed around the postfix mail server. - Depending on your environment you may have an alternative MTA installed such as exim4. If this is the case consult the documentation for your installed MTA to configure the recommended state."
compliance:
- cis: ["2.1.21"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1018", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'not c:ss -lntu -> r::25\s|:465\s|:587\s && r:\s+127.0.0.\d+:|\s+[::1]:'
# 2.1.22 Ensure only approved services are listening on a network interface. (Manual) - Not Implemented
# 2.2.1 Ensure NIS Client is not installed. (Automated)
- id: 35582
title: "Ensure NIS Client is not installed."
description: "The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client was used to bind a machine to an NIS server and receive the distributed configuration files."
rationale: "The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed."
impact: "Many insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."
remediation: "Uninstall nis: # apt purge nis."
compliance:
- cis: ["2.2.1"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["2.6"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.12.5.1", "A.12.6.2"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s nis -> r:package 'nis' is not installed"
# 2.2.2 Ensure rsh client is not installed. (Automated)
- id: 35583
title: "Ensure rsh client is not installed."
description: "The rsh-client package contains the client commands for the rsh services."
rationale: "These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the rsh-client package removes the clients for rsh , rcp and rlogin."
impact: "Many insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."
remediation: "Uninstall rsh: # apt purge rsh-client."
compliance:
- cis: ["2.2.2"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1041", "M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1040", "T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s rsh-client -> r:package 'rsh-client' is not installed"
# 2.2.3 Ensure talk client is not installed. (Automated)
- id: 35584
title: "Ensure talk client is not installed."
description: "The talk software makes it possible for users to send and receive messages across systems through a terminal session. The talk client, which allows initialization of talk sessions, is installed by default."
rationale: "The software presents a security risk as it uses unencrypted protocols for communication."
impact: "Many insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."
remediation: "Uninstall talk: # apt purge talk."
compliance:
- cis: ["2.2.3"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1041", "M1042"]
- mitre_tactics: ["TA0006", "TA0008"]
- mitre_techniques: ["T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s talk -> r:package 'talk' is not installed"
# 2.2.4 Ensure telnet client is not installed. (Automated)
- id: 35585
title: "Ensure telnet client is not installed."
description: "The inetutils-telnet package contains the telnet client, which allows users to start connections to other systems via the telnet protocol."
rationale: "The telnet protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The ssh package provides an encrypted session and stronger security and is included in most Linux distributions."
impact: "Many insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."
remediation: "Run the following commands to uninstall telnet & inetutils-telnet: # apt purge telnet # apt purge inetutils-telnet."
compliance:
- cis: ["2.2.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1041", "M1042"]
- mitre_tactics: ["TA0006", "TA0008"]
- mitre_techniques: ["T1040", "T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "not c:dpkg-query -s telnet inetutils-telnet -> r:^Status: install ok installed"
# 2.2.5 Ensure ldap client is not installed. (Automated)
- id: 35586
title: "Ensure ldap client is not installed."
description: "The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."
rationale: "If the system will not need to act as an LDAP client, it is recommended that the software be removed to reduce the potential attack surface."
impact: "Removing the LDAP client will prevent or inhibit using LDAP for authentication in your environment."
remediation: "Uninstall ldap-utils: # apt purge ldap-utils."
compliance:
- cis: ["2.2.5"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "c:dpkg-query -s ldap-utils -> r:package 'ldap-utils' is not installed"
# 2.2.6 Ensure ftp client is not installed. (Automated)
- id: 35587
title: "Ensure ftp client is not installed."
description: "tnftp an enhanced FTP client, is the user interface to the Internet standard File Transfer Protocol. The program allows a user to transfer files to and from a remote network site."
rationale: "Unless there is a need to run the system using Internet standard File Transfer Protocol (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface."
remediation: "Run the following commands to uninstall tnftp & ftp: # apt purge ftp # apt purge tnftp."
compliance:
- cis: ["2.2.6"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1203", "T1543", "T1543.002"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "not c:dpkg-query -s ftp tnftp -> r:^Status: install ok installed"
# 2.3.1.1 Ensure a single time synchronization daemon is in use. (Automated) - Not Implemented
# 2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver. (Automated)
- id: 35588
title: "Ensure systemd-timesyncd configured with authorized timeserver."
description: "NTP= - A space-separated list of NTP server host names or IP addresses. During runtime this list is combined with any per-interface NTP servers acquired from systemd-networkd.service(8). systemd-timesyncd will contact all configured system or per-interface servers in turn, until one responds. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. This setting defaults to an empty list. FallbackNTP= - A space-separated list of NTP server host names or IP addresses to be used as the fallback NTP servers. Any per-interface NTP servers obtained from systemd-networkd.service(8) take precedence over this setting, as do any servers set via NTP= above. This setting is hence only relevant if no other NTP server information is known. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. If this option is not given, a compiled-in list of NTP servers is used."
rationale: "Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations."
remediation: "Set NTP and/or FallbackNPT parameters to local site approved authoritative time server(s) in /etc/systemd/timesyncd.conf or a file in /etc/systemd/timesyncd.conf.d/ ending in .conf in the [Time] section: Example file: [Time] NTP=time.nist.gov # Uses the generic name for NIST's time servers FallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov # Space separated list of NIST time servers Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"NTP=time.nist.gov\" \"FallbackNTP=time-a-g.nist.gov time-b- g.nist.gov time-c-g.nist.gov\") [ ! -d /etc/systemd/timesyncd.conf.d/ ] && mkdir /etc/systemd/timesyncd.conf.d/ if grep -Psq -- '^\\h*\\[Time\\]' /etc/systemd/timesyncd.conf.d/60- timesyncd.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf else printf '%s\\n' \"\" \"[Time]\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf fi } Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten Run to following command to update the parameters in the service: # systemctl reload-or-restart systemd-journald."
references:
- 'https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html'
- 'https://tf.nist.gov/tf-cgi/servers.cgi'
compliance:
- cis: ["2.3.2.1"]
- cis_csc_v8: ["8.4"]
- cis_csc_v7: ["6.1"]
- cmmc_v2.0: ["AU.L2-3.3.7"]
- iso_27001-2013: ["A.12.4.4"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.4"]
- pci_dss_v4.0: ["10.6", "10.6.1", "10.6.2", "10.6.3"]
- soc_2: ["CC4.1", "CC5.2"]
condition: any
rules:
- "f:/etc/systemd/timesyncd.conf -> r:^NTP|^FallbackNTP"
- "not c:systemctl show systemd-timesyncd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.3.2.2 Ensure systemd-timesyncd is enabled and running. (Automated)
- id: 35589
title: "Ensure systemd-timesyncd is enabled and running."
description: "systemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network."
rationale: "systemd-timesyncd needs to be enabled and running in order to synchronize the system to a timeserver. Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations."
remediation: "- IF - systemd-timesyncd is in use on the system, run the following commands: Run the following command to unmask systemd-timesyncd.service: # systemctl unmask systemd-timesyncd.service Run the following command to enable and start systemd-timesyncd.service: # systemctl --now enable systemd-timesyncd.service - OR - If another time synchronization service is in use on the system, run the following command to stop and mask systemd-timesyncd: # systemctl --now mask systemd-timesyncd.service."
compliance:
- cis: ["2.3.2.2"]
- cis_csc_v8: ["8.4"]
- cis_csc_v7: ["6.1"]
- cmmc_v2.0: ["AU.L2-3.3.7"]
- iso_27001-2013: ["A.12.4.4"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.4"]
- pci_dss_v4.0: ["10.6", "10.6.1", "10.6.2", "10.6.3"]
- soc_2: ["CC4.1", "CC5.2"]
condition: all
rules:
- "c:systemctl is-enabled systemd-timesyncd.service -> r:enabled"
- "c:systemctl is-active systemd-timesyncd.service -> r:active"
# 2.3.3.1 Ensure chrony is configured with authorized timeserver. (Automated)
- id: 35590
title: "Ensure chrony is configured with authorized timeserver."
description: "The server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server's system time will never be influenced by that of a client. o This directive can be used multiple times to specify multiple servers. o The directive is immediately followed by either the name of the server, or its IP address. - pool o The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time. o This directive can be used multiple times to specify multiple pools. o All options valid in the server directive can be used in this directive too."
rationale: "Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations."
remediation: "Edit /etc/chrony/chrony.conf or a file ending in .sources in /etc/chrony/sources.d/ and add or edit server or pool lines as appropriate according to local site policy: Edit the Chrony configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy <[server|pool]> <[remote-server|remote-pool]> Example script to add a drop-in configuration for the pool directive: #!/usr/bin/env bash { [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/ printf '%s\\n' \"\" \"#The maxsources option is unique to the pool directive\" \\ \"pool time.nist.gov iburst maxsources 4\" >> /etc/chrony/sources.d/60- sources.sources chronyc reload sources &>/dev/null } Example script to add a drop-in configuration for the server directive: #!/usr/bin/env bash { [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/ printf '%s\\n' \"\" \"server time-a-g.nist.gov iburst\" \"server 132.163.97.3 iburst\" \\ \"server time-d-b.nist.gov iburst\" >> /etc/chrony/sources.d/60- sources.sources chronyc reload sources &>/dev/null } Run the following command to reload the chronyd config: # systemctl reload-or-restart chronyd."
compliance:
- cis: ["2.3.3.1"]
- cis_csc_v8: ["8.4"]
- cis_csc_v7: ["6.1"]
- cmmc_v2.0: ["AU.L2-3.3.7"]
- iso_27001-2013: ["A.12.4.4"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.4"]
- pci_dss_v4.0: ["10.6", "10.6.1", "10.6.2", "10.6.3"]
- soc_2: ["CC4.1", "CC5.2"]
condition: any
rules:
- 'f:/etc/chrony/chrony.conf -> r:^server|^pool'
- 'd:/etc/chrony/sources.d -> r:\.*.sources -> r:^server|^pool'
- 'not c:systemctl show chrony.service -> r:^LoadState=loaded|^ActiveState=active'
# 2.3.3.2 Ensure chrony is running as user _chrony. (Automated)
- id: 35591
title: "Ensure chrony is running as user _chrony."
description: "The chrony package is installed with a dedicated user account _chrony. This account is granted the access required by the chronyd service."
rationale: "The chronyd service should run with only the required privlidges."
remediation: "Add or edit the user line to /etc/chrony/chrony.conf or a file ending in .conf in /etc/chrony/conf.d/: user _chrony - OR - If another time synchronization service is in use on the system, run the following command to remove chrony from the system: # apt purge chrony # apt autoremove chrony."
compliance:
- cis: ["2.3.3.2"]
- cis_csc_v8: ["8.4"]
- cis_csc_v7: ["6.1"]
- cmmc_v2.0: ["AU.L2-3.3.7"]
- iso_27001-2013: ["A.12.4.4"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.4"]
- pci_dss_v4.0: ["10.6", "10.6.1", "10.6.2", "10.6.3"]
- soc_2: ["CC4.1", "CC5.2"]
condition: all
rules:
- 'c:ps -ef -> r:_chrony\.+chronyd'
- 'd:/etc/chrony/sources.d -> r:\.*.sources -> r:^server|^pool'
- "not c:systemctl show systemd-timesyncd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.3.3.3 Ensure chrony is enabled and running. (Automated)
- id: 35592
title: "Ensure chrony is enabled and running."
description: "chrony is a daemon for synchronizing the system clock across the network."
rationale: "chrony needs to be enabled and running in order to synchronize the system to a timeserver. Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations."
remediation: "- IF - chrony is in use on the system, run the following commands: Run the following command to unmask chrony.service: # systemctl unmask chrony.service Run the following command to enable and start chrony.service: # systemctl --now enable chrony.service - OR - If another time synchronization service is in use on the system, run the following command to remove chrony: # apt purge chrony # apt autoremove chrony."
compliance:
- cis: ["2.3.3.3"]
- cis_csc_v8: ["8.4"]
- cis_csc_v7: ["6.1"]
- cmmc_v2.0: ["AU.L2-3.3.7"]
- iso_27001-2013: ["A.12.4.4"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.4"]
- pci_dss_v4.0: ["10.6", "10.6.1", "10.6.2", "10.6.3"]
- soc_2: ["CC4.1", "CC5.2"]
condition: all
rules:
- "c:systemctl show chrony.service -> r:^LoadState=loaded"
- "c:systemctl show chrony.service -> r:^ActiveState=active"
- "not c:systemctl show systemd-timesyncd.service -> r:^LoadState=loaded|^ActiveState=active"
# 2.4.1.1 Ensure cron daemon is enabled and active. (Automated)
- id: 35593
title: "Ensure cron daemon is enabled and active."
description: "The cron daemon is used to execute batch jobs on the system."
rationale: "While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run, and cron is used to execute them."
remediation: "- IF - cron is installed on the system: Run the following commands to unmask, enable, and start cron: # systemctl unmask \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\" # systemctl --now enable \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"."
compliance:
- cis: ["2.4.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
condition: all
rules:
- "c:systemctl show cron.service -> r:^LoadState=loaded"
- "c:systemctl show cron.service -> r:^ActiveState=active"
# 2.4.1.2 Ensure permissions on /etc/crontab are configured. (Automated)
- id: 35594
title: "Ensure permissions on /etc/crontab are configured."
description: "The /etc/crontab file is used by cron to control its own jobs. The commands in this item make sure that root is the user and group owner of the file and that only the owner can access the file."
rationale: "This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on /etc/crontab: # chown root:root /etc/crontab # chmod og-rwx /etc/crontab."
compliance:
- cis: ["2.4.1.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/crontab -> r:Access:\s*\t*\(0600/-rw-------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.3 Ensure permissions on /etc/cron.hourly are configured. (Automated)
- id: 35595
title: "Ensure permissions on /etc/cron.hourly are configured."
description: "This directory contains system cron jobs that need to run on an hourly basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."
rationale: "Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on the /etc/cron.hourly directory: # chown root:root /etc/cron.hourly/ # chmod og-rwx /etc/cron.hourly/."
compliance:
- cis: ["2.4.1.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/cron.hourly/ -> r:Access:\s*\t*\(0700/drwx------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.4 Ensure permissions on /etc/cron.daily are configured. (Automated)
- id: 35596
title: "Ensure permissions on /etc/cron.daily are configured."
description: "The /etc/cron.daily directory contains system cron jobs that need to run on a daily basis. The files in this directory cannot be manipulated by the crontab command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."
rationale: "Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on the /etc/cron.daily directory: # chown root:root /etc/cron.daily/ # chmod og-rwx /etc/cron.daily/."
compliance:
- cis: ["2.4.1.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/cron.daily/ -> r:Access:\s*\t*\(0700/drwx------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.5 Ensure permissions on /etc/cron.weekly are configured. (Automated)
- id: 35597
title: "Ensure permissions on /etc/cron.weekly are configured."
description: "The /etc/cron.weekly directory contains system cron jobs that need to run on a weekly basis. The files in this directory cannot be manipulated by the crontab command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."
rationale: "Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on the /etc/cron.weekly directory: # chown root:root /etc/cron.weekly/ # chmod og-rwx /etc/cron.weekly/."
compliance:
- cis: ["2.4.1.5"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/cron.weekly/ -> r:Access:\s*\t*\(0700/drwx------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.6 Ensure permissions on /etc/cron.monthly are configured. (Automated)
- id: 35598
title: "Ensure permissions on /etc/cron.monthly are configured."
description: "The /etc/cron.monthly directory contains system cron jobs that need to run on a monthly basis. The files in this directory cannot be manipulated by the crontab command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."
rationale: "Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on the /etc/cron.monthly directory: # chown root:root /etc/cron.monthly/ # chmod og-rwx /etc/cron.monthly/."
compliance:
- cis: ["2.4.1.6"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/cron.monthly/ -> r:Access:\s*\t*\(0700/drwx------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.7 Ensure permissions on /etc/cron.d are configured. (Automated)
- id: 35599
title: "Ensure permissions on /etc/cron.d are configured."
description: "The /etc/cron.d directory contains system cron jobs that need to run in a similar manner to the hourly, daily weekly and monthly jobs from /etc/crontab, but require more granular control as to when they run. The files in this directory cannot be manipulated by the crontab command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."
rationale: "Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."
remediation: "- IF - cron is installed on the system: Run the following commands to set ownership and permissions on the /etc/cron.d directory: # chown root:root /etc/cron.d/ # chmod og-rwx /etc/cron.d/."
compliance:
- cis: ["2.4.1.7"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002", "TA0007"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/cron.d/ -> r:Access:\s*\t*\(0700/drwx------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.1.8 Ensure crontab is restricted to authorized users. (Automated)
- id: 35600
title: "Ensure crontab is restricted to authorized users."
description: "crontab is the program used to install, deinstall, or list the tables used to drive the cron daemon. Each user can have their own crontab, and though these are files in /var/spool/cron/crontabs, they are not intended to be edited directly. If the /etc/cron.allow file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the /etc/cron.allow file does not exist but the /etc/cron.deny file does exist, then you must not be listed in the /etc/cron.deny file in order to use this command. If neither of these files exists, then depending on site-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command. If both files exist then /etc/cron.allow takes precedence. Which means that /etc/cron.deny is not considered and your user must be listed in /etc/cron.allow in order to be able to use the crontab. Regardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab. The files /etc/cron.allow and /etc/cron.deny, if they exist, must be either world-readable, or readable by group crontab. If they are not, then cron will deny access to all users until the permissions are fixed. There is one file for each user's crontab under the /var/spool/cron/crontabs directory. Users are not allowed to edit the files under that directory directly to ensure that only users allowed by the system to run periodic tasks can add them, and only syntactically correct crontabs will be written there. This is enforced by having the directory writable only by the crontab group and configuring crontab command with the setgid bid set for that specific group. Note: - Even though a given user is not listed in cron.allow, cron jobs can still be run as that user - The files /etc/cron.allow and /etc/cron.deny, if they exist, only controls administrative access to the crontab command for scheduling and modifying cron jobs."
rationale: "On many systems, only the system administrator is authorized to schedule cron jobs. Using the cron.allow file to control who can run cron jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files."
remediation: "- IF - cron is installed on the system: Run the following script to: - Create /etc/cron.allow if it doesn't exist - Change owner to user root - Change group owner to group root - OR - group crontab if it exists - Change mode to 640 or more restrictive #!/usr/bin/env bash { [ ! -e \"/etc/cron.deny\" ] && touch /etc/cron.allow chmod u-x,g-wx,o-rwx /etc/cron.allow if grep -Pq -- '^\\h*crontab\\:' /etc/group; then chown root:crontab /etc/cron.allow else chown root:root /etc/cron.allow fi } - IF - /etc/cron.deny exists, run the following script to: - Change owner to user root - Change group owner to group root - OR - group crontab if it exists - Change mode to 640 or more restrictive #!/usr/bin/env bash { if [ -e \"/etc/cron.deny\" ]; then chmod u-x,g-wx,o-rwx /etc/cron.deny if grep -Pq -- '^\\h*crontab\\:' /etc/group; then chown root:crontab /etc/cron.deny else chown root:root /etc/cron.deny fi fi } Note: On systems where cron is configured to use the group crontab, if the group crontab is not set as the owner of cron.allow, then cron will deny access to all users and you will see an error similar to: You (<USERNAME>) are not allowed to use this program (crontab) See crontab(1) for more information."
compliance:
- cis: ["2.4.1.8"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "f:/etc/cron.allow"
- 'c:stat /etc/cron.allow -> r:Access:\s*\t*\(0640/-rw-r-----\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 2.4.2.1 Ensure at is restricted to authorized users. (Automated)
- id: 35601
title: "Ensure at is restricted to authorized users."
description: "at allows fairly complex time specifications, extending the POSIX.2 standard. It accepts times of the form HH:MM to run a job at a specific time of day. (If that time is already past, the next day is assumed.) You may also specify midnight, noon, or teatime (4pm) and you can have a time-of-day suffixed with AM or PM for running in the morning or the evening. You can also say what day the job will be run, by giving a date in the form month-name day with an optional year, or giving a date of the form MMDD[CC]YY, MM/DD/[CC]YY, DD.MM.[CC]YY or [CC]YY-MM-DD. The specification of a date must follow the specification of the time of day. You can also give times like now + count time-units, where the time-units can be minutes, hours, days, or weeks and you can tell at to run the job today by suffixing the time with today and to run the job tomorrow by suffixing the time with tomorrow. The /etc/at.allow and /etc/at.deny files determine which user can submit commands for later execution via at or batch. The format of the files is a list of usernames, one on each line. Whitespace is not permitted. If the file /etc/at.allow exists, only usernames mentioned in it are allowed to use at. If /etc/at.allow does not exist, /etc/at.deny is checked, every username not mentioned in it is then allowed to use at. An empty /etc/at.deny means that every user may use at. If neither file exists, only the superuser is allowed to use at."
rationale: "On many systems, only the system administrator is authorized to schedule at jobs. Using the at.allow file to control who can run at jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files."
remediation: "- IF - at is installed on the system: Run the following script to: - /etc/at.allow: o Create the file if it doesn't exist o Change owner or user root o If group daemon exists, change to group daemon, else change group to root o Change mode to 640 or more restrictive - - IF - /etc/at.deny exists: o Change owner or user root o If group daemon exists, change to group daemon, else change group to root o Change mode to 640 or more restrictive #!/usr/bin/env bash { grep -Pq -- '^daemon\\b' /etc/group && l_group=\"daemon\" || l_group=\"root\" [ ! -e \"/etc/at.allow\" ] && touch /etc/at.allow chown root:\"$l_group\" /etc/at.allow chmod u-x,g-wx,o-rwx /etc/at.allow [ -e \"/etc/at.deny\" ] && chown root:\"$l_group\" /etc/at.deny [ -e \"/etc/at.deny\" ] && chmod u-x,g-wx,o-rwx /etc/at.deny }."
compliance:
- cis: ["2.4.2.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0002"]
- mitre_techniques: ["T1053", "T1053.003"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "f:/etc/at.allow"
- 'c:stat -Lc "%a" /etc/at.allow -> n:^(\d)\d\d$ compare <= 6'
- 'c:stat -Lc "%a" /etc/at.allow -> n:^\d(\d)\d$ compare <= 4'
- 'c:stat -Lc "%a" /etc/at.allow -> n:^\d\d(\d)$ compare <= 0'
- 'c:stat -Lc "%U %G" /etc/at.allow -> r:^root root$|^root daemon$'
# 3.1.1 Ensure IPv6 status is identified. (Manual) - Not Implemented
# 3.2.1 Ensure dccp kernel module is not available. (Automated)
- id: 35604
title: "Ensure dccp kernel module is not available."
description: "The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery."
rationale: "- IF - the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface."
remediation: "Run the following script to unload and disable the dccp module: - IF - the dccp kernel module is available in ANY installed kernel: - Create a file ending in .conf with install dccp /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist dccp in the /etc/modprobe.d/ directory - Run modprobe -r dccp 2>/dev/null; rmmod dccp 2>/dev/null to remove dccp from the kernel - IF - the dccp kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env."
compliance:
- cis: ["3.2.1"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1068", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- c:modprobe -n -v dccp -> r:^install /bin/false
- not c:lsmod -> r:dccp
# 3.2.2 Ensure tipc kernel module is not available. (Automated)
- id: 35605
title: "Ensure tipc kernel module is not available."
description: "The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes."
rationale: "- IF - the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."
remediation: "Run the following script to unload and disable the tipc module: - IF - the tipc kernel module is available in ANY installed kernel: - Create a file ending in .conf with install tipc /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist tipc in the /etc/modprobe.d/ directory - Run modprobe -r tipc 2>/dev/null; rmmod tipc 2>/dev/null to remove tipc from the kernel - IF - the tipc kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env."
compliance:
- cis: ["3.2.2"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1068", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- c:modprobe -n -v tipc -> r:^install /bin/false
- not c:lsmod -> r:tipc
# 3.2.3 Ensure rds kernel module is not available. (Automated)
- id: 35606
title: "Ensure rds kernel module is not available."
description: "The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation."
rationale: "- IF - the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."
remediation: "Run the following script to unload and disable the rds module: - IF - the rds kernel module is available in ANY installed kernel: - Create a file ending in .conf with install rds /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist rds in the /etc/modprobe.d/ directory - Run modprobe -r rds 2>/dev/null; rmmod rds 2>/dev/null to remove rds from the kernel - IF - the rds kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env."
compliance:
- cis: ["3.2.3"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1068", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- d:/etc/modprobe.d/ -> r:\.+.conf$ -> r:^install\s*\t*rds\s*\t*/bin/false
- d:/etc/modprobe.d/ -> r:\.+.conf$ -> r:^blacklist\s*\t*rds
- c:modprobe -n -v rds -> r:^install /bin/false
- not c:lsmod -> r:rds
# 3.2.4 Ensure sctp kernel module is not available. (Automated)
- id: 35607
title: "Ensure sctp kernel module is not available."
description: "The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP."
rationale: "- IF - the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."
remediation: "Run the following script to unload and disable the sctp module: - IF - the sctp kernel module is available in ANY installed kernel: - Create a file ending in .conf with install sctp /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist sctp in the /etc/modprobe.d/ directory - Run modprobe -r sctp 2>/dev/null; rmmod sctp 2>/dev/null to remove sctp from the kernel - IF - the sctp kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env."
compliance:
- cis: ["3.2.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1068", "T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- d:/etc/modprobe.d/ -> r:\.+.conf$ -> r:^install\s*\t*sctp\s*\t*/bin/false
- d:/etc/modprobe.d/ -> r:\.+.conf$ -> r:^blacklist\s*\t*sctp
- c:modprobe -n -v sctp -> r:^install /bin/false
- not c:lsmod -> r:sctp
# 3.3.1 Ensure ip forwarding is disabled. (Automated)
- id: 35608
title: "Ensure ip forwarding is disabled."
description: "The net.ipv4.ip_forward and net.ipv6.conf.all.forwarding flags are used to tell the system whether it can forward packets or not."
rationale: "Setting net.ipv4.ip_forward and net.ipv6.conf.all.forwarding to 0 ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router."
impact: "IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router. Many Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding."
remediation: "Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.ip_forward = 0 Example: # printf '%s\\n' \"net.ipv4.ip_forward = 0\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.ip_forward=0 sysctl -w net.ipv4.route.flush=1 } - IF - IPv6 is enabled on the system: Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv6.conf.all.forwarding = 0 Example: # printf '%s\\n' \"net.ipv6.conf.all.forwarding = 0\" >> /etc/sysctl.d/60- netipv6_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv6.conf.all.forwarding=0 sysctl -w net.ipv6.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.1"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0009"]
- mitre_techniques: ["T1557"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.ip_forward -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.all.forwarding -> r:=\s*\t*0$'
# 3.3.2 Ensure packet redirect sending is disabled. (Automated)
- id: 35609
title: "Ensure packet redirect sending is disabled."
description: "ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects."
rationale: "An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system."
impact: "IP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.send_redirects = 0 - net.ipv4.conf.default.send_redirects = 0 Example: # printf '%s\\n' \"net.ipv4.conf.all.send_redirects = 0\" \"net.ipv4.conf.default.send_redirects = 0\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.send_redirects=0 sysctl -w net.ipv4.conf.default.send_redirects=0 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.2"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0009"]
- mitre_techniques: ["T1557"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.send_redirects -> r:=\s*\t*0$'
- 'c:sysctl net.ipv4.conf.default.send_redirects -> r:=\s*\t*0$'
# 3.3.3 Ensure bogus icmp responses are ignored. (Automated)
- id: 35610
title: "Ensure bogus icmp responses are ignored."
description: "Setting net.ipv4.icmp_ignore_bogus_error_responses to 1 prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages."
rationale: "Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages."
remediation: "Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.icmp_ignore_bogus_error_responses = 1 Example: # printf '%s\\n' \"net.ipv4.icmp_ignore_bogus_error_responses = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.3"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1053"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1562", "T1562.006"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.icmp_ignore_bogus_error_responses -> r:=\s*\t*1$'
# 3.3.4 Ensure broadcast icmp requests are ignored. (Automated)
- id: 35611
title: "Ensure broadcast icmp requests are ignored."
description: "Setting net.ipv4.icmp_echo_ignore_broadcasts to 1 will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses."
rationale: "Accepting ICMP echo and timestamp requests with broadcast or multicast destinations for your network could be used to trick your host into starting (or participating) in a Smurf attack. A Smurf attack relies on an attacker sending large amounts of ICMP broadcast messages with a spoofed source address. All hosts receiving this message and responding would send echo-reply messages back to the spoofed address, which is probably not routable. If many hosts respond to the packets, the amount of traffic on the network could be significantly multiplied."
remediation: "Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.icmp_echo_ignore_broadcasts = 1 Example: # printf '%s\\n' \"net.ipv4.icmp_echo_ignore_broadcasts = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1037"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1498", "T1498.001"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.icmp_echo_ignore_broadcasts -> r:=\s*\t*1$'
# 3.3.5 Ensure icmp redirects are not accepted. (Automated)
- id: 35612
title: "Ensure icmp redirects are not accepted."
description: "ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables."
rationale: "ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting net.ipv4.conf.all.accept_redirects, net.ipv4.conf.default.accept_redirects, net.ipv6.conf.all.accept_redirects, and net.ipv6.conf.default.accept_redirects to 0, the system will not accept any ICMP redirect messages, and therefore, won't allow outsiders to update the system's routing tables."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.accept_redirects = 0 - net.ipv4.conf.default.accept_redirects = 0 Example: # printf '%s\\n' \"net.ipv4.conf.all.accept_redirects = 0\" \"net.ipv4.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.accept_redirects=0 sysctl -w net.ipv4.conf.default.accept_redirects=0 sysctl -w net.ipv4.route.flush=1 } - IF - IPv6 is enabled on the system: Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv6.conf.all.accept_redirects = 0 - net.ipv6.conf.default.accept_redirects = 0 Example: # printf '%s\\n' \"net.ipv6.conf.all.accept_redirects = 0\" \"net.ipv6.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60- netipv6_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv6.conf.all.accept_redirects=0 sysctl -w net.ipv6.conf.default.accept_redirects=0 sysctl -w net.ipv6.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.5"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0009"]
- mitre_techniques: ["T1557"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.accept_redirects -> r:=\s*\t*0$'
- 'c:sysctl net.ipv4.conf.default.accept_redirects -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.all.accept_redirects -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.default.accept_redirects -> r:=\s*\t*0$'
# 3.3.6 Ensure secure icmp redirects are not accepted. (Automated)
- id: 35613
title: "Ensure secure icmp redirects are not accepted."
description: "Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure."
rationale: "It is still possible for even known gateways to be compromised. Setting net.ipv4.conf.all.secure_redirects and net.ipv4.conf.default.secure_redirects to 0 protects the system from routing table updates by possibly compromised known gateways."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.secure_redirects = 0 - net.ipv4.conf.default.secure_redirects = 0 Example: # printf '%s\\n' \"net.ipv4.conf.all.secure_redirects = 0\" \"net.ipv4.conf.default.secure_redirects = 0\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.secure_redirects=0 sysctl -w net.ipv4.conf.default.secure_redirects=0 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.6"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0009"]
- mitre_techniques: ["T1557"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.secure_redirects -> r:=\s*\t*0$'
- 'c:sysctl net.ipv4.conf.default.secure_redirects -> r:=\s*\t*0$'
# 3.3.7 Ensure reverse path filtering is enabled. (Automated)
- id: 35614
title: "Ensure reverse path filtering is enabled."
description: "Setting net.ipv4.conf.all.rp_filter and net.ipv4.conf.default.rp_filter to 1 forces the Linux kernel to utilize reverse path filtering on a received packet to determine if the packet was valid. Essentially, with reverse path filtering, if the return packet does not go out the same interface that the corresponding source packet came from, the packet is dropped (and logged if log_martians is set)."
rationale: "Setting net.ipv4.conf.all.rp_filter and net.ipv4.conf.default.rp_filter to 1 is a good way to deter attackers from sending your system bogus packets that cannot be responded to. One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing."
impact: "If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.rp_filter = 1 - net.ipv4.conf.default.rp_filter = 1 Example: # printf '%s\\n' \"net.ipv4.conf.all.rp_filter = 1\" \"net.ipv4.conf.default.rp_filter = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.rp_filter=1 sysctl -w net.ipv4.conf.default.rp_filter=1 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.7"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0040"]
- mitre_techniques: ["T1498", "T1498.001"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.rp_filter -> r:=\s*\t*1$'
- 'c:sysctl net.ipv4.conf.default.rp_filter -> r:=\s*\t*1$'
# 3.3.8 Ensure source routed packets are not accepted. (Automated)
- id: 35615
title: "Ensure source routed packets are not accepted."
description: "In networking, source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non-source routed packets travel a path determined by routers in the network. In some cases, systems may not be routable or reachable from some locations (e.g. private addresses vs. Internet routable), and so source routed packets would need to be used."
rationale: "Setting net.ipv4.conf.all.accept_source_route, net.ipv4.conf.default.accept_source_route, net.ipv6.conf.all.accept_source_route and net.ipv6.conf.default.accept_source_route to 0 disables the system from accepting source routed packets. Assume this system was capable of routing packets to Internet routable addresses on one interface and private addresses on another interface. Assume that the private addresses were not routable to the Internet routable addresses and vice versa. Under normal routing circumstances, an attacker from the Internet routable addresses could not use the system as a way to reach the private address systems. If, however, source routed packets were allowed, they could be used to gain access to the private address systems as the route could be specified, rather than rely on routing protocols that did not allow this routing."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.accept_source_route = 0 - net.ipv4.conf.default.accept_source_route = 0 Example: # printf '%s\\n' \"net.ipv4.conf.all.accept_source_route = 0\" \"net.ipv4.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.accept_source_route=0 sysctl -w net.ipv4.conf.default.accept_source_route=0 sysctl -w net.ipv4.route.flush=1 } - IF - IPv6 is enabled on the system: Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv6.conf.all.accept_source_route = 0 - net.ipv6.conf.default.accept_source_route = 0 Example: # printf '%s\\n' \"net.ipv6.conf.all.accept_source_route = 0\" \"net.ipv6.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60- netipv6_sysctl.conf Run the following command to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv6.conf.all.accept_source_route=0 sysctl -w net.ipv6.conf.default.accept_source_route=0 sysctl -w net.ipv6.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.8"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1590", "T1590.005"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.accept_source_route -> r:=\s*\t*0$'
- 'c:sysctl net.ipv4.conf.default.accept_source_route -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.all.accept_source_route -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.default.accept_source_route -> r:=\s*\t*0$'
# 3.3.9 Ensure suspicious packets are logged. (Automated)
- id: 35616
title: "Ensure suspicious packets are logged."
description: "When enabled, this feature logs packets with un-routable source addresses to the kernel log."
rationale: "Setting net.ipv4.conf.all.log_martians and net.ipv4.conf.default.log_martians to 1 enables this feature. Logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system."
remediation: "Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.conf.all.log_martians = 1 - net.ipv4.conf.default.log_martians = 1 Example: # printf '%s\\n' \"net.ipv4.conf.all.log_martians = 1\" \"net.ipv4.conf.default.log_martians = 1\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.conf.all.log_martians=1 sysctl -w net.ipv4.conf.default.log_martians=1 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.9"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'c:sysctl net.ipv4.conf.all.log_martians -> r:=\s*\t*1$'
- 'c:sysctl net.ipv4.conf.default.log_martians -> r:=\s*\t*1$'
# 3.3.10 Ensure tcp syn cookies is enabled. (Automated)
- id: 35617
title: "Ensure tcp syn cookies is enabled."
description: "When tcp_syncookies is set, the kernel will handle TCP SYN packets normally until the half-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. Instead, the kernel simply replies to the SYN with a SYN/ACK, but will include a specially crafted TCP sequence number that encodes the source and destination IP address and port number and the time the packet was sent. A legitimate connection would send the ACK packet of the three way handshake with the specially crafted sequence number. This allows the system to verify that it has received a valid response to a SYN cookie and allow the connection, even though there is no corresponding SYN in the queue."
rationale: "Attackers use SYN flood attacks to perform a denial of service attacked on a system by sending many SYN packets without completing the three way handshake. This will quickly use up slots in the kernel's half-open connection queue and prevent legitimate connections from succeeding. Setting net.ipv4.tcp_syncookies to 1 enables SYN cookies, allowing the system to keep accepting valid connections, even if under a denial of service attack."
remediation: "Set the following parameter in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv4.tcp_syncookies = 1 Example: # printf '%s\\n' \"net.ipv4.tcp_syncookies = 1\" >> /etc/sysctl.d/60- netipv4_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv4.tcp_syncookies=1 sysctl -w net.ipv4.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.10"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1037"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1499", "T1499.001"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv4.tcp_syncookies -> r:=\s*\t*1$'
# 3.3.11 Ensure ipv6 router advertisements are not accepted. (Automated)
- id: 35618
title: "Ensure ipv6 router advertisements are not accepted."
description: "Routers periodically multicast Router Advertisement messages to announce their availability and convey information to neighboring nodes that enable them to be automatically configured on the network. net.ipv6.conf.all.accept_ra and net.ipv6.conf.default.accept_ra determine the systems ability to accept these advertisements."
rationale: "It is recommended that systems do not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes. Setting net.ipv6.conf.all.accept_ra and net.ipv6.conf.default.accept_ra to 0 disables the system's ability to accept IPv6 router advertisements."
remediation: "- IF - IPv6 is enabled on the system: Set the following parameters in /etc/sysctl.conf or a file in /etc/sysctl.d/ ending in .conf: - net.ipv6.conf.all.accept_ra = 0 - net.ipv6.conf.default.accept_ra = 0 Example: # printf '%s\\n' \"net.ipv6.conf.all.accept_ra = 0\" \"net.ipv6.conf.default.accept_ra = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf Run the following script to set the active kernel parameters: #!/usr/bin/env bash { sysctl -w net.ipv6.conf.all.accept_ra=0 sysctl -w net.ipv6.conf.default.accept_ra=0 sysctl -w net.ipv6.route.flush=1 } Note: If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten."
compliance:
- cis: ["3.3.11"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1030", "M1042"]
- mitre_tactics: ["TA0006", "TA0040"]
- mitre_techniques: ["T1557"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sysctl net.ipv6.conf.all.accept_ra -> r:=\s*\t*0$'
- 'c:sysctl net.ipv6.conf.default.accept_ra -> r:=\s*\t*0$'
# 4.1.1 Ensure a single firewall configuration utility is in use. (Automated)
- id: 35619
title: "Ensure a single firewall configuration utility is in use."
description: "In Linux security, employing a single, effective firewall configuration utility ensures that only legitimate traffic gets processed, reducing the system's exposure to potential threats. The choice between ufw, nftables, and iptables depends on organizational needs. Note: iptables is being phased out, and support for iptables will be reduced over time. It is recommended to transition towards either nftables or ufw as the default firewall management tool."
rationale: "Proper configuration of a single firewall utility minimizes cyber threats and protects services and data, while avoiding vulnerabilities like open ports or exposed services. Standardizing on a single tool simplifies management, reduces errors, and fortifies security across Linux systems."
impact: "The use of more than one firewall utility may produce unexpected results."
remediation: "Remediating to a single firewall configuration is a complex process and involves several steps. The following provides the basic steps to follow for a single firewall configuration: 1. Determine which firewall utility best fits organizational needs 2. Follow the recommendations in the subsequent subsection for the single firewall to be used Note: Review the firewall subsection overview for the selected firewall to be used, it contains a script to simplify this process. 3. Return to this recommendation to ensure a single firewall configuration utility is in use."
references:
- 'https://wiki.debian.org/DebianFirewall'
- 'https://wiki.ubuntu.com/UncomplicatedFirewall'
- 'https://assets.ubuntu.com/v1/544d9904-ubuntu-server-guide-2024-01-22.pdf'
- 'https://www.debian.org/doc/manuals/debian-reference/debian-reference.en.pdf'
compliance:
- cis: ["4.1.1"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- 'c:sh -c "systemctl show ufw.service nft.service iptables.service | grep -cE \"^ActiveState=active\"" -> n:^(\p*\d+) compare == 1'
- 'c:sh -c "systemctl show ufw.service nft.service iptables.service | grep -cE \"^LoadState=loaded\"" -> n:^(\p*\d+) compare == 1'
# 4.4.1.1 Ensure iptables packages are installed. (Automated)
- id: 35633
title: "Ensure iptables packages are installed."
description: "iptables is a utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall, implemented as different Netfilter modules, and the chains and rules it stores. Different kernel modules and programs are used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames."
rationale: "A method of configuring and maintaining firewall rules is necessary to configure a Host Based Firewall."
remediation: "Run the following command to install iptables and iptables-persistent # apt install iptables iptables-persistent."
compliance:
- cis: ["4.4.1.1"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- "c:dpkg -s iptables -> r:Status: install ok installed"
- "c:dpkg -s iptables-persistent -> r:Status: install ok installed"
# 4.4.1.2 Ensure nftables is not in use with iptables. (Automated)
- id: 35634
title: "Ensure nftables is not in use with iptables."
description: "nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables."
rationale: "Running both iptables and nftables may lead to conflict."
remediation: "Run the following command to remove nftables: # apt purge nftables - OR - Run the following commands to stop and mask nftables.service: # systemctl stop nftables.service # systemctl mask nftables.service."
compliance:
- cis: ["4.4.1.2"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- "c:dpkg-query -W -f='${binary:Package}\\t${Status}\\t${db:Status-Status}\\n' nftables iptables -> r:install ok installed"
- "c:dpkg-query -W -f='${binary:Package}\\t${Status}\\t${db:Status-Status}\\n' nftables iptables -> r:unknown ok not-installed|no packages found matching"
# 4.4.1.3 Ensure ufw is not in use with iptables. (Automated)
- id: 35635
title: "Ensure ufw is not in use with iptables."
description: "Uncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use. - Uses a command-line interface consisting of a small number of simple commands - Uses iptables for configuration."
rationale: "Running iptables.persistent with ufw enabled may lead to conflict and unexpected results."
remediation: "Run the following command to remove ufw: # apt purge ufw - OR - Run the following commands to disable ufw, and stop and mask ufw.service: # ufw disable # systemctl stop ufw.service # systemctl mask ufw.service Note: ufw disable needs to be run before systemctl mask ufw.service in order to correctly disable UFW."
compliance:
- cis: ["4.4.1.3"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- "not c:dpkg-query -s ufw -> r:install ok installed"
- 'c:systemctl is-enabled ufw -> r:enabled'
- "c:systemctl is-enabled ufw.service -> r:active"
- "c:dpkg-query -s iptables -> r:install ok installed"
# 4.4.2.1 Ensure iptables default deny firewall policy. (Automated)
- id: 35636
title: "Ensure iptables default deny firewall policy."
description: "A default deny all policy on connections ensures that any unconfigured network usage will be rejected. Notes: - Changing firewall settings while connected over network can result in being locked out of the system - Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well."
rationale: "With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage."
remediation: "Run the following commands to implement a default DROP policy: # iptables -P INPUT DROP # iptables -P OUTPUT DROP # iptables -P FORWARD DROP."
compliance:
- cis: ["4.4.2.1"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- 'c:iptables -L -> r:Chain INPUT \(policy && r:DROP\)|REJECT\)'
- 'c:iptables -L -> r:Chain FORWARD \(policy && r:DROP\)|REJECT\)'
- 'c:iptables -L -> r:Chain OUTPUT \(policy && r:DROP\)|REJECT\)'
# 4.4.2.2 Ensure iptables loopback traffic is configured. (Automated)
- id: 35637
title: "Ensure iptables loopback traffic is configured."
description: "Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8). Note: - Changing firewall settings while connected over network can result in being locked out of the system - Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well."
rationale: "Loopback traffic is generated between processes on machine and is typically critical to the operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure."
remediation: "Run the following commands to implement the loopback rules: # iptables -A INPUT -i lo -j ACCEPT # iptables -A OUTPUT -o lo -j ACCEPT # iptables -A INPUT -s 127.0.0.0/8 -j DROP."
compliance:
- cis: ["4.4.2.2"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- 'c:iptables -L INPUT -v -n -> r:\.*ACCEPT\.*all\.*lo\.*\p\.*0.0.0.0/0\.*0.0.0.0/0'
- 'c:iptables -L INPUT -v -n -> r:\.*DROP\.*all\.*\p\.*\p\.*127.0.0.0/8\.*0.0.0.0/0'
- 'c:iptables -L OUTPUT -v -n -> r:\.*ACCEPT\.*all\.*\p\.*lo\.*0.0.0.0/0\.*0.0.0.0/0'
# 4.4.2.3 Ensure iptables outbound and established connections are configured. (Manual) - Not Implemented
# 4.4.2.4 Ensure iptables firewall rules exist for all open ports. (Automated) - Not Implemented
# 4.4.3.1 Ensure ip6tables default deny firewall policy. (Automated)
- id: 35638
title: "Ensure ip6tables default deny firewall policy."
description: "A default deny all policy on connections ensures that any unconfigured network usage will be rejected. Note: - Changing firewall settings while connected over network can result in being locked out of the system - Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well."
rationale: "With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage."
remediation: "- IF - IPv6 is enabled on your system: Run the following commands to implement a default DROP policy: # ip6tables -P INPUT DROP # ip6tables -P OUTPUT DROP # ip6tables -P FORWARD DROP."
compliance:
- cis: ["4.4.3.1"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- "c:ip6tables -L -> r:^Chain INPUT && r:policy DROP"
- "c:ip6tables -L -> r:^Chain FORWARD && r:policy DROP"
- "c:ip6tables -L -> r:^Chain OUTPUT && r:policy DROP"
# 4.4.3.2 Ensure ip6tables loopback traffic is configured. (Automated)
- id: 35639
title: "Ensure ip6tables loopback traffic is configured."
description: "Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (::1). Note: - Changing firewall settings while connected over network can result in being locked out of the system - Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well."
rationale: "Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (::1) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure."
remediation: "Run the following commands to implement the loopback rules: # ip6tables -A INPUT -i lo -j ACCEPT # ip6tables -A OUTPUT -o lo -j ACCEPT # ip6tables -A INPUT -s ::1 -j DROP."
compliance:
- cis: ["4.4.3.2"]
- cis_csc_v8: ["4.4", "4.5"]
- cis_csc_v7: ["9.4"]
- cmmc_v2.0: ["AC.L1-3.1.20", "CM.L2-3.4.7", "SC.L1-3.13.1", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.1"]
- mitre_mitigations: ["M1031", "M1037"]
- mitre_tactics: ["TA0011"]
- mitre_techniques: ["T1562", "T1562.004"]
- nist_sp_800-53: ["SC-7(5)"]
- pci_dss_v3.2.1: ["1.1.4", "1.3.1", "1.4"]
- pci_dss_v4.0: ["1.2.1", "1.4.1"]
- soc_2: ["CC6.6"]
condition: all
rules:
- 'c:ip6tables -L INPUT -v -n -> r:\.*ACCEPT\.*all\.*lo\.*\p\.*::/0\.*::/0'
- 'c:ip6tables -L INPUT -v -n -> r:\.*DROP\.*all\.*\p\.*\p\.*::1\.*::/0'
- 'c:ip6tables -L OUTPUT -v -n -> r:\.*ACCEPT\.*all\.*\p\.*lo\.*::/0\.*::/0'
# 4.4.3.3 Ensure ip6tables outbound and established connections are configured. (Manual) - Not Implemented
# 4.4.3.4 Ensure ip6tables firewall rules exist for all open ports. (Automated) - Not Implemented
# 5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured. (Automated)
- id: 35640
title: "Ensure permissions on /etc/ssh/sshd_config are configured."
description: "The file /etc/ssh/sshd_config, and files ending in .conf in the /etc/ssh/sshd_config.d directory, contain configuration specifications for sshd."
rationale: "configuration specifications for sshd need to be protected from unauthorized changes by non-privileged users."
remediation: "Run the following script to set ownership and permissions on /etc/ssh/sshd_config and files ending in .conf in the /etc/ssh/sshd_config.d directory: #!/usr/bin/env bash { chmod u-x,og-rwx /etc/ssh/sshd_config chown root:root /etc/ssh/sshd_config while IFS= read -r -d $'\\0' l_file; do if [ -e \"$l_file\" ]; then chmod u-x,og-rwx \"$l_file\" chown root:root \"$l_file\" fi done < <(find /etc/ssh/sshd_config.d -type f -print0 2>/dev/null) } - IF - other locations are listed in an Include statement, *.conf files in these locations access should also be modified."
compliance:
- cis: ["5.1.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1098", "T1098.004", "T1543", "T1543.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/ssh/sshd_config -> r:Access:\s*\t*\(0600/-rw-------\)\s*\t*Uid:\s*\t*\(\s*\t*0/\s*root\)\s*Gid:\s*\t*\(\s*\t*0/\s*\t*root\)'
# 5.1.2 Ensure permissions on SSH private host key files are configured. (Automated)
- id: 35641
title: "Ensure permissions on SSH private host key files are configured."
description: "An SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed."
rationale: "If an unauthorized user obtains the private SSH host key file, the host could be impersonated."
remediation: "Run the following script to set mode, ownership, and group on the private SSH host key files: #!/usr/bin/env bash { a_output=(); a_output2=(); l_ssh_group_name=\"$(awk -F: '($1 ~ /^(ssh_keys|_?ssh)$/) {print $1}' /etc/group)\" f_file_access_fix() { while IFS=: read -r l_file_mode l_file_owner l_file_group; do a_out2=() [ \"$l_file_group\" = \"$l_ssh_group_name\" ] && l_pmask=\"0137\" || l_pmask=\"0177\" l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\" if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\ \" updating to mode: \\:$l_maxperm\\\"\") if [ \"l_file_group\" = \"$l_ssh_group_name\" ]; then chmod u-x,g-wx,o-rwx \"$l_file\" else chmod u-x,go-rwx \"$l_file\" fi fi if [ \"$l_file_owner\" != \"root\" ]; then a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\ \" Changing ownership to \\\"root\\\"\") chown root \"$l_file\" fi if [[ ! \"$l_file_group\" =~ ($l_ssh_group_name|root) ]]; then [ -n \"$l_ssh_group_name\" ] && l_new_group=\"$l_ssh_group_name\" || l_new_group=\"root\" a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"$l_ssh_group_name\\\" or \\\"root\\\"\" \\ \" Changing group ownership to \\\"$l_new_group\\\"\") chgrp \"$l_new_group\" \"$l_file\" fi if [ \"${#a_out2[@]}\" -gt \"0\" ]; then a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\") else a_output+=(\" - File: \\\"$l_file\\\"\" \\ \"Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\") fi done < <(stat -Lc '%#a:%U:%G' \"$l_file\") } while IFS= read -r -d $'\\0' l_file; do if ssh-keygen -lf &>/dev/null \"$l_file\"; then file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?private\\h+key\\b' && f_file_access_fix fi done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null) if [ \"${#a_output2[@]}\" -le \"0\" ]; then printf '%s\\n' \"\" \" - No access changes required\" \"\" else printf '%s\\n' \"\" \" - Remediation results:\" \"${a_output2[@]}\" \"\" fi }."
compliance:
- cis: ["5.1.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0003", "TA0006"]
- mitre_techniques: ["T1552", "T1552.004"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/ssh/ssh_host_rsa_key -> r:^Access: \(0\d00/-\w\w\w------\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
- 'c:stat /etc/ssh/ssh_host_ecdsa_key -> r:^Access: \(0\d00/-\w\w\w------\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
- 'c:stat /etc/ssh/ssh_host_ed25519_key -> r:^Access: \(0\d00/-\w\w\w------\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
# 5.1.3 Ensure permissions on SSH public host key files are configured. (Automated)
- id: 35642
title: "Ensure permissions on SSH public host key files are configured."
description: "An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully."
rationale: "If a public host key file is modified by an unauthorized user, the SSH service may be compromised."
remediation: "Run the following script to set mode, ownership, and group on the public SSH host key files: #!/usr/bin/env bash { a_output=(); a_output2=() l_pmask=\"0133\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\" f_file_access_fix() { while IFS=: read -r l_file_mode l_file_owner l_file_group; do a_out2=() [ $(( $l_file_mode & $l_pmask )) -gt 0 ] && \\ a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\ \" updating to mode: \\\"$l_maxperm\\\"\") && chmod u-x,go-wx \"$l_file\" [ \"$l_file_owner\" != \"root\" ] && \\ a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\ \" Changing ownership to \\\"root\\\"\") && chown root \"$l_file\" [ \"$l_file_group\" != \"root\" ] && \\ a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"root\\\"\" \\ \" Changing group ownership to \\\"root\\\"\") && chgrp root \"$l_file\" if [ \"${#a_out2[@]}\" -gt \"0\" ]; then a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\") else a_output+=(\" - File: \\\"$l_file\\\"\" \\ \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\") fi done < <(stat -Lc '%#a:%U:%G' \"$l_file\") } while IFS= read -r -d $'\\0' l_file; do if ssh-keygen -lf &>/dev/null \"$l_file\"; then file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?public\\h+key\\b' && f_file_access_fix fi done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null) if [ \"${#a_output2[@]}\" -le \"0\" ]; then printf '%s\\n' \"\" \" - No access changes required\" \"\" else printf '%s\\n' \" - Remediation results:\" \"${a_output2[@]}\" \"\" fi }."
compliance:
- cis: ["5.1.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0003", "TA0006"]
- mitre_techniques: ["T1557"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/ssh/ssh_host_rsa_key.pub -> r:^Access: \(0\d\d\d/-\w\w\w\w--\w--\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
- 'c:stat /etc/ssh/ssh_host_ecdsa_key.pub -> r:^Access: \(0\d\d\d/-\w\w\w\w--\w--\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
- 'c:stat /etc/ssh/ssh_host_ed25519_key.pub -> r:^Access: \(0\d\d\d/-\w\w\w\w--\w--\) Uid: \( 0/ root\) Gid: \( 0/ root\)$'
# 5.1.4 Ensure sshd access is configured. (Automated)
- id: 35643
title: "Ensure sshd access is configured."
description: "There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged: - AllowUsers: o The AllowUsers variable gives the system administrator the option of allowing specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host. - AllowGroups: o The AllowGroups variable gives the system administrator the option of allowing specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable. - DenyUsers: o The DenyUsers variable gives the system administrator the option of denying specific users to ssh into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host. - DenyGroups: o The DenyGroups variable gives the system administrator the option of denying specific groups of users to ssh into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable."
rationale: "Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system."
remediation: "Edit the /etc/ssh/sshd_config file to set one or more of the parameters above any Include and Match set statements as follows: AllowUsers <userlist> - AND/OR - AllowGroups <grouplist> Note: - First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a .conf file in an Include directory. - Be advised that these options are \"ANDed\" together. If both AllowUsers and AllowGroups are set, connections will be limited to the list of users that are also a member of an allowed group. It is recommended that only one be set for clarity and ease of administration. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user or group and forget to add it to the deny list. -."
compliance:
- cis: ["5.1.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1021", "T1021.004"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: any
rules:
- 'c:sshd -T -> r:^\s*\t*Allowusers\s*\t*\w+|^\s*\t*Denyusers\s*\t*\w+|^\s*\t*Allowgroups\s*\t*\w+|^\s*\t*Denygroups\s*\t*\w+'
- 'f:/etc/ssh/sshd_config -> r:^\s*\t*Allowusers\s*\t*\w+|^\s*\t*Denyusers\s*\t*\w+|^\s*\t*Allowgroups\s*\t*\w+|^\s*\t*Denygroups\s*\t*\w+'
- 'd:/etc/ssh/sshd_config.d -> r:\.* -> r:^\s*\t*Allowusers\s*\t*\w+|^\s*\t*Denyusers\s*\t*\w+|^\s*\t*Allowgroups\s*\t*\w+|^\s*\t*Denygroups\s*\t*\w+'
# 5.1.5 Ensure sshd Banner is configured. (Automated)
- id: 35644
title: "Ensure sshd Banner is configured."
description: "The Banner parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed."
rationale: "Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user login may assist the prosecution of trespassers on the computer system."
remediation: "Edit the /etc/ssh/sshd_config file to set the Banner parameter above any Include and Match entries as follows: Banner /etc/issue.net Note: First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. Edit the file being called by the Banner argument with the appropriate contents according to your site policy, remove any instances of \\m , \\r , \\s , \\v or references to the OS platform Example: # printf '%s\\n' \"Authorized users only. All activity may be monitored and reported.\" > \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"."
compliance:
- cis: ["5.1.5"]
- mitre_mitigations: ["M1035"]
- mitre_tactics: ["TA0001", "TA0007"]
condition: all
rules:
- "c:sshd -T -> r:^banner && r:/etc/issue.net$"
# 5.1.6 Ensure sshd Ciphers are configured. (Automated)
- id: 35645
title: "Ensure sshd Ciphers are configured."
description: "This variable limits the ciphers that SSH can use during communication. Notes: - Some organizations may have stricter requirements for approved ciphers. - Ensure that ciphers used are in compliance with site policy. - The only \"strong\" ciphers currently FIPS 140 compliant are: o aes256-gcm@openssh.com o aes128-gcm@openssh.com o aes256-ctr o aes192-ctr o aes128-ctr."
rationale: "Weak ciphers that are used for authentication to the cryptographic module cannot be relied upon to provide confidentiality or integrity, and system data may be compromised. - The Triple DES ciphers, as used in SSH, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain clear text data via a birthday attack against a long-duration encrypted session, aka a \"Sweet32\" attack. - Error handling in the SSH protocol; Client and Server, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plain text data from an arbitrary block of cipher text in an SSH session via unknown vectors."
remediation: "Edit the /etc/ssh/sshd_config file and add/modify the Ciphers line to contain a comma separated list of the site unapproved (weak) Ciphers preceded with a - above any Include entries: Example: Ciphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,chacha20- poly1305@openssh.com - IF - CVE-2023-48795 has been addressed, and it meets local site policy, chacha20-poly1305@openssh.com may be removed from the list of excluded ciphers. Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
references:
- 'https://nvd.nist.gov/vuln/detail/CVE-2023-48795'
- 'https://nvd.nist.gov/vuln/detail/CVE-2019-1543'
- 'https://nvd.nist.gov/vuln/detail/CVE-2016-2183'
- 'https://nvd.nist.gov/vuln/detail/CVE-2008-5161'
- 'https://www.openssh.com/txt/cbc.adv'
compliance:
- cis: ["5.1.6"]
- cis_csc_v8: ["3.10"]
- cis_csc_v7: ["14.4"]
- cmmc_v2.0: ["AC.L2-3.1.13", "AC.L2-3.1.17", "IA.L2-3.5.10", "SC.L2-3.13.11", "SC.L2-3.13.15", "SC.L2-3.13.8"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(1)", "164.312(e)(2)(i)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1", "A.13.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1040", "T1557"]
- nist_sp_800-53: ["AC-17(2)", "SC-8", "SC-8(1)"]
- pci_dss_v3.2.1: ["2.1.1", "4.1", "4.1.1", "8.2.1"]
- pci_dss_v4.0: ["2.2.7", "4.1.1", "4.2.1", "4.2.1.2", "4.2.2", "8.3.2"]
condition: none
rules:
- "c:sshd -T -> r:^Ciphers && r:3des-cbc|aes128-cbc|aes192-cbc|aes256-cbc"
# 5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured. (Automated)
- id: 35646
title: "Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured."
description: "Note: To clarify, the two settings described below are only meant for idle connections from a protocol perspective and are not meant to check if the user is active or not. An idle user does not mean an idle connection. SSH does not and never had, intentionally, the capability to drop idle users. In SSH versions before 8.2p1 there was a bug that caused these values to behave in such a manner that they were abused to disconnect idle users. This bug has been resolved in 8.2p1 and thus it can no longer be abused disconnect idle users. The two options ClientAliveInterval and ClientAliveCountMax control the timeout of SSH sessions. Taken directly from man 5 sshd_config: - ClientAliveInterval Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. - ClientAliveCountMax Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become unresponsive. The default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds. Setting a zero ClientAliveCountMax disables connection termination."
rationale: "In order to prevent resource exhaustion, appropriate values should be set for both ClientAliveInterval and ClientAliveCountMax. Specifically, looking at the source code, ClientAliveCountMax must be greater than zero in order to utilize the ability of SSH to drop idle connections. If connections are allowed to stay open indefinitely, this can potentially be used as a DDOS attack or simple resource exhaustion could occur over unreliable networks. The example set here is a 45 second timeout. Consult your site policy for network timeouts and apply as appropriate."
remediation: "Edit the /etc/ssh/sshd_config file to set the ClientAliveInterval and ClientAliveCountMax parameters above any Include and Match entries according to site policy. Example: ClientAliveInterval 15 ClientAliveCountMax 3 Note: First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.7"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.002", "T1078.003"]
condition: all
rules:
- 'c:sshd -T -> n:^clientaliveinterval\s*\t*(\p*\d+) compare > 0'
- 'c:sshd -T -> n:^clientalivecountmax\s*\t*(\p*\d+) compare > 0'
# 5.1.8 Ensure sshd DisableForwarding is enabled. (Automated)
- id: 35647
title: "Ensure sshd DisableForwarding is enabled."
description: "The DisableForwarding parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations. - X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections. - ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh. - SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines."
rationale: "Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders. anyone with root privilege on the the intermediate server can make free use of ssh-agent to authenticate them to other servers Leaving port forwarding enabled can expose the organization to security risks and backdoors. SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications, or to exfiltrate stolen data from the target network."
impact: "SSH tunnels are widely used in many corporate environments. In some environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without having to modify the applications."
remediation: "Edit the /etc/ssh/sshd_config file to set the DisableForwarding parameter to yes above any Include entry as follows: DisableForwarding yes Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.8"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1210"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'c:sshd -T -> r:^disableforwarding\s*\t*yes'
# 5.1.9 Ensure sshd GSSAPIAuthentication is disabled. (Automated)
- id: 35648
title: "Ensure sshd GSSAPIAuthentication is disabled."
description: "The GSSAPIAuthentication parameter specifies whether user authentication based on GSSAPI is allowed."
rationale: "Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, and should be disabled to reduce the attack surface of the system."
remediation: "Edit the /etc/ssh/sshd_config file to set the GSSAPIAuthentication parameter to no above any Include and Match entries as follows: GSSAPIAuthentication no Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.9"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'c:sshd -T -> r:^gssapiauthentication\s*\t*no'
# 5.1.10 Ensure sshd HostbasedAuthentication is disabled. (Automated)
- id: 35649
title: "Ensure sshd HostbasedAuthentication is disabled."
description: "The HostbasedAuthentication parameter specifies if authentication is allowed through trusted hosts via the user of .rhosts, or /etc/hosts.equiv, along with successful public key client host authentication."
rationale: "Even though the .rhosts files are ineffective if support is disabled in /etc/pam.conf, disabling the ability to use .rhosts files in SSH provides an additional layer of protection."
remediation: "Edit the /etc/ssh/sshd_config file to set the HostbasedAuthentication parameter to no above any Include and Match entries as follows: HostbasedAuthentication no Note: First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.10"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
condition: all
rules:
- "c:sshd -T -> r:^hostbasedauthentication no"
- "not f:/etc/ssh/sshd_config -> r:^\\s*\\t*HostBasedAuthentication\\s*\\t*yes"
# 5.1.11 Ensure sshd IgnoreRhosts is enabled. (Automated)
- id: 35650
title: "Ensure sshd IgnoreRhosts is enabled."
description: "The IgnoreRhosts parameter specifies that .rhosts and .shosts files will not be used in RhostsRSAAuthentication or HostbasedAuthentication."
rationale: "Setting this parameter forces users to enter a password when authenticating with SSH."
remediation: "Edit the /etc/ssh/sshd_config file to set the IgnoreRhosts parameter to yes above any Include and Match entries as follows: IgnoreRhosts yes Note: First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.11"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "c:sshd -T -> r:^ignorerhosts yes"
- "not f:/etc/ssh/sshd_config -> r:^\\s*\\t*IgnoreRhosts\\s*\\t*no"
# 5.1.12 Ensure sshd KexAlgorithms is configured. (Automated)
- id: 35651
title: "Ensure sshd KexAlgorithms is configured."
description: "Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received Notes: - Kex algorithms have a higher preference the earlier they appear in the list - Some organizations may have stricter requirements for approved Key exchange algorithms - Ensure that Key exchange algorithms used are in compliance with site policy - The only Key Exchange Algorithms currently FIPS 140 approved are: o ecdh-sha2-nistp256 o ecdh-sha2-nistp384 o ecdh-sha2-nistp521 o diffie-hellman-group-exchange-sha256 o diffie-hellman-group16-sha512 o diffie-hellman-group18-sha512 o diffie-hellman-group14-sha256."
rationale: "Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used, or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the-middle attacks."
remediation: "Edit the /etc/ssh/sshd_config file and add/modify the KexAlgorithms line to contain a comma separated list of the site unapproved (weak) KexAlgorithms preceded with a - above any Include entries: Example: KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie- hellman-group-exchange-sha1 Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
references:
- 'https://ubuntu.com/server/docs/openssh-crypto-configuration'
compliance:
- cis: ["5.1.12"]
- cis_csc_v8: ["3.10"]
- cis_csc_v7: ["14.4"]
- cmmc_v2.0: ["AC.L2-3.1.13", "AC.L2-3.1.17", "IA.L2-3.5.10", "SC.L2-3.13.11", "SC.L2-3.13.15", "SC.L2-3.13.8"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(1)", "164.312(e)(2)(i)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1", "A.13.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1040", "T1557"]
- nist_sp_800-53: ["AC-17(2)", "SC-8", "SC-8(1)"]
- pci_dss_v3.2.1: ["2.1.1", "4.1", "4.1.1", "8.2.1"]
- pci_dss_v4.0: ["2.2.7", "4.1.1", "4.2.1", "4.2.1.2", "4.2.2", "8.3.2"]
condition: none
rules:
- "c:sshd -T -> r:^kexalgorithms && r:diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1"
# 5.1.13 Ensure sshd LoginGraceTime is configured. (Automated)
- id: 35652
title: "Ensure sshd LoginGraceTime is configured."
description: "The LoginGraceTime parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access."
rationale: "Setting the LoginGraceTime parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set the number based on site policy."
remediation: "Edit the /etc/ssh/sshd_config file to set the LoginGraceTime parameter to 60 seconds or less above any Include entry as follows: LoginGraceTime 60 Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.13"]
- mitre_mitigations: ["M1036"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003", "T1110.004"]
condition: all
rules:
- 'c:sshd -T -> n:^\s*logingracetime\s*(\d+) compare <= 60 && n:^logingracetime\s*(\d+) compare >= 1'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*LoginGraceTime\s*\t*(\d+) compare > 60'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*LoginGraceTime\s*\t*(\d+) compare == 0'
# 5.1.14 Ensure sshd LogLevel is configured. (Automated)
- id: 35653
title: "Ensure sshd LogLevel is configured."
description: "SSH provides several logging levels with varying amounts of verbosity. The DEBUG options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users."
rationale: "The INFO level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field. The VERBOSE level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments."
remediation: "Edit the /etc/ssh/sshd_config file to set the LogLevel parameter to VERBOSE or INFO above any Include and Match entries as follows: LogLevel VERBOSE - OR - LogLevel INFO Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
references:
- 'https://www.ssh.com/ssh/sshd_config/'
compliance:
- cis: ["5.1.14"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: any
rules:
- "c:sshd -T -> r:^loglevel VERBOSE|^loglevel INFO"
- "not f:/etc/ssh/sshd_config -> !r:^\\s*\\t*loglevel\\s*\\t*VERBOSE|^\\s*\\t*loglevel\\s*\\t*INFO"
# 5.1.15 Ensure sshd MACs are configured. (Automated)
- id: 35654
title: "Ensure sshd MACs are configured."
description: "This variable limits the types of MAC algorithms that SSH can use during communication. Notes: - Some organizations may have stricter requirements for approved MACs. - Ensure that MACs used are in compliance with site policy. - The only \"strong\" MACs currently FIPS 140 approved are: o HMAC-SHA1 o HMAC-SHA2-256 o HMAC-SHA2-384 o HMAC-SHA2-512."
rationale: "MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information."
remediation: "Edit the /etc/ssh/sshd_config file and add/modify the MACs line to contain a comma separated list of the site unapproved (weak) MACs preceded with a - above any Include entries: Example: MACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac- 64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac- ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64- etm@openssh.com,umac-128-etm@openssh.com - IF - CVE-2023-48795 has not been reviewed and addressed, the following etm MACs should be added to the exclude list: hmac-sha1-etm@openssh.com,hmac-sha2-256- etm@openssh.com,hmac-sha2-512-etm@openssh.com Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
references:
- 'https://nvd.nist.gov/vuln/detail/CVE-2023-48795'
- 'http://www.mitls.org/pages/attacks/SLOTH'
compliance:
- cis: ["5.1.15"]
- cis_csc_v8: ["3.10"]
- cis_csc_v7: ["14.4", "16.5"]
- cmmc_v2.0: ["AC.L2-3.1.13", "AC.L2-3.1.17", "IA.L2-3.5.10", "SC.L2-3.13.11", "SC.L2-3.13.15", "SC.L2-3.13.8"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(1)", "164.312(e)(2)(i)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1", "A.13.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1040", "T1557"]
- nist_sp_800-53: ["AC-17(2)", "SC-8", "SC-8(1)"]
- pci_dss_v3.2.1: ["2.1.1", "4.1", "4.1.1", "8.2.1"]
- pci_dss_v4.0: ["2.2.7", "4.1.1", "4.2.1", "4.2.1.2", "4.2.2", "8.3.2"]
condition: none
rules:
- "c:sshd -T -> r:^MACs && r:hmac-md5|hmac-md5-96|hmac-ripemd160|hmac-sha1|hmac-sha1-96|umac-64@openssh.com|umac-128@openssh.com|hmac-md5-etm@openssh.com|hmac-md5-96-etm@openssh.com|hmac-ripemd160-etm@openssh.com|hmac-sha1-etm@openssh.com|hmac-sha1-96-etm@openssh.com|umac-64-etm@openssh.com|umac-128-etm@openssh.com"
# 5.1.16 Ensure sshd MaxAuthTries is configured. (Automated)
- id: 35655
title: "Ensure sshd MaxAuthTries is configured."
description: "The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure."
rationale: "Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. While the recommended setting is 4, set the number based on site policy."
remediation: "Edit the /etc/ssh/sshd_config file to set the MaxAuthTries parameter to 4 or less above any Include and Match entries as follows: MaxAuthTries 4 Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.16"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["16.13"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- mitre_mitigations: ["M1036"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- "c:sshd -T -> n:^maxauthtries\\s+(\\d+) compare <= 4"
- "not f:/etc/ssh/sshd_config -> n:^\\s*\\t*maxauthtries\\s+(\\d+) compare > 4"
# 5.1.17 Ensure sshd MaxSessions is configured. (Automated)
- id: 35656
title: "Ensure sshd MaxSessions is configured."
description: "The MaxSessions parameter specifies the maximum number of open sessions permitted from a given connection."
rationale: "To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon."
remediation: "Edit the /etc/ssh/sshd_config file to set the MaxSessions parameter to 10 or less above any Include and Match entries as follows: MaxSessions 10 Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.17"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1499", "T1499.002"]
condition: all
rules:
- "c:sshd -T -> n:^maxsessions\\s*\\t*(\\d+) compare <= 10"
- "not f:/etc/ssh/sshd_config -> n:^^\\s*\\t*MaxSessions\\s+(\\d+) compare > 10"
# 5.1.18 Ensure sshd MaxStartups is configured. (Automated)
- id: 35657
title: "Ensure sshd MaxStartups is configured."
description: "The MaxStartups parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon."
rationale: "To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon."
remediation: "Edit the /etc/ssh/sshd_config file to set the MaxStartups parameter to 10:30:60 or more restrictive above any Include entries as follows: MaxStartups 10:30:60 Note: First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.18"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1499", "T1499.002"]
condition: all
rules:
- 'c:sshd -T -> n:^\s*maxstartups\s+(\d+):\d+:\d+ compare <= 10 && n:^maxstartups\s+(\d+):\d+:\d+ compare >= 1'
- 'c:sshd -T -> n:^\s*maxstartups\s+\d+:(\d+):\d+ compare <= 30 && n:^maxstartups\s+(\d+):\d+:\d+ compare >= 1'
- 'c:sshd -T -> n:^\s*maxstartups\s+\d+:\d+:(\d+) compare <= 60 && n:^maxstartups\s+(\d+):\d+:\d+ compare >= 1'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*(\d+):\d+:\d+ compare > 10'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*(\d+):\d+:\d+ compare == 0'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*\d+:(\d+):\d+ compare > 30'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*\d+:(\d+):\d+ compare == 0'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*\d+:\d+:(\d+) compare > 60'
- 'not f:/etc/ssh/sshd_config -> n:^\s*\t*MaxStartups\s*\t*\d+:\d+:(\d+) compare == 0'
# 5.1.19 Ensure sshd PermitEmptyPasswords is disabled. (Automated)
- id: 35658
title: "Ensure sshd PermitEmptyPasswords is disabled."
description: "The PermitEmptyPasswords parameter specifies if the SSH server allows login to accounts with empty password strings."
rationale: "Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system."
remediation: "Edit /etc/ssh/sshd_config and set the PermitEmptyPasswords parameter to no above any Include and Match entries as follows: PermitEmptyPasswords no Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.19"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1021"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "c:sshd -T -> r:^permitemptypasswords no"
- "not f:/etc/ssh/sshd_config -> r:^\\s*\\t*PermitEmptyPasswords\\s*\\t*yes"
# 5.1.20 Ensure sshd PermitRootLogin is disabled. (Automated)
- id: 35659
title: "Ensure sshd PermitRootLogin is disabled."
description: "The PermitRootLogin parameter specifies if the root user can log in using SSH. The default is prohibit-password."
rationale: "Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root. This limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident."
remediation: "Edit the /etc/ssh/sshd_config file to set the PermitRootLogin parameter to no above any Include and Match entries as follows: PermitRootLogin no Note: First occurrence of an option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.20"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1021"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: all
rules:
- "c:sshd -T -> r:^permitrootlogin no"
- "f:/etc/ssh/sshd_config -> r:^\\s*\\t*PermitRootLogin\\s*\\t*no"
# 5.1.21 Ensure sshd PermitUserEnvironment is disabled. (Automated)
- id: 35660
title: "Ensure sshd PermitUserEnvironment is disabled."
description: "The PermitUserEnvironment option allows users to present environment options to the SSH daemon."
rationale: "Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs)."
remediation: "Edit the /etc/ssh/sshd_config file to set the PermitUserEnvironment parameter to no above any Include entries as follows: PermitUserEnvironment no Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.21"]
- mitre_mitigations: ["M1042"]
- mitre_tactics: ["TA0008"]
- mitre_techniques: ["T1021"]
condition: all
rules:
- "c:sshd -T -> r:^permituserenvironment no"
- "not f:/etc/ssh/sshd_config -> r:^\\s*\\t*PermitUserEnvironment\\s*\\t*yes"
# 5.1.22 Ensure sshd UsePAM is enabled. (Automated)
- id: 35661
title: "Ensure sshd UsePAM is enabled."
description: "The UsePAM directive enables the Pluggable Authentication Module (PAM) interface. If set to yes this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication directives in addition to PAM account and session module processing for all authentication types."
rationale: "When usePAM is set to yes, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server."
remediation: "Edit the /etc/ssh/sshd_config file to set the UsePAM parameter to yes above any Include entries as follows: UsePAM yes Note: First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."
compliance:
- cis: ["5.1.22"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1035"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1021", "T1021.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "c:sshd -T -> r:^usepam yes"
- "not f:/etc/ssh/sshd_config -> r:^\\s*\\t*UsePAM\\s*\\t*no"
# 5.2.1 Ensure sudo is installed. (Automated)
- id: 35662
title: "Ensure sudo is installed."
description: "sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. The invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy."
rationale: "sudo supports a plug-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug-ins to work seamlessly with the sudo front end. The default security policy is sudoers, which is configured via the file /etc/sudoers and any entries in /etc/sudoers.d. The security policy determines what privileges, if any, a user has to run sudo. The policy may require that users authenticate themselves with a password or another authentication mechanism. If authentication is required, sudo will exit if the user's password is not entered within a configurable time limit. This limit is policy-specific."
remediation: "First determine if LDAP functionality is required. If so, then install sudo-ldap, else install sudo. Example: # apt install sudo."
compliance:
- cis: ["5.2.1"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: any
rules:
- "c:dpkg -s sudo -> r:install ok installed"
- "c:dpkg -s sudo-ldap -> r:install ok installed"
# 5.2.2 Ensure sudo commands use pty. (Automated)
- id: 35663
title: "Ensure sudo commands use pty."
description: "sudo can be configured to run only from a pseudo terminal (pseudo-pty)."
rationale: "Attackers can run a malicious program using sudo which would fork a background process that remains even when the main program has finished executing."
impact: "WARNING: Editing the sudo configuration incorrectly can cause sudo to stop functioning. Always use visudo to modify sudo configuration files."
remediation: "Edit the file /etc/sudoers with visudo or a file in /etc/sudoers.d/ with visudo -f <PATH TO FILE> and add the following line: Defaults use_pty Edit the file /etc/sudoers with visudo and any files in /etc/sudoers.d/ with visudo -f <PATH TO FILE> and remove any occurrence of !use_pty Note: - sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files. - Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. - Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. - Using a consistent number of leading zeroes in the file names can be used to avoid such problems."
compliance:
- cis: ["5.2.2"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["5.1"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.14.2.5", "A.8.1.3"]
- mitre_mitigations: ["M1026", "M1028"]
- mitre_tactics: ["TA0001", "TA0003"]
- mitre_techniques: ["T1078", "T1078.003", "T1548", "T1548.003"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: any
rules:
- 'f:/etc/sudoers -> r:^\s*\t*Defaults\s*\t*use_pty'
- 'd:/etc/sudoers.d -> r:\.* -> r:^\s*\t*Defaults\s*\t*use_pty'
# 5.2.3 Ensure sudo log file exists. (Automated)
- id: 35664
title: "Ensure sudo log file exists."
description: "sudo can use a custom log file."
rationale: "A sudo log file simplifies auditing of sudo commands."
impact: "WARNING: Editing the sudo configuration incorrectly can cause sudo to stop functioning. Always use visudo to modify sudo configuration files."
remediation: "Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo or visudo -f <PATH TO FILE> and add the following line: Example: Defaults logfile=\"/var/log/sudo.log\" Note: - sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files. - Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second. - Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second. - Using a consistent number of leading zeroes in the file names can be used to avoid such problems."
compliance:
- cis: ["5.2.3"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: any
rules:
- 'f:/etc/sudoers -> r:^\s*\t*Defaults\s*\t*logfile=\S+.log'
- 'd:/etc/sudoers.d -> \.* -> r:^\s*\t*Defaults\s*\t*logfile=\S+.log'
# 5.2.4 Ensure users must provide password for privilege escalation. (Automated)
- id: 35665
title: "Ensure users must provide password for privilege escalation."
description: "The operating system must be configured so that users must provide a password for privilege escalation."
rationale: "Without (re-)authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user (re-)authenticate."
impact: "This will prevent automated processes from being able to elevate privileges."
remediation: "Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file. Remove any line with occurrences of NOPASSWD tags in the file."
compliance:
- cis: ["5.2.4"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: none
rules:
- 'f:/etc/sudoers -> r:^\s*\t*NOPASSWD'
- 'd:/etc/sudoers.d -> r:\.* -> r:^\s*\t*NOPASSWD'
# 5.2.5 Ensure re-authentication for privilege escalation is not disabled globally. (Automated)
- id: 35666
title: "Ensure re-authentication for privilege escalation is not disabled globally."
description: "The operating system must be configured so that users must re-authenticate for privilege escalation."
rationale: "Without re-authentication, users may access resources or perform tasks for which they do not have authorization. When operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate."
remediation: "Configure the operating system to require users to reauthenticate for privilege escalation. Based on the outcome of the audit procedure, use visudo -f <PATH TO FILE> to edit the relevant sudoers file. Remove any occurrences of !authenticate tags in the file(s)."
compliance:
- cis: ["5.2.5"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: none
rules:
- 'f:/etc/sudoers -> r:^\s*\t*!authenticate'
- 'd:/etc/sudoers.d -> r:\.* -> r:^\s*\t*!authenticate'
# 5.2.6 Ensure sudo authentication timeout is configured correctly. (Automated)
- id: 35667
title: "Ensure sudo authentication timeout is configured correctly."
description: "sudo caches used credentials for a default of 15 minutes. This is for ease of use when there are multiple administrative tasks to perform. The timeout can be modified to suit local security policies. This default is distribution specific. See audit section for further information."
rationale: "Setting a timeout value reduces the window of opportunity for unauthorized privileged access to another user."
remediation: "If the currently configured timeout is larger than 15 minutes, edit the file listed in the audit section with visudo -f <PATH TO FILE> and modify the entry timestamp_timeout= to 15 minutes or less as per your site policy. The value is in minutes. This particular entry may appear on it's own, or on the same line as env_reset. See the following two examples: Defaults env_reset, timestamp_timeout=15 Defaults timestamp_timeout=15 Defaults env_reset."
references:
- 'https://www.sudo.ws/man/1.9.0/sudoers.man.html'
compliance:
- cis: ["5.2.6"]
- cis_csc_v8: ["5.4"]
- cis_csc_v7: ["4.3"]
- cmmc_v2.0: ["AC.L2-3.1.5", "AC.L2-3.1.6", "AC.L2-3.1.7", "SC.L2-3.13.3"]
- iso_27001-2013: ["A.9.2.3"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-6(2)", "AC-6(5)"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- soc_2: ["CC6.1", "CC6.3"]
condition: any
rules:
- 'f:/etc/sudoers -> !r:^\s*\t*# && n:^\s*\t*timestamp_timeout=(\d+) compare <= 15 && n:^\s*\t*timestamp_timeout=(\d+) compare >= 0'
- 'd:/etc/sudoers.d -> r:\.* -> !r:^\s*\t*# && n:^\s*\t*timestamp_timeout=(\d+) compare <= 15 && n:^\s*\t*timestamp_timeout=(\d+) compare >= 0'
- 'c:sudo -V -> n:Authentication timestamp timeout:\s*\t*(\d+) compare <= 15 && n:Authentication timestamp timeout:\s*\t*(\d+) compare >= 0'
# 5.2.7 Ensure access to the su command is restricted. (Automated)
- id: 35668
title: "Ensure access to the su command is restricted."
description: "The su command allows a user to run a command or shell as another user. The program has been superseded by sudo, which allows for more granular control over privileged access. Normally, the su command can be executed by any user. By uncommenting the pam_wheel.so statement in /etc/pam.d/su, the su command will only allow users in a specific groups to execute su. This group should be empty to reinforce the use of sudo for privileged access."
rationale: "Restricting the use of su , and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo , whereas su can only record that a user executed the su program."
remediation: "Create an empty group that will be specified for use of the su command. The group should be named according to site policy. Example: # groupadd sugroup Add the following line to the /etc/pam.d/su file, specifying the empty group: auth required pam_wheel.so use_uid group=sugroup."
compliance:
- cis: ["5.2.7"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/su -> !r:^# && r:auth\s*required\s*pam_wheel.so && r:use_uid && r:group='
# 5.3.1.1 Ensure latest version of pam is installed. (Automated)
- id: 35669
title: "Ensure latest version of pam is installed."
description: "Updated versions of PAM include additional functionality."
rationale: "To ensure the system has full functionality and access to the options covered by this Benchmark the latest version of libpam-runtime should be installed on the system."
remediation: "Run the following command to update to the latest version of PAM: # apt upgrade libpam-runtime."
compliance:
- cis: ["5.3.1.1"]
condition: all
rules:
- "c:dpkg-query -s libpam-runtime -> r:^Status: install ok installed"
# 5.3.1.2 Ensure libpam-modules is installed. (Automated)
- id: 35670
title: "Ensure libpam-modules is installed."
description: "Pluggable Authentication Modules for PAM."
rationale: "To ensure the system has full functionality and access to the PAM options covered by this Benchmark."
remediation: "Run the following command to update to the latest version of PAM: # apt upgrade libpam-modules."
compliance:
- cis: ["5.3.1.2"]
condition: all
rules:
- "c:dpkg -s libpam-modules -> r:install ok installed"
# 5.3.1.3 Ensure libpam-pwquality is installed. (Automated)
- id: 35671
title: "Ensure libpam-pwquality is installed."
description: "libpwquality provides common functions for password quality checking and scoring them based on their apparent randomness. The library also provides a function for generating random passwords with good pronounceability. This module can be plugged into the password stack of a given service to provide some plug-in strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options."
rationale: "Strong passwords reduce the risk of systems being hacked through brute force methods."
remediation: "Run the following command to install libpam-pwquality: # apt install libpam-pwquality."
references:
- 'https://packages.debian.org/buster/libpam-pwquality'
compliance:
- cis: ["5.3.1.3"]
condition: all
rules:
- "c:dpkg -s libpam-pwquality -> r:install ok installed"
# 5.3.2.1 Ensure pam_unix module is enabled. (Automated)
- id: 35672
title: "Ensure pam_unix module is enabled."
description: "pam_unix is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the /etc/passwd and if shadow is enabled, the /etc/shadow file as well. The account component performs the task of establishing the status of the user's account and password based on the following shadow elements: expire, last_change, max_change, min_change, warn_change. In the case of the latter, it may offer advice to the user on changing their password or, through the PAM_AUTHTOKEN_REQD return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed. The authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank."
rationale: "The system should only provide access after performing authentication of a user."
remediation: "Run the following command to enable the pam_unix module: # pam-auth-update --enable unix Note: If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the pam_faillock module, enable that module instead."
compliance:
- cis: ["5.3.2.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-account -> r:^account\s*\t*[success=1 new_authtok_reqd=done default=ignore] && r:pam_unix.so'
- 'f:/etc/pam.d/common-session -> r:^session\s*\t*required && r:pam_unix.so'
- "f:/etc/pam.d/common-auth -> r:^auth && r:[success=2|[success=3 && r:default=ignore] && r:pam_unix.so"
- "f:/etc/pam.d/common-password -> r:^password && r:[success=1|[success=2 && r:default=ignore] && r:pam_unix.so"
# 5.3.2.2 Ensure pam_faillock module is enabled. (Automated)
- id: 35673
title: "Ensure pam_faillock module is enabled."
description: "The pam_faillock.so module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the deny parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory."
rationale: "Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."
remediation: "Create two pam-auth-update profiles in /usr/share/pam-configs/: 1. Create the faillock profile in /usr/share/pam-configs/ with the following lines: Name: Enable pam_faillock to deny access Default: yes Priority: 0 Auth-Type: Primary Auth: [default=die] pam_faillock.so authfail Example Script: #!/usr/bin/env bash { arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail') printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock } 2. Create the faillock_notify profile in /usr/share/pam-configs/ with the following lines: Name: Notify of failed login attempts and reset count upon success Default: yes Priority: 1024 Auth-Type: Primary Auth: requisite pam_faillock.so preauth Account-Type: Primary Account: required pam_faillock.so Example Script: #!/usr/bin/env bash { arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so') printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock_notify } Run the following command to update the common-auth and common-account PAM files with the new profiles: # pam-auth-update --enable <profile_filename> Example: # pam-auth-update --enable faillock # pam-auth-update --enable faillock_notify Note: - The name used for the file must be used in the pam-auth-update --enable command - The Name: line should be easily recognizable and understood - The Priority: Line is important as it effects the order of the lines in the - /etc/pam.d/ files If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the pam_faillock module, enable that module instead."
compliance:
- cis: ["5.3.2.2"]
- cis_csc_v8: ["6.2"]
- cis_csc_v7: ["16.7"]
- cmmc_v2.0: ["AC.L1-3.1.1"]
- hipaa: ["164.308(a)(3)(ii)(C)"]
- iso_27001-2013: ["A.9.2.6"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003"]
- nist_sp_800-53: ["AC-2(1)"]
- pci_dss_v3.2.1: ["8.1.3"]
- pci_dss_v4.0: ["8.2.4", "8.2.5"]
- soc_2: ["CC6.2", "CC6.3"]
condition: all
rules:
- 'f:/etc/pam.d/common-auth -> r:^auth\s*\t*requisite && r:pam_faillock.so'
- 'f:/etc/pam.d/common-auth -> r:^auth\s*\t*[default=die] && r:pam_faillock.so'
- 'f:/etc/pam.d/common-account -> r:^account\s*\t*required && r:pam_faillock.so'
# 5.3.2.3 Ensure pam_pwquality module is enabled. (Automated)
- id: 35674
title: "Ensure pam_pwquality module is enabled."
description: "The pam_pwquality.so module performs password quality checking. This module can be plugged into the password stack of a given service to provide strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options. The action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices. The first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token."
rationale: "Use of a unique, complex passwords helps to increase the time and resources required to compromise the password."
remediation: "Run the following script to verify the pam_pwquality.so line exists in a pam-auth- update profile: # grep -P -- '\\bpam_pwquality\\.so\\b' /usr/share/pam-configs/* Output should be similar to: /usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3 /usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3 - IF - similar output is returned: Run the following command to update /etc/pam.d/common-password with the returned profile: # pam-auth-update --enable {PROFILE_NAME} Example: # pam-auth-update pwquality - IF - similar output is NOT returned: Create a pam-auth-update profile in /usr/share/pam-configs/ with the following lines: Name: Pwquality password strength checking Default: yes Priority: 1024 Conflicts: cracklib Password-Type: Primary Password: requisite pam_pwquality.so retry=3 Example: #!/usr/bin/env bash { arr=('Name: Pwquality password strength checking' 'Default: yes' 'Priority: 1024' 'Conflicts: cracklib' 'Password-Type: Primary' 'Password:' ' requisite pam_pwquality.so retry=3') printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwquality } Run the following command to update /etc/pam.d/common-password with the pwquality profile: # pam-auth-update --enable pwquality Note: - The name used for the file must be used in the pam-auth-update --enable command - The Name: line should be easily recognizable and understood - The Priority: Line is important as it effects the order of the lines in the - /etc/pam.d/ files If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the pam_pwquality module, enable that module instead."
compliance:
- cis: ["5.3.2.3"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-password -> r:^password\s*\t*requisite && r:pam_pwquality.so'
# 5.3.2.4 Ensure pam_pwhistory module is enabled. (Automated)
- id: 35675
title: "Ensure pam_pwhistory module is enabled."
description: "The pam_pwhistory.so module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently. This module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with NIS or LDAP, since the old passwords are stored on the local machine and are not available on another machine for password history checking."
rationale: "Use of a unique, complex passwords helps to increase the time and resources required to compromise the password."
remediation: "Run the following script to verify the pam_pwquality.so line exists in a pam-auth- update profile: # grep -P -- '\\bpam_pwhistory\\.so\\b' /usr/share/pam-configs/* Output should be similar to: /usr/share/pam-configs/pwhistory: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok - IF - similar output is returned: Run the following command to update /etc/pam.d/common-password with the returned profile: # pam-auth-update --enable {PROFILE_NAME} Example: # pam-auth-update pwhistory - IF - similar output is NOT returned: Create a pwhistory profile in /usr/share/pam-configs/ with the following lines: Name: pwhistory password history checking Default: yes Priority: 1024 Password-Type: Primary Password: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok Example Script: #!/usr/bin/env bash { arr=('Name: pwhistory password history checking' 'Default: yes' 'Priority: 1024' 'Password-Type: Primary' 'Password:' ' requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok') printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwhistory } Run the following command to update /etc/pam.d/common-password with the pwhistory profile: # pam-auth-update --enable pwhistory Note: - The name used for the file must be used in the pam-auth-update --enable command - The Name: line should be easily recognizable and understood - The Priority: Line is important as it effects the order of the lines in the - /etc/pam.d/ files If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the pam_pwhistory module, enable that module instead."
compliance:
- cis: ["5.3.2.4"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-password -> !r:^# && r:password\s*\t*required\s*\t*pam_pwhistory.so && n:remember\s*\t*=\s*\t*(\d+) compare => 5'
- 'f:/etc/pam.d/common-password -> !r:^# && r:password && r:success && r:default\s*=\s*ignore && r:pam_unix.so && r:use_authtok'
# 5.3.3.1.1 Ensure password failed attempts lockout is configured. (Automated)
- id: 35676
title: "Ensure password failed attempts lockout is configured."
description: "The deny=<n> option will deny access if the number of consecutive authentication failures for this user during the recent interval exceeds."
rationale: "Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."
remediation: "Create or edit the following line in /etc/security/faillock.conf setting the deny option to 5 or less: deny = 5 Run the following command: # grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?deny\\b' /usr/share/pam- configs/* Edit any returned files and remove the deny=<N> arguments from the pam_faillock.so line(s):."
compliance:
- cis: ["5.3.3.1.1"]
- cis_csc_v8: ["6.2"]
- cis_csc_v7: ["16.7"]
- cmmc_v2.0: ["AC.L1-3.1.1"]
- hipaa: ["164.308(a)(3)(ii)(C)"]
- iso_27001-2013: ["A.9.2.6"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003"]
- nist_sp_800-53: ["AC-2(1)"]
- pci_dss_v3.2.1: ["8.1.3"]
- pci_dss_v4.0: ["8.2.4", "8.2.5"]
- soc_2: ["CC6.2", "CC6.3"]
condition: all
rules:
- 'f:/etc/security/faillock.conf -> n:^deny\s*\t*=\s*\t*(\p*\d+) compare <= 5'
# 5.3.3.1.2 Ensure password unlock time is configured. (Automated)
- id: 35677
title: "Ensure password unlock time is configured."
description: "unlock_time=<n> - The access will be re-enabled after seconds after the lock out. The value 0 has the same meaning as value never - the access will not be re-enabled without resetting the faillock entries by the faillock(8) command. Note: - The default directory that pam_faillock uses is usually cleared on system boot so the access will be also re-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option. It is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers. - - The maximum configurable value for unlock_time is 604800."
rationale: "Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."
impact: "Use of unlock_time=0 may allow an attacker to cause denial of service to legitimate users. This will also require a systems administrator with elevated privileges to unlock the account."
remediation: "Set password unlock time to conform to site policy. unlock_time should be 0 (never), or 900 seconds or greater. Edit /etc/security/faillock.conf and update or add the following line: unlock_time = 900 Run the following command: remove the unlock_time argument from the pam_faillock.so module in the PAM files: # grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?unlock_time\\b' /usr/share/pam-configs/* Edit any returned files and remove the unlock_time=<N> argument from the pam_faillock.so line(s):."
compliance:
- cis: ["5.3.3.1.2"]
- cis_csc_v8: ["6.2"]
- cis_csc_v7: ["16.7"]
- cmmc_v2.0: ["AC.L1-3.1.1"]
- hipaa: ["164.308(a)(3)(ii)(C)"]
- iso_27001-2013: ["A.9.2.6"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003"]
- nist_sp_800-53: ["AC-2(1)"]
- pci_dss_v3.2.1: ["8.1.3"]
- pci_dss_v4.0: ["8.2.4", "8.2.5"]
- soc_2: ["CC6.2", "CC6.3"]
condition: any
rules:
- 'f:/etc/security/faillock.conf -> n:^unlock_time\s*\t*=\s*\t*(\p*\d+) compare == 0'
- 'f:/etc/security/faillock.conf -> n:^unlock_time\s*\t*=\s*\t*(\p*\d+) compare >= 900'
# 5.3.3.1.3 Ensure password failed attempts lockout includes root account. (Automated)
- id: 35678
title: "Ensure password failed attempts lockout includes root account."
description: "even_deny_root - Root account can become locked as well as regular accounts root_unlock_time=n - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option."
rationale: "Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."
impact: "Use of unlock_time=0 or root_unlock_time=0 may allow an attacker to cause denial of service to legitimate users."
remediation: "Edit /etc/security/faillock.conf: - Remove or update any line containing root_unlock_time, - OR - set it to a value of 60 or more - Update or add the following line: even_deny_root Run the following command: # grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?(even_deny_root|root_unlock_time)' /usr/share/pam-configs/* Edit any returned files and remove the even_deny_root and root_unlock_time arguments from the pam_faillock.so line(s):."
compliance:
- cis: ["5.3.3.1.3"]
- cis_csc_v8: ["6.2"]
- cis_csc_v7: ["16.7"]
- cmmc_v2.0: ["AC.L1-3.1.1"]
- hipaa: ["164.308(a)(3)(ii)(C)"]
- iso_27001-2013: ["A.9.2.6"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.003"]
- nist_sp_800-53: ["AC-2(1)"]
- pci_dss_v3.2.1: ["8.1.3"]
- pci_dss_v4.0: ["8.2.4", "8.2.5"]
- soc_2: ["CC6.2", "CC6.3"]
condition: any
rules:
- "f:/etc/security/faillock.conf -> r:^even_deny_root"
- 'f:/etc/security/faillock.conf -> n:^root_unlock_time\s*\t*=\s*\t*(\p*\d+) compare >= 60'
# 5.3.3.2.1 Ensure password number of changed characters is configured. (Automated)
- id: 35679
title: "Ensure password number of changed characters is configured."
description: "The pwquality difok option sets the number of characters in a password that must not be present in the old password."
rationale: "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."
remediation: "Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set difok to 2 or more. Ensure setting conforms to local site policy: Example: #!/usr/bin/env bash { sed -ri 's/^\\s*difok\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s' \"difok = 2\" > /etc/security/pwquality.conf.d/50-pwdifok.conf } Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?difok\\b' /usr/share/pam- configs/* Edit any returned files and remove the difok argument from the pam_pwquality.so line(s):."
compliance:
- cis: ["5.3.3.2.1"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/security/pwquality.conf -> n:^difok\s*\t*=\s*\t*(\p*\d+) compare >= 2'
# 5.3.3.2.2 Ensure minimum password length is configured. (Automated)
- id: 35680
title: "Ensure minimum password length is configured."
description: "The minimum password length setting determines the lowers number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps \"passphrase\" is a better term than \"password\". The minlen option sets the minimum acceptable size for the new password (plus one if credits are not disabled which is the default). Cannot be set to lower value than 6."
rationale: "Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords."
impact: "In general, it is true that longer passwords are better (harder to crack), but it is also true that forced password length requirements can cause user behavior that is predictable and undesirable. For example, requiring users to have a minimum 16-character password may cause them to choose repeating patterns like fourfourfourfour or passwordpassword that meet the requirement but aren’t hard to guess. Additionally, length requirements increase the chances that users will adopt other insecure practices, like writing them down, re-using them or storing them unencrypted in their documents. Having a reasonable minimum length with no maximum character limit increases the resulting average password length used (and therefore the strength).6."
remediation: "Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set password length of 14 or more characters. Ensure that password length conforms to local site policy: Example: #!/usr/bin/env bash { sed -ri 's/^\\s*minlen\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s' \"minlen = 14\" > /etc/security/pwquality.conf.d/50- pwlength.conf } Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?minlen\\b' /usr/share/pam- configs/* Edit any returned files and remove the minlen argument from the pam_pwquality.so line(s):."
compliance:
- cis: ["5.3.3.2.2"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/security/pwquality.conf -> !r:^\s*\t*# && n:\s*\t*minlen\s*\t*=\s*\t*(\d+) compare >= 14'
# 5.3.3.2.3 Ensure password complexity is configured. (Manual)
- id: 35681
title: "Ensure password complexity is configured."
description: "Password complexity can be set through: - minclass - The minimum number of classes of characters required in a new password. (digits, uppercase, lowercase, others). e.g. minclass = 4 requires digits, uppercase, lower case, and special characters. - dcredit - The maximum credit for having digits in the new password. If less than 0 it is the minimum number of digits in the new password. e.g. dcredit = -1 requires at least one digit - ucredit - The maximum credit for having uppercase characters in the new password. If less than 0 it is the minimum number of uppercase characters in the new password. e.g. ucredit = -1 requires at least one uppercase character - ocredit - The maximum credit for having other characters in the new password. If less than 0 it is the minimum number of other characters in the new password. e.g. ocredit = -1 requires at least one special character - lcredit - The maximum credit for having lowercase characters in the new password. If less than 0 it is the minimum number of lowercase characters in the new password. e.g. lcredit = -1 requires at least one lowercase character."
rationale: "Strong passwords protect systems from being hacked through brute force methods. Requiring at least one non-alphabetic character increases the search space beyond pure dictionary words, which makes the resulting password harder to crack. Forcing users to choose an excessively complex password, e.g. some combination of upper-case, lower-case, numbers, and special characters, has a negative impact. It places an extra burden on users and many will use predictable patterns (for example, a capital letter in the first position, followed by lowercase letters, then one or two numbers, and a special character at the end). Attackers know this, so dictionary attacks will often contain these common patterns and use the most common substitutions like, $ for s, @ for a, 1 for l, 0 for o."
impact: "Passwords that are too complex in nature make it harder for users to remember, leading to bad practices. In addition, composition requirements provide no defense against common attack types such as social engineering or insecure storage of passwords."
remediation: "Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?(minclass|[dulo]credit)\\b' /usr/share/pam-configs/* Edit any returned files and remove the minclass, dcredit, ucredit, lcredit, and ocredit arguments from the pam_pwquality.so line(s) Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line(s) to set complexity according to local site policy: - minclass = _N_ - dcredit = _N_ # Value should be either 0 or a number proceeded by a minus (- ) symbol - ucredit = -1 # Value should be either 0 or a number proceeded by a minus (-) symbol - ocredit = -1 # Value should be either 0 or a number proceeded by a minus (-) symbol - lcredit = -1 # Value should be either 0 or a number proceeded by a minus (-) symbol Example 1 - Set minclass = 3: #!/usr/bin/env bash { sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s' \"minclass = 3\" > /etc/security/pwquality.conf.d/50- pwcomplexity.conf } Example 2 - set dcredit = -1, ucredit = -1, and lcredit = -1: #!/usr/bin/env bash { sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '%s\\n' \"dcredit = -1\" \"ucredit = -1\" \"lcredit = -1\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf }."
references:
- 'https://www.cisecurity.org/insights/white-papers/cis-password-policy-guide'
compliance:
- cis: ["5.3.3.2.3"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/security/pwquality.conf -> !r:^\s*\t*# && n:\s*\t*minclass\s*\t*=\s*\t*(\d+) compare >= 4'
# 5.3.3.2.4 Ensure password same consecutive characters is configured. (Automated)
- id: 35682
title: "Ensure password same consecutive characters is configured."
description: "The pwquality maxrepeat option sets the maximum number of allowed same consecutive characters in a new password."
rationale: "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."
remediation: "Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set maxrepeat to 3 or less and not 0. Ensure setting conforms to local site policy: Example: #!/usr/bin/env bash { sed -ri 's/^\\s*maxrepeat\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s' \"maxrepeat = 3\" > /etc/security/pwquality.conf.d/50- pwrepeat.conf } Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxrepeat\\b' /usr/share/pam-configs/* Edit any returned files and remove the maxrepeat argument from the pam_pwquality.so line(s):."
compliance:
- cis: ["5.3.3.2.4"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/security/pwquality.conf -> !r:^# && n:maxrepeat\s*\t*=\s*\t*(\d+) compare <=3'
- 'not f:/etc/security/pwquality.conf -> !r:^# && n:maxrepeat\s*\t*=\s*\t*(\d+) compare =0'
# 5.3.3.2.5 Ensure password maximum sequential characters is configured. (Automated)
- id: 35683
title: "Ensure password maximum sequential characters is configured."
description: "The pwquality maxsequence option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are 12345 or fedcb. The check is disabled if the value is 0. Note: Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password."
rationale: "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."
remediation: "Create or modify a file ending in .conf in the /etc/security/pwquality.conf.d/ directory or the file /etc/security/pwquality.conf and add or modify the following line to set maxsequence to 3 or less and not 0. Ensure setting conforms to local site policy: Example: #!/usr/bin/env bash { sed -ri 's/^\\s*maxsequence\\s*=/# &/' /etc/security/pwquality.conf [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s' \"maxsequence = 3\" > /etc/security/pwquality.conf.d/50- pwmaxsequence.conf } Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxsequence\\b' /usr/share/pam-configs/* Edit any returned files and remove the maxsequence argument from the pam_pwquality.so line(s):."
compliance:
- cis: ["5.3.3.2.5"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/security/pwquality.conf -> !r:^# && n:maxsequence\s*\t*=\s*\t*(\d+) compare <=3'
- 'not f:/etc/security/pwquality.conf -> !r:^# && n:maxsequence\s*\t*=\s*\t*(\d+) compare =0'
# 5.3.3.2.6 Ensure password dictionary check is enabled. (Automated)
- id: 35684
title: "Ensure password dictionary check is enabled."
description: "The pwquality dictcheck option sets whether to check for the words from the cracklib dictionary."
rationale: "If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks."
remediation: "Edit any file ending in .conf in the /etc/security/pwquality.conf.d/ directory and/or the file /etc/security/pwquality.conf and comment out or remove any instance of dictcheck = 0: Example: # sed -ri 's/^\\s*dictcheck\\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?dictcheck\\b' /usr/share/pam-configs/* Edit any returned files and remove the dictcheck argument from the pam_pwquality.so line(s)."
compliance:
- cis: ["5.3.3.2.6"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'not f:/etc/security/pwquality.conf -> !r:^# && n:dictcheck\s*\t*=\s*\t*(\d+) compare =0'
# 5.3.3.2.7 Ensure password quality checking is enforced. (Automated)
- id: 35685
title: "Ensure password quality checking is enforced."
description: "The pam_pwquality module can be configured to either reject a password if it fails the checks, or only print a warning. This is configured by setting the enforcing=<N> argument. If nonzero, a password will be rejected if it fails the checks, otherwise only a warning message will be provided. This setting applies only to the pam_pwquality module and possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1)."
rationale: "Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords."
remediation: "Run the following command: # grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?enforcing=0\\b' /usr/share/pam-configs/* Edit any returned files and remove the enforcing=0 argument from the pam_pwquality.so line(s) Edit /etc/security/pwquality.conf and all files ending in .conf in the /etc/security/pwquality.conf.d/ directory and remove or comment out any line containing the enforcing = 0 argument: Example: # sed -ri 's/^\\s*enforcing\\s*=\\s*0/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf."
compliance:
- cis: ["5.3.3.2.7"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'not c:cat /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf -> r:^enforcing\s*\t*=\s*\t*0'
# 5.3.3.2.8 Ensure password quality is enforced for the root user. (Automated)
- id: 35686
title: "Ensure password quality is enforced for the root user."
description: "If the pwquality enforce_for_root option is enabled, the module will return error on failed check even if the user changing the password is root. This option is off by default which means that just the message about the failed check is printed but root can change the password anyway. Note: The root is not asked for an old password so the checks that compare the old and new password are not performed."
rationale: "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."
remediation: "Edit or add the following line in a *.conf file in /etc/security/pwquality.conf.d or in /etc/security/pwquality.conf: Example: #!/urs/bin/env bash { [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/ printf '\\n%s\\n' \"enforce_for_root\" > /etc/security/pwquality.conf.d/50- pwroot.conf }."
compliance:
- cis: ["5.3.3.2.8"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: any
rules:
- "f:/etc/security/pwquality.conf -> r:^enforce_for_root"
- 'd:/etc/security/pwquality.conf.d -> r:\.+.conf$ -> r:^enforce_for_root'
# 5.3.3.3.1 Ensure password history remember is configured. (Automated)
- id: 35687
title: "Ensure password history remember is configured."
description: "The /etc/security/opasswd file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set via the remember argument value in set for the pam_pwhistory module. - remember=<N> - <N> is the number of old passwords to remember."
rationale: "Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password. Note: These change only apply to accounts configured on the local system."
remediation: "Run the following command: # awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/* Edit any returned files and edit or add the remember= argument, with a value of 24 or more, that meets local site policy to the pam_pwhistory line in the Password section: Example File: Name: pwhistory password history checking Default: yes Priority: 1024 Password-Type: Primary Password: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes remember=<N>** Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <MODIFIED_PROFILE_NAME> Example: # pam-auth-update --enable pwhistory."
compliance:
- cis: ["5.3.3.3.1"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.002", "T1078.003", "T1078.004", "T1110", "T1110.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-password -> r:^password\s*\t*requisite\s*\t*pam_pwhistory.so && n:remember=(\p*\d+) compare >= 24'
# 5.3.3.3.2 Ensure password history is enforced for the root user. (Automated)
- id: 35688
title: "Ensure password history is enforced for the root user."
description: "If the pwhistory enforce_for_root option is enabled, the module will enforce password history for the root user as well."
rationale: "Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password Note: These change only apply to accounts configured on the local system."
remediation: "Run the following command: # awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/* Edit any returned files and add the enforce_for_root argument to the pam_pwhistory line in the Password section: Example File: Name: pwhistory password history checking Default: yes Priority: 1024 Password-Type: Primary Password: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes enforce_for_root** Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <MODIFIED_PROFILE_NAME> Example: # pam-auth-update --enable pwhistory."
compliance:
- cis: ["5.3.3.3.2"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1110", "T1110.001", "T1110.002", "T1110.003", "T1178.001", "T1178.002", "T1178.003", "T1178.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-password -> r:^password\s*\t*requisite\s*\t*pam_pwhistory.so && r:enforce_for_root'
# 5.3.3.3.3 Ensure pam_pwhistory includes use_authtok. (Automated)
- id: 35689
title: "Ensure pam_pwhistory includes use_authtok."
description: "use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module."
rationale: "use_authtok allows multiple pam modules to confirm a new password before it is accepted."
remediation: "Run the following command: # awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/* Edit any returned files and add the use_authtok argument to the pam_pwhistory line in the Password section: Example File: Name: pwhistory password history checking Default: yes Priority: 1024 Password-Type: Primary Password: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes use_authtok** Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <MODIFIED_PROFILE_NAME> Example: # pam-auth-update --enable pwhistory."
compliance:
- cis: ["5.3.3.3.3"]
- cis_csc_v8: ["3.11"]
- cis_csc_v7: ["16.4"]
- cmmc_v2.0: ["AC.L2-3.1.19", "IA.L2-3.5.10", "MP.L2-3.8.1", "SC.L2-3.13.11", "SC.L2-3.13.16"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- nist_sp_800-53: ["SC-28", "SC-28(1)"]
- pci_dss_v3.2.1: ["3.4", "3.4.1", "8.2.1"]
- pci_dss_v4.0: ["3.1.1", "3.3.2", "3.3.3", "3.5.1", "3.5.1.2", "3.5.1.3", "8.3.2"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/pam.d/common-password -> !r:^# && r:password\s*\t*requisite\s*\t*pam_pwhistory.so && n:remember\s*\t*=\s*\t*(\d+) compare => 5'
- 'f:/etc/pam.d/common-password -> !r:^# && r:password && r:success && r:default\s*=\s*ignore && r:pam_unix.so && r:use_authtok'
# 5.3.3.4.1 Ensure pam_unix does not include nullok. (Automated)
- id: 35690
title: "Ensure pam_unix does not include nullok."
description: "The nullok argument overrides the default action of pam_unix.so to not permit the user access to a service if their official password is blank."
rationale: "Using a strong password is essential to helping protect personal and sensitive information from unauthorized access."
remediation: "Run the following command: # grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?nullok\\b' /usr/share/pam-configs/* Edit any files returned and remove the nullok argument for the pam_unix lines Example File: Name: Unix authentication Default: yes Priority: 256 Auth-Type: Primary Auth: [success=end default=ignore] pam_unix.so try_first_pass # <- **ensure line does not include nullok nullok** Auth-Initial: [success=end default=ignore] pam_unix.so # <- **ensure line does not include nullok nullok** Account-Type: Primary Account: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Account-Initial: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Session-Type: Additional Session: required pam_unix.so Session-Initial: required pam_unix.so Password-Type: Primary Password: [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt Password-Initial: [success=end default=ignore] pam_unix.so obscure yescrypt Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <EDITED_PROFILE_NAME> Example: # pam-auth-update --enable unix Note: If custom files are being used, the corresponding files in /etc/pam.d/ would need to be edited directly, and the pam-auth-update --enable <EDITED_PROFILE_NAME> command skipped."
compliance:
- cis: ["5.3.3.4.1"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "not f:/etc/pam.d/common-password -> r:pam_unix.so && r:nullok"
- "not f:/etc/pam.d/common-auth -> r:pam_unix.so && r:nullok"
- "not f:/etc/pam.d/common-account -> r:pam_unix.so && r:nullok"
- "not f:/etc/pam.d/common-session -> r:pam_unix.so && r:nullok"
- "not f:/etc/pam.d/common-session-noninteractive -> r:pam_unix.so && r:nullok"
# 5.3.3.4.2 Ensure pam_unix does not include remember. (Automated)
- id: 35691
title: "Ensure pam_unix does not include remember."
description: "The remember=n argument saves the last n passwords for each user in /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the pam_pwhistory module should be used. The pam_pwhistory module saves the last n passwords for each user in /etc/security/opasswd using the password hash algorithm set on the pam_unix module. This allows for the yescrypt or sha512 hash algorithm to be used."
rationale: "The remember=n argument should be removed to ensure a strong password hashing algorithm is being used. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user's old passwords stored in /etc/security/opasswd."
remediation: "Run the following command: # grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?remember\\b' /usr/share/pam-configs/* Edit any files returned and remove the remember=_<N>_ argument for the pam_unix lines Example output: [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5 # **<- remove remember=<N>** [success=end default=ignore] pam_unix.so obscure yescrypt remember=5 # **<- remove remember=<N>** Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <EDITED_PROFILE_NAME> Example: # pam-auth-update --enable unix Note: If custom files are being used, the corresponding files in /etc/pam.d/ would need to be edited directly, and the pam-auth-update --enable <EDITED_PROFILE_NAME> command skipped."
compliance:
- cis: ["5.3.3.4.2"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "not f:/etc/pam.d/common-password -> r:pam_unix.so && r:remember"
- "not f:/etc/pam.d/common-auth -> r:pam_unix.so && r:remember"
- "not f:/etc/pam.d/common-account -> r:pam_unix.so && r:remember"
- "not f:/etc/pam.d/common-session -> r:pam_unix.so && r:remember"
- "not f:/etc/pam.d/common-session-noninteractive -> r:pam_unix.so && r:remember"
# 5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm. (Automated)
- id: 35692
title: "Ensure pam_unix includes a strong password hashing algorithm."
description: "A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password. The pam_unix module can be configured to use one of the following hashing algorithms for user's passwords: - md5 - When a user changes their password next, encrypt it with the MD5 algorithm. - bigcrypt - When a user changes their password next, encrypt it with the DEC C2 algorithm. - sha256 - When a user changes their password next, encrypt it with the SHA256 algorithm. The SHA256 algorithm must be supported by the crypt(3) function. - sha512 - When a user changes their password next, encrypt it with the SHA512 algorithm. The SHA512 algorithm must be supported by the crypt(3) function. - blowfish - When a user changes their password next, encrypt it with the blowfish algorithm. The blowfish algorithm must be supported by the crypt(3) function. - gost_yescrypt - When a user changes their password next, encrypt it with the gost-yescrypt algorithm. The gost-yescrypt algorithm must be supported by the crypt(3) function. - yescrypt - When a user changes their password next, encrypt it with the yescrypt algorithm. The yescrypt algorithm must be supported by the crypt(3) function."
rationale: "The SHA-512 and yescrypt algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user passwords. Note: These changes only apply to the local system."
remediation: "Run the following command: # awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/* Edit any returned files and edit or add a strong hashing algorithm, either sha512 or yescrypt, that meets local site policy to the pam_unix lines in the Password section: Example File: Name: Unix authentication Default: yes Priority: 256 Auth-Type: Primary # <- Start of \"Auth\" section Auth: [success=end default=ignore] pam_unix.so try_first_pass Auth-Initial: [success=end default=ignore] pam_unix.so Account-Type: Primary # <- Start of \"Account\" section Account: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Account-Initial: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Session-Type: Additional # <- Start of \"Session\" section Session: required pam_unix.so Session-Initial: required pam_unix.so Password-Type: Primary # <- Start of \"Password\" section Password: [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt** Password-Initial: [success=end default=ignore] pam_unix.so obscure yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt** Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <MODIFIED_PROFILE_NAME> Example: # pam-auth-update --enable unix."
compliance:
- cis: ["5.3.3.4.3"]
- cis_csc_v8: ["3.11"]
- cis_csc_v7: ["16.4"]
- cmmc_v2.0: ["AC.L2-3.1.19", "IA.L2-3.5.10", "MP.L2-3.8.1", "SC.L2-3.13.11", "SC.L2-3.13.16"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- nist_sp_800-53: ["SC-28", "SC-28(1)"]
- pci_dss_v3.2.1: ["3.4", "3.4.1", "8.2.1"]
- pci_dss_v4.0: ["3.1.1", "3.3.2", "3.3.3", "3.5.1", "3.5.1.2", "3.5.1.3", "8.3.2"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "f:/etc/pam.d/common-password -> r:^password && r:pam_unix.so && r:sha512|yescrypt"
# 5.3.3.4.4 Ensure pam_unix includes use_authtok. (Automated)
- id: 35693
title: "Ensure pam_unix includes use_authtok."
description: "use_authtok - When password changing enforce the module to set the new password to the one provided by a previously stacked password module."
rationale: "use_authtok allows multiple pam modules to confirm a new password before it is accepted."
remediation: "Run the following command: # awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/* Edit any returned files add use_authtok to the pam_unix line in the Password section under Password: subsection: Note: The if the file's Password section includes a Password-Initial: subsection, use_authtok should not be added to the pam_unix line in the Password-Initial: subsection Example File: Name: Unix authentication Default: yes Priority: 256 Auth-Type: Primary # <- Start of \"Auth\" section Auth: [success=end default=ignore] pam_unix.so try_first_pass Auth-Initial: [success=end default=ignore] pam_unix.so Account-Type: Primary # <- Start of \"Account\" section Account: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Account-Initial: [success=end new_authtok_reqd=done default=ignore] pam_unix.so Session-Type: Additional # <- Start of \"Session\" section Session: required pam_unix.so Session-Initial: required pam_unix.so Password-Type: Primary # <- Start of \"Password\" section Password: [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure line includes use_authtok** Password-Initial: [success=end default=ignore] pam_unix.so obscure yescrypt # <- **Password-Initial: subsection does not include use_authtok Run the following command to update the files in the /etc/pam.d/ directory: # pam-auth-update --enable <MODIFIED_PROFILE_NAME> Example: # pam-auth-update --enable unix."
compliance:
- cis: ["5.3.3.4.4"]
- cis_csc_v8: ["3.11"]
- cis_csc_v7: ["16.4"]
- cmmc_v2.0: ["AC.L2-3.1.19", "IA.L2-3.5.10", "MP.L2-3.8.1", "SC.L2-3.13.11", "SC.L2-3.13.16"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- nist_sp_800-53: ["SC-28", "SC-28(1)"]
- pci_dss_v3.2.1: ["3.4", "3.4.1", "8.2.1"]
- pci_dss_v4.0: ["3.1.1", "3.3.2", "3.3.3", "3.5.1", "3.5.1.2", "3.5.1.3", "8.3.2"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "f:/etc/pam.d/common-password -> r:^password && r:pam_unix.so && r:use_authtok"
# 5.4.1.1 Ensure password expiration is configured. (Automated)
- id: 35694
title: "Ensure password expiration is configured."
description: "The PASS_MAX_DAYS parameter in /etc/login.defs allows an administrator to force passwords to expire once they reach a defined age. PASS_MAX_DAYS <N> - The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, -1 will be assumed (which disables the restriction)."
rationale: "The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. Therefore, reducing the maximum age of a password also reduces an attacker's window of opportunity. We recommend a yearly password change. This is primarily because for all their good intentions users will share credentials across accounts. Therefore, even if a breach is publicly identified, the user may not see this notification, or forget they have an account on that site. This could leave a shared credential vulnerable indefinitely. Having an organizational policy of a 1-year (annual) password expiration is a reasonable compromise to mitigate this with minimal user burden."
impact: "The password expiration must be greater than the minimum days between password changes or users will be unable to change their password. Excessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous one (incrementing a number used in the password for example). Also, password expiration requirements offer no containment benefits because attackers will often use credentials as soon as they compromise them. Instead, immediate password changes should be based on key events including, but not limited to: Indication of compromise - - Change of user roles - When a user leaves the organization. Not only does changing passwords every few weeks or months frustrate the user, but it’s also been suggested that it does more harm than good, because it could lead to bad practices by the user such as adding a character to the end of their existing password."
remediation: "Set the PASS_MAX_DAYS parameter to conform to site policy in /etc/login.defs : PASS_MAX_DAYS 365 Modify user parameters for all users with a password set to match: # chage --maxdays 365 <user> Edit /etc/login.defs and set PASS_MAX_DAYS to a value greater than 0 that follows local site policy: Example: PASS_MAX_DAYS 365 Run the following command to modify user parameters for all users with a password set to a maximum age no greater than 365 or less than 1 that follows local site policy: # chage --maxdays <N> <user> Example: # awk -F: '($2~/^\\$.+\\$/) {if($5 > 365 || $5 < 1)system (\"chage --maxdays 365 \" $1)}' /etc/shadow Warning: If a password has been set at system install or kickstart, the last change date field is not set, In this case, setting PASS_MAX_DAYS will immediately expire the password. One possible solution is to populate the last change date field through a command like: chage -d \"$(date +%Y-%m-%d)\" root."
compliance:
- cis: ["5.4.1.1"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.002", "T1078.003", "T1078.004", "T1110", "T1110.001", "T1110.002", "T1110.003", "T1110.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/login.defs -> n:^\s*\t*PASS_MAX_DAYS\s*\t*(\d+) compare <= 365'
- 'f:/etc/login.defs -> n:^\s*\t*PASS_MAX_DAYS\s*\t*(\d+) compare > 0'
- 'not f:/etc/shadow -> !r:^\w+:\p: && n:^\w+:\S*:\d*:\d*:(\d+) compare > 365'
# 5.4.1.2 Ensure minimum password days is configured. (Manual)
- id: 35695
title: "Ensure minimum password days is configured."
description: "PASS_MIN_DAYS <N> - The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, 0 will be assumed (which disables the restriction)."
rationale: "Users may have favorite passwords that they like to use because they are easy to remember, and they believe that their password choice is secure from compromise. Unfortunately, passwords are compromised and if an attacker is targeting a specific individual user account, with foreknowledge of data about that user, reuse of old, potentially compromised passwords, may cause a security breach. By restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls."
impact: "If a user's password is set by other personnel as a procedure in dealing with a lost or expired password, the user should be forced to update this \"set\" password with their own password. e.g. force \"change at next logon\". If it is not possible to have a user set their own password immediately, and this recommendation or local site procedure may cause a user to continue using a third party generated password, PASS_MIN_DAYS for the effected user should be temporally changed to 0, to allow a user to change their password immediately. For applications where the user is not using the password at console, the ability to \"change at next logon\" may be limited. This may cause a user to continue to use a password created by other personnel."
remediation: "Edit /etc/login.defs and set PASS_MIN_DAYS to a value greater than 0 that follows local site policy: Example: PASS_MIN_DAYS 1 Run the following command to modify user parameters for all users with a password set to a minimum days greater than zero that follows local site policy: # chage --mindays <N> <user> Example: # awk -F: '($2~/^\\$.+\\$/) {if($4 < 1)system (\"chage --mindays 1 \" $1)}' /etc/shadow."
compliance:
- cis: ["5.4.1.2"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.002", "T1078.003", "T1078.004", "T1110", "T1110.004"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'f:/etc/login.defs -> n:^PASS_MIN_DAYS\s*\t*(\p*\d+) compare > 0'
- 'f:/etc/shadow -> n:\.*:\$\.*:\.*:(\p*\d+):\.*:\.*:\.*:\.*: compare > 0'
# 5.4.1.3 Ensure password expiration warning days is configured. (Automated)
- id: 35696
title: "Ensure password expiration warning days is configured."
description: "The PASS_WARN_AGE parameter in /etc/login.defs allows an administrator to notify users that their password will expire in a defined number of days. PASS_WARN_AGE <N> - The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided."
rationale: "Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered."
remediation: "Edit /etc/login.defs and set PASS_WARN_AGE to a value of 7 or more that follows local site policy: Example: PASS_WARN_AGE 7 Run the following command to modify user parameters for all users with a password set to a minimum warning to 7 or more days that follows local site policy: # chage --warndays <N> <user> Example: # awk -F: '($2~/^\\$.+\\$/) {if($6 < 7)system (\"chage --warndays 7 \" $1)}' /etc/shadow."
compliance:
- cis: ["5.4.1.3"]
- cis_csc_v8: ["4.1"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "CM.L2-3.4.1", "CM.L2-3.4.2", "CM.L2-3.4.6", "CM.L2-3.4.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1078"]
- nist_sp_800-53: ["CM-7(1)", "CM-9", "SA-10"]
- pci_dss_v3.2.1: ["11.5", "2.2"]
- pci_dss_v4.0: ["1.1.1", "1.2.1", "1.2.6", "1.2.7", "1.5.1", "2.1.1", "2.2.1"]
- soc_2: ["CC7.1", "CC8.1"]
condition: all
rules:
- 'f:/etc/login.defs -> n:^PASS_WARN_AGE\s*\t*(\p*\d+) compare >= 7'
- 'f:/etc/shadow -> n:\.*:\$\.*:\.*:\.*:\.*:(\p*\d+):\.*:\.*: compare >= 7'
# 5.4.1.4 Ensure strong password hashing algorithm is configured. (Automated)
- id: 35697
title: "Ensure strong password hashing algorithm is configured."
description: "A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password. ENCRYPT_METHOD (string) - This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values: - MD5 - MD5-based algorithm will be used for encrypting password - SHA256 - SHA256-based algorithm will be used for encrypting password - SHA512 - SHA512-based algorithm will be used for encrypting password - BCRYPT - BCRYPT-based algorithm will be used for encrypting password - YESCRYPT - YESCRYPT-based algorithm will be used for encrypting password - DES - DES-based algorithm will be used for encrypting password (default) Note: - This parameter overrides the deprecated MD5_CRYPT_ENAB variable. - This parameter will only affect the generation of group passwords. - The generation of user passwords is done by PAM and subject to the PAM configuration. It is recommended to set this variable consistently with the PAM configuration. -."
rationale: "The SHA-512 and yescrypt algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local group passwords."
remediation: "Edit /etc/login.defs and set the ENCRYPT_METHOD to SHA512 or YESCRYPT: ENCRYPT_METHOD <HASHING_ALGORITHM> Example: ENCRYPT_METHOD YESCRYPT Note: - This only effects local groups' passwords created after updating the file to use - - sha512 or yescrypt. If it is determined that the password algorithm being used is not sha512 or yescrypt, once it is changed, it is recommended that all group passwords be updated to use the stronger hashing algorithm. It is recommended that the chosen hashing algorithm is consistent across /etc/login.defs and the PAM configuration."
compliance:
- cis: ["5.4.1.4"]
- cis_csc_v8: ["3.11"]
- cis_csc_v7: ["16.4"]
- cmmc_v2.0: ["AC.L2-3.1.19", "IA.L2-3.5.10", "MP.L2-3.8.1", "SC.L2-3.13.11", "SC.L2-3.13.16"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1"]
- mitre_mitigations: ["M1041"]
- mitre_tactics: ["TA0006"]
- mitre_techniques: ["T1003", "T1003.008", "T1110", "T1110.002"]
- nist_sp_800-53: ["SC-28", "SC-28(1)"]
- pci_dss_v3.2.1: ["3.4", "3.4.1", "8.2.1"]
- pci_dss_v4.0: ["3.1.1", "3.3.2", "3.3.3", "3.5.1", "3.5.1.2", "3.5.1.3", "8.3.2"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "f:/etc/login.defs -> r:^ENCRYPT_METHOD && r:sha512|yescrypt"
# 5.4.1.5 Ensure inactive password lock is configured. (Automated)
- id: 35698
title: "Ensure inactive password lock is configured."
description: "User accounts that have been inactive for over a given period of time can be automatically disabled. INACTIVE - Defines the number of days after the password exceeded its maximum age where the user is expected to replace this password. The value is stored in the shadow password file. An input of 0 will disable an expired password with no delay. An input of -1 will blank the respective field in the shadow password file."
rationale: "Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies."
remediation: "Run the following command to set the default password inactivity period to 45 days or less that meets local site policy: # useradd -D -f <N> Example: # useradd -D -f 45 Run the following command to modify user parameters for all users with a password set to a inactive age of 45 days or less that follows local site policy: # chage --inactive <N> <user> Example: # awk -F: '($2~/^\\$.+\\$/) {if($7 > 45 || $7 < 0)system (\"chage --inactive 45 \" $1)}' /etc/shadow."
compliance:
- cis: ["5.4.1.5"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1078", "T1078.002", "T1078.003"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'c:useradd -D -> n:^INACTIVE\s*\t*=\s*\t*(\p*\d+) compare <= 45'
- 'f:/etc/shadow -> n:\.*:\$\.*:\.*:\.*:\.*:\.*:(\p*\d+):\.*: compare <= 45'
# 5.4.1.6 Ensure all users last password change date is in the past. (Automated) - Not Implemented
# 5.4.2.1 Ensure root is the only UID 0 account. (Automated)
- id: 35699
title: "Ensure root is the only UID 0 account."
description: "Any account with UID 0 has superuser privileges on the system."
rationale: "This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism as noted in Item 5.6 Ensure access to the su command is restricted."
remediation: "Run the following command to change the root account UID to 0: # usermod -u 0 root Modify any users other than root with UID 0 and assign them a new UID."
compliance:
- cis: ["5.4.2.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1548"]
condition: all
rules:
- 'not f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:0:'
# 5.4.2.2 Ensure root is the only GID 0 account. (Automated)
- id: 35700
title: "Ensure root is the only GID 0 account."
description: "The usermod command can be used to specify which group the root account belongs to. This affects permissions of files that are created by the root account."
rationale: "Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users."
remediation: "Run the following command to set the root user's GID to 0: # usermod -g 0 root Run the following command to set the root group's GID to 0: # groupmod -g 0 root Remove any users other than the root user with GID 0 or assign them a new GID if appropriate."
compliance:
- cis: ["5.4.2.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'not f:/etc/passwd -> !r:^# && !r:^root: && r:^\w+:\w+:\d+:0:'
# 5.4.2.3 Ensure group root is the only GID 0 group. (Automated)
- id: 35701
title: "Ensure group root is the only GID 0 group."
description: "The groupmod command can be used to specify which group the root group belongs to. This affects permissions of files that are group owned by the root group."
rationale: "Using GID 0 for the root group helps prevent root group owned files from accidentally becoming accessible to non-privileged users."
remediation: "Run the following command to set the root group's GID to 0: # groupmod -g 0 root Remove any groups other than the root group with GID 0 or assign them a new GID if appropriate."
compliance:
- cis: ["5.4.2.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1548"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'not f:/etc/group -> !r:^# && !r:^root: && r:^\w+:\w+:0:'
# 5.4.2.4 Ensure root account access is controlled. (Automated)
- id: 35702
title: "Ensure root account access is controlled."
description: "There are a number of methods to access the root account directly. Without a password set any user would be able to gain access and thus control over the entire system."
rationale: "Access to root should be secured at all times."
impact: "If there are any automated processes that relies on access to the root account without authentication, they will fail after remediation."
remediation: "Run the following command to set a password for the root user: # passwd root - OR - Run the following command to lock the root user account: # usermod -L root."
compliance:
- cis: ["5.4.2.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1078"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: any
rules:
- 'c:passwd -S root -> r:root\s*\t*L'
- 'c:passwd -S root -> r:root\s*\t*P'
# 5.4.2.5 Ensure root path integrity. (Automated) - Not Implemented
# 5.4.2.6 Ensure root user umask is configured. (Automated)
- id: 35703
title: "Ensure root user umask is configured."
description: "The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw-rw-). The umask modifies the default Linux permissions by restricting (masking) these permissions. The umask is not simply subtracted, but is processed bitwise. Bits set in the umask are cleared in the resulting file mode. umask can be set with either Octal or Symbolic values: - Octal (Numeric) Value - Represented by either three or four digits. ie umask 0027 or umask 027. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively. - Symbolic Value - Represented by a comma separated list for User u, group g, and world/other o. The permissions listed are not masked by umask. ie a umask set by umask u=rwx,g=rx,o= is the Symbolic equivalent of the Octal umask 027. This umask would set a newly created directory with file mode drwxr-x--- and a newly created file with file mode rw-r-----. root user Shell Configuration Files: - /root/.bash_profile - Is executed to configure the root users' shell before the initial command prompt. Is only read by login shells. - /root/.bashrc - Is executed for interactive shells. only read by a shell that's both interactive and non-login umask is set by order of precedence. If umask is set in multiple locations, this order of precedence will determine the system's default umask. Order of precedence: 1. /root/.bash_profile 2. /root/.bashrc 3. The system default umask."
rationale: "Setting a secure value for umask ensures that users make a conscious choice about their file permissions. A permissive umask value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users."
remediation: "Edit /root/.bash_profile and /root/.bashrc and remove, comment out, or update any line with umask to be 0027 or more restrictive."
compliance:
- cis: ["5.4.2.6"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- "f:/root/.bash_profile -> r:umask && r:0027|0077"
- "f:/root/.bashrc -> r:umask && r:0027|0077"
# 5.4.2.7 Ensure system accounts do not have a valid login shell. (Automated) - Not Implemented
# 5.4.2.8 Ensure accounts without a valid login shell are locked. (Automated) - Not Implemented
# 5.4.3.1 Ensure nologin is not listed in /etc/shells. (Automated)
- id: 35704
title: "Ensure nologin is not listed in /etc/shells."
description: "/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs. Be aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file."
rationale: "A user can use chsh to change their configured shell. If a user has a shell configured that isn't in in /etc/shells, then the system assumes that they're somehow restricted. In the case of chsh it means that the user cannot change that value. Other programs might query that list and apply similar restrictions. By putting nologin in /etc/shells, any user that has nologin as its shell is considered a full, unrestricted user. This is not the expected behavior for nologin."
remediation: "Edit /etc/shells and remove any lines that include nologin."
compliance:
- cis: ["5.4.3.1"]
condition: all
rules:
- "not f:/etc/shells -> !r:^# && r:nologin"
# 5.4.3.2 Ensure default user shell timeout is configured. (Automated)
- id: 35705
title: "Ensure default user shell timeout is configured."
description: "TMOUT is an environmental setting that determines the timeout of a shell in seconds. - TMOUT=n - Sets the shell timeout to n seconds. A setting of TMOUT=0 disables - timeout. readonly TMOUT-Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time. - export TMOUT - exports the TMOUT variable System Wide Shell Configuration Files: - /etc/profile - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the .bash_profile, however this file is used to set an initial PATH or PS1 for all shell users of the system. is only executed for interactive login shells, or shells executed with the login parameter. - /etc/profile.d - /etc/profile will execute the scripts within /etc/profile.d/*.sh. It is recommended to place your configuration in a shell script within /etc/profile.d to set your own system wide environmental variables. - /etc/bashrc - System wide version of .bashrc. In Fedora derived distributions, /etc/bashrc also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to /dev/null if non-interactive. Is only executed for interactive shells or if BASH_ENV is set to /etc/bashrc."
rationale: "Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session."
remediation: "Review /etc/bashrc, /etc/profile, and all files ending in *.sh in the /etc/profile.d/ directory and remove or edit all TMOUT=_n_ entries to follow local site policy. TMOUT should not exceed 900 or be equal to 0. Configure TMOUT in one of the following files: - A file in the /etc/profile.d/ directory ending in .sh - /etc/profile - /etc/bashrc TMOUT configuration examples: - As multiple lines: TMOUT=900 readonly TMOUT export TMOUT - As a single line: readonly TMOUT=900 ; export TMOUT."
compliance:
- cis: ["5.4.3.2"]
- cis_csc_v8: ["4.3"]
- cis_csc_v7: ["16.11"]
- cmmc_v2.0: ["AC.L2-3.1.10", "AC.L2-3.1.11"]
- hipaa: ["164.312(a)(2)(iii)"]
- iso_27001-2013: ["A.8.1.3"]
- mitre_mitigations: ["M1026"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1078"]
- nist_sp_800-53: ["AC-11", "AC-11(1)", "AC-12", "AC-2(5)"]
- pci_dss_v3.2.1: ["8.1.8"]
- pci_dss_v4.0: ["8.2.8"]
condition: all
rules:
- 'c:sh -c "cat /etc/bashrc /etc/profile /etc/profile.d/*.sh" -> n:TMOUT\s*\t*=\s*\t*(\p*\d+) compare <= 900 && n:TMOUT\s*\t*=\s*\t*(\p*\d+) compare > 0'
- 'c:sh -c "cat /etc/bashrc /etc/profile /etc/profile.d/*.sh" -> r:readonly\s*\t*TMOUT'
- 'c:sh -c "cat /etc/bashrc /etc/profile /etc/profile.d/*.sh" -> r:export\s*\t*TMOUT'
# 5.4.3.3 Ensure default user umask is configured. (Automated)
- id: 35706
title: "Ensure default user umask is configured."
description: "The user file-creation mode mask (umask) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (rwxrwxrwx), and for any newly created file it is 0666 (rw-rw-rw-)."
rationale: "Setting a secure default value for umask ensures that users make a conscious choice about their file permissions. A permissive umask value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users."
remediation: "Run the following script and perform the instructions in the output to set the default umask to 027 or more restrictive: #!/usr/bin/env bash { l_output=\"\" l_output2=\"\" l_out=\"\" file_umask_chk() { if grep -Psiq -- '^\\h*umask\\h+(0?[0-7][2- 7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\\h*#.*)?$' \"$l_file\"; then l_out=\"$l_out\\n - umask is set correctly in \\\"$l_file\\\"\" elif grep -Psiq -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0- 7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0- 6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx ]{1,3},)?o=[wrx]{1,3}\\b)))' \"$l_file\"; then l_output2=\"$l_output2\\n - \\\"$l_file\\\"\" fi } while IFS= read -r -d $'\\0' l_file; do file_umask_chk done < <(find /etc/profile.d/ -type f -name '*.sh' -print0) [ -n \"$l_out\" ] && l_output=\"$l_out\" l_file=\"/etc/profile\" && file_umask_chk l_file=\"/etc/bashrc\" && file_umask_chk l_file=\"/etc/bash.bashrc\" && file_umask_chk l_file=\"/etc/pam.d/postlogin\" if grep -Psiq '^\\h*session\\h+[^#\\n\\r]+\\h+pam_umask\\.so\\h+([^#\\n\\r]+\\h+)?umask=(([0-7][0- 7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b))' \"$l_file\"; then l_output2=\"$l_output2\\n - \\\"$l_file\\\"\" fi l_file=\"/etc/login.defs\" && file_umask_chk l_file=\"/etc/default/login\" && file_umask_chk if [ -z \"$l_output2\" ]; then echo -e \" - No files contain a UMASK that is not restrictive enough\\n No UMASK updates required to existing files\" else echo -e \"\\n - UMASK is not restrictive enough in the following file(s):$l_output2\\n\\n- Remediation Procedure:\\n - Update these files and comment out the UMASK line\\n or update umask to be \\\"0027\\\" or more restrictive\" fi if [ -n \"$l_output\" ]; then echo -e \"$l_output\" else echo -e \" - Configure UMASK in a file in the \\\"/etc/profile.d/\\\" directory ending in \\\".sh\\\"\\n\\n Example Command (Hash to represent being run at a root prompt):\\n\\n# printf '%s\\\\\\n' \\\"umask 027\\\" > /etc/profile.d/50-systemwide_umask.sh\\n\" fi } Notes: - This method only applies to bash and shell. If other shells are supported on the - system, it is recommended that their configuration files also are checked If the pam_umask.so module is going to be used to set umask, ensure that it's not being overridden by another setting. Refer to the PAM_UMASK(8) man page for more information."
compliance:
- cis: ["5.4.3.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: any
rules:
- "f:/etc/profile -> r:umask && r:027|0027"
- "f:/etc/login.defs -> r:umask && r:027|0027"
- "f:/etc/default/login -> r:umask && r:027|0027"
- 'd:/etc/profile.d -> r:\.+.sh$ -> r:umask && r:027|0027'
# 6.1.1.1 Ensure journald service is enabled and active. (Automated)
- id: 35707
title: "Ensure journald service is enabled and active."
description: "Ensure that the systemd-journald service is enabled to allow capturing of logging events."
rationale: "If the systemd-journald service is not enabled to start on boot, the system will not capture logging events."
remediation: "Run the following commands to unmask and start systemd-journald.service # systemctl unmask systemd-journald.service # systemctl start systemd-journald.service."
compliance:
- cis: ["6.1.1.1"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:systemctl is-enabled systemd-journald.service -> r:static"
- "c:systemctl is-active systemd-journald.service -> r:active"
# 6.1.1.2 Ensure journald log file access is configured. (Manual) - Not Implemented
# 6.1.1.3 Ensure journald log file rotation is configured. (Manual)
- id: 35708
title: "Ensure journald log file rotation is configured."
description: "Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file /etc/systemd/journald.conf is the configuration file used to specify how logs generated by Journald should be rotated."
rationale: "By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files."
remediation: "Edit /etc/systemd/journald.conf or a file ending in .conf the /etc/systemd/journald.conf.d/ directory. Set the following parameters in the [Journal] section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters. Example Configuration: [Journal] SystemMaxUse=1G SystemKeepFree=500M RuntimeMaxUse=200M RuntimeKeepFree=50M MaxFileSec=1month Example script to create systemd drop-in configuration file: { a_settings=(\"SystemMaxUse=1G\" \"SystemKeepFree=500M\" \"RuntimeMaxUse=200M\" \"RuntimeKeepFree=50M\" \"MaxFileSec=1month\") [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/ if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60- journald.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60- journald.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf fi } Note: - If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten - Logfile size and configuration to move logfiles to a remote log server should be accounted for when configuring these settings Run to following command to update the parameters in the service: # systemctl reload-or-restart systemd-journald."
compliance:
- cis: ["6.1.1.3"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'f:/etc/systemd/journald.conf -> r:^SystemMaxUse\s*\t*=\s*\t*\d+'
- 'f:/etc/systemd/journald.conf -> r:^SystemKeepFree\s*\t*=\s*\t*\d+'
- 'f:/etc/systemd/journald.conf -> r:^RuntimeMaxUse\s*\t*=\s*\t*\d+'
- 'f:/etc/systemd/journald.conf -> r:^RuntimeKeepFree\s*\t*=\s*\t*\d+'
- 'f:/etc/systemd/journald.conf -> r:^MaxFileSec\s*\t*=\s*\t*\d+'
# 6.1.1.4 Ensure only one logging system is in use. (Automated) - Not Implemented
# 6.1.2.1.1 Ensure systemd-journal-remote is installed. (Automated)
- id: 35709
title: "Ensure systemd-journal-remote is installed."
description: "Journald systemd-journal-remote supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."
rationale: "Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "Run the following command to install systemd-journal-remote: # apt install systemd-journal-remote."
compliance:
- cis: ["6.1.2.1.1"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:dpkg-query -s systemd-journal-remote -> r:^Status: install ok installed"
# 6.1.2.1.2 Ensure systemd-journal-upload authentication is configured. (Manual)
- id: 35710
title: "Ensure systemd-journal-upload authentication is configured."
description: "Journald systemd-journal-upload supports the ability to send log events it gathers to a remote log host."
rationale: "Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "Edit the /etc/systemd/journal-upload.conf file or a file in /etc/systemd/journal-upload.conf.d ending in .conf and ensure the following lines are set in the [Upload] section per your environment: Example settings: [Upload] URL=192.168.50.42 ServerKeyFile=/etc/ssl/private/journal-upload.pem ServerCertificateFile=/etc/ssl/certs/journal-upload.pem TrustedCertificateFile=/etc/ssl/ca/trusted.pem Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"URL=192.168.50.42\" \"ServerKeyFile=/etc/ssl/private/journal- upload.pem\" \\ \"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem\" \"TrustedCertificateFile=/etc/ssl/ca/trusted.pem\") [ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/ if grep -Psq -- '^\\h*\\[Upload\\]' /etc/systemd/journal-upload.conf.d/60- journald_upload.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journal- upload.conf.d/60-journald_upload.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf fi } Run the following command to update the parameters in the service: # systemctl reload-or-restart systemd-journal-upload."
compliance:
- cis: ["6.1.2.1.2"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'c:cat /etc/systemd/journal-upload.conf /etc/systemd/journal-upload.conf.d/*.conf -> r:^URL\s*\t*=\s*\t*\w+'
- 'c:cat /etc/systemd/journal-upload.conf /etc/systemd/journal-upload.conf.d/*.conf -> r:^ServerKeyFile\s*\t*=\s*\t*/\w+'
- 'c:cat /etc/systemd/journal-upload.conf /etc/systemd/journal-upload.conf.d/*.conf -> r:^ServerCertificateFile\s*\t*=\s*\t*/\w+'
- 'c:cat /etc/systemd/journal-upload.conf /etc/systemd/journal-upload.conf.d/*.conf -> r:^TrustedCertificateFile\s*\t*=\s*\t*/\w+'
# 6.1.2.1.3 Ensure systemd-journal-upload is enabled and active. (Automated)
- id: 35711
title: "Ensure systemd-journal-upload is enabled and active."
description: "Journald systemd-journal-upload supports the ability to send log events it gathers to a remote log host."
rationale: "Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "Run the following commands to unmask, enable and start systemd-journal-upload: # systemctl unmask systemd-journal-upload.service # systemctl --now enable systemd-journal-upload.service."
compliance:
- cis: ["6.1.2.1.3"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:systemctl is-enabled systemd-journal-upload.service -> r:enabled"
- "c:systemctl is-active systemd-journal-upload.service -> r:active"
# 6.1.2.1.4 Ensure systemd-journal-remote service is not in use. (Automated)
- id: 35712
title: "Ensure systemd-journal-remote service is not in use."
description: "Journald systemd-journal-remote supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts. Note: - The same package, systemd-journal-remote, is used for both sending logs to remote hosts and receiving incoming logs. - With regards to receiving logs, there are two services; systemd-journal- remote.socket and systemd-journal-remote.service."
rationale: "If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "Run the following commands to stop and mask systemd-journal-remote.socket and systemd-journal-remote.service: # systemctl stop systemd-journal-remote.socket systemd-journal-remote.service # systemctl mask systemd-journal-remote.socket systemd-journal-remote.service."
compliance:
- cis: ["6.1.2.1.4"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- "not c:systemctl is-enabled systemd-journal-remote.socket systemd-journal-remote.service -> r:^enabled"
- "not c:systemctl is-active systemd-journal-remote.socket systemd-journal-remote.service -> r:^active"
# 6.1.2.2 Ensure journald ForwardToSyslog is disabled. (Automated)
- id: 35713
title: "Ensure journald ForwardToSyslog is disabled."
description: "Data from journald should be kept in the confines of the service and not forwarded to other services."
rationale: "- IF - journald is the method for capturing logs, all logs of the system should be handled by journald and not forwarded to other logging mechanisms. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "- IF - rsyslog is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. - IF - journald is the preferred method for capturing logs: Set the following parameter in the [Journal] section in /etc/systemd/journald.conf or a file in /etc/systemd/journald.conf.d/ ending in .conf: ForwardToSyslog=no Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"ForwardToSyslog=no\") [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/ if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60- journald.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60- journald.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf fi } Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten Run to following command to update the parameters in the service: # systemctl reload-or-restart systemd-journald."
compliance:
- cis: ["6.1.2.2"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: any
rules:
- 'not f:/etc/systemd/journald.conf -> !r:^# && r:ForwardToSyslog\s*=\s*yes'
- 'not d:/etc/systemd/journald.conf.d -> r:\.* -> !r:^# && r:ForwardToSyslog\s*=\s*yes'
# 6.1.2.3 Ensure journald Compress is configured. (Automated)
- id: 35714
title: "Ensure journald Compress is configured."
description: "The journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large."
rationale: "Uncompressed large files may unexpectedly fill a filesystem leading to resource unavailability. Compressing logs prior to write can prevent sudden, unexpected filesystem impacts. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "- IF - rsyslog is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. - IF - journald is the preferred method for capturing logs: Set the following parameter in the [Journal] section in /etc/systemd/journald.conf or a file in /etc/systemd/journald.conf.d/ ending in .conf: Compress=yes Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"Compress=yes\") [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/ if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60- journald.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60- journald.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf fi } Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten Run to following command to update the parameters in the service: # systemctl reload-or-restart systemd-journald."
compliance:
- cis: ["6.1.2.3"]
- cis_csc_v8: ["8.2", "8.3"]
- cis_csc_v7: ["6.2", "6.3", "6.4"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1053"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3", "10.7"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
- soc_2: ["A1.1"]
condition: all
rules:
- 'f:/etc/systemd/journald.conf -> r:^Compress\s*\t*=\s*\t*yes'
# 6.1.2.4 Ensure journald Storage is configured. (Automated)
- id: 35715
title: "Ensure journald Storage is configured."
description: "Data from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss due to a reboot."
rationale: "Writing log data to disk will provide the ability to forensically reconstruct events which may have impacted the operations or security of a system even after a system crash or reboot. Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used."
remediation: "- IF - rsyslog is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. - IF - journald is the preferred method for capturing logs: Set the following parameter in the [Journal] section in /etc/systemd/journald.conf or a file in /etc/systemd/journald.conf.d/ ending in .conf: Storage=persistent Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"Storage=persistent\") [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/ if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60- journald.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60- journald.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf fi } Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten Run to following command to update the parameters in the service: # systemctl reload-or-restart systemd-journald."
compliance:
- cis: ["6.1.2.4"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'f:/etc/systemd/journald.conf -> r:^Storage\s*\t*=\s*\t*persistent'
# 6.1.3.1 Ensure rsyslog is installed. (Automated)
- id: 35716
title: "Ensure rsyslog is installed."
description: "The rsyslog software is recommended in environments where journald does not meet operation requirements."
rationale: "The security enhancements of rsyslog such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server) justify installing and configuring the package."
remediation: "Run the following command to install rsyslog: # apt install rsyslog."
compliance:
- cis: ["6.1.3.1"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029", "M1057"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1005", "T1070", "T1070.002"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:dpkg-query -s rsyslog -> r:^Status: install ok installed"
# 6.1.3.2 Ensure rsyslog service is enabled and active. (Automated)
- id: 35717
title: "Ensure rsyslog service is enabled and active."
description: "Once the rsyslog package is installed, ensure that the service is enabled."
rationale: "If the rsyslog service is not enabled to start on boot, the system will not capture logging events."
remediation: "- IF - rsyslog is being used for logging on the system: Run the following commands to unmask, enable, and start rsyslog.service: # systemctl unmask rsyslog.service # systemctl enable rsyslog.service # systemctl start rsyslog.service."
compliance:
- cis: ["6.1.3.2"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1070", "T1070.002", "T1211", "T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:systemctl is-enabled rsyslog -> r:^enabled"
- "c:systemctl is-active rsyslog.service -> r:^active"
# 6.1.3.3 Ensure journald is configured to send logs to rsyslog. (Automated)
- id: 35718
title: "Ensure journald is configured to send logs to rsyslog."
description: "Data from systemd-journald may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of systemd-journald logs, however, use of the rsyslog service provides a consistent means of log collection and export."
rationale: "- IF - rsyslog is the preferred method for capturing logs, all logs of the system should be sent to it for further processing. Note: This recommendation only applies if rsyslog is the chosen method for client side logging. Do not apply this recommendation if systemd-journald is used."
remediation: "- IF - Journald is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure Journald\" section followed. - IF - rsyslog is the preferred method for capturing logs: Set the following parameter in the [Journal] section in /etc/systemd/journald.conf or a file in /etc/systemd/journald.conf.d/ ending in .conf: ForwardToSyslog=yes Example script to create systemd drop-in configuration file: #!/usr/bin/env bash { a_settings=(\"ForwardToSyslog=yes\") [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/ if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60- journald.conf; then printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60- journald.conf else printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf fi } Note: If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten Run to following command to update the parameters in the service: Restart systemd-journald.service: # systemctl reload-or-restart systemd-journald.service."
compliance:
- cis: ["6.1.3.3"]
- cis_csc_v8: ["8.2", "8.9"]
- cis_csc_v7: ["6.2", "6.3", "6.5"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006", "T1565"]
- nist_sp_800-53: ["AU-6(3)", "AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3", "10.5.3", "10.5.4"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "10.3.3", "5.3.4", "6.4.1", "6.4.2"]
- soc_2: ["PL1.4"]
condition: any
rules:
- "c:systemctl show systemd-journald.service -> r:^LoadState=loaded|^ActiveState=active"
- "c:systemctl show rsyslog.service -> r:^LoadState=loaded|^ActiveState=active"
- 'f:/etc/systemd/journald.conf -> r:^ForwardToSyslog\s*\t*=\s*\t*yes'
# 6.1.3.4 Ensure rsyslog log file creation mode is configured. (Automated)
- id: 35719
title: "Ensure rsyslog log file creation mode is configured."
description: "rsyslog will create logfiles that do not already exist on the system. The global() configuration object umask, available in rsyslog 8.26.0+, sets the rsyslogd process' umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero. The legacy $umask parameter sets the rsyslogd process' umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero. The legacy $FileCreateMode parameter allows the setting of the mode with which rsyslogd creates new files. If not specified, the value 0644 is used. The value given must always be a 4-digit octal number, with the initial digit being zero. Please note that the actual permission depend on rsyslogd process umask. If in doubt, use $umask 0000 right at the beginning of the configuration file to remove any restrictions. The legacy $FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode parameter. Order of lines is vitally important."
rationale: "It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected."
remediation: "Edit either /etc/rsyslog.conf or a dedicated .conf file in /etc/rsyslog.d/ and set $FileCreateMode to 0640 or more restrictive: $FileCreateMode 0640 Example script to create a drop-in configuration file in the default include location: #!/usr/bin/env bash { [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslog.d/ printf '%s\\n' \"\" \"\\$FileCreateMode 0640\" >> /etc/rsyslog.d/60-rsyslog.conf } Reload the service: # systemctl reload-or-restart rsyslog."
references:
- 'https://www.rsyslog.com/doc/'
compliance:
- cis: ["6.1.3.4"]
- cis_csc_v8: ["3.3", "8.2"]
- cis_csc_v7: ["5.1", "6.2", "6.3"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "AU.L2-3.3.1", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)", "164.312(b)"]
- iso_27001-2013: ["A.12.4.1", "A.14.2.5", "A.8.1.3"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6", "AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3", "7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'd:/etc/rsyslog.d -> r:\.*.conf -> r:^\$FileCreateMode && r:0640|0600|0400'
- 'f:/etc/rsyslog.conf -> r:^\$FileCreateMode && r:0640|0600|0400'
# 6.1.3.5 Ensure rsyslog logging is configured. (Manual) - Not Implemented
# 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host. (Manual)
- id: 35720
title: "Ensure rsyslog is configured to send logs to a remote log host."
description: "rsyslog supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."
rationale: "Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system."
remediation: "Edit the rsyslog configuration and add the following line (where loghost.example.com is the name of your central log host). The target directive may either be a fully qualified domain name or an IP address. Example script to create a drop-in configuration file: #!/usr/bin/env bash { a_parameters=('*.* action(type=\"omfwd\" target=\"loghost.example.com\" port=\"514\" protocol=\"tcp\"' \\ ' action.resumeRetryCount=\"100\"' ' queue.type=\"LinkedList\" queue.size=\"1000\")') [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslod.d/ printf '%s\\n' \"\" \"${a_parameters[@]}\" >> /etc/rsyslog.d/60-rsyslog.conf } Run the following command to reload rsyslog.service: # systemctl reload-or-restart rsyslog.service."
references:
- 'https://www.rsyslog.com/doc/'
compliance:
- cis: ["6.1.3.6"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'd:/etc/rsyslog.d -> r:\.*.conf -> r:^*.* action\.+target='
- 'f:/etc/rsyslog.conf -> r:^*.* action\.+target='
# 6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client. (Automated)
- id: 35721
title: "Ensure rsyslog is not configured to receive logs from a remote client."
description: "rsyslog supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts."
rationale: "If a client is configured to also receive data, thus turning it into a server, the client system is acting outside its operational boundary."
remediation: "Unless the system's primary function is to serve as a logfile server , modify the files returned by the Audit Procedure and remove the specific lines highlighted by the audit. Verify none of the following entries are present in the rsyslog configuration. advanced format module(load=\"imtcp\") input(type=\"imtcp\" port=\"514\") deprecated legacy format $ModLoad imtcp $InputTCPServerRun Reload the service: # systemctl reload-or-restart rsyslog."
references:
- 'https://www.rsyslog.com/doc/index.html'
compliance:
- cis: ["6.1.3.7"]
- cis_csc_v8: ["4.8"]
- cis_csc_v7: ["9.2"]
- cmmc_v2.0: ["CM.L2-3.4.7", "CM.L2-3.4.8", "SC.L2-3.13.6"]
- iso_27001-2013: ["A.13.1.3"]
- mitre_mitigations: ["M1029"]
- mitre_tactics: ["TA0005", "TA0040"]
- mitre_techniques: ["T1070", "T1070.002", "T1562", "T1562.006"]
- pci_dss_v3.2.1: ["1.1.6", "1.2.1", "2.2.2", "2.2.5"]
- pci_dss_v4.0: ["1.2.5", "2.2.4", "6.4.1"]
- soc_2: ["CC6.3", "CC6.6"]
condition: all
rules:
- 'f:/etc/rsyslog.conf -> r:^\s*\t*module\(load="imtcp"\)'
- 'd:/etc/rsyslog.d -> r:\.*.conf -> r:^\s*\t*module\(load="imtcp"\)'
- 'f:/etc/rsyslog.conf -> r:^\s*\t*input\(type="imtcp" port="514"\)'
- 'd:/etc/rsyslog.d -> r:\.*.conf -> r:^\s*\t*input\(type="imtcp" port="514"\)'
# 6.1.3.8 Ensure logrotate is configured. (Manual) - Not Implemented
# 6.1.4.1 Ensure access to all logfiles has been configured. (Automated)
- id: 35722
title: "Ensure access to all logfiles has been configured."
description: "Log files contain information from many services on the the local system, or in the event of a centralized log server, others systems logs as well. In general log files are found in /var/log/, although application can be configured to store logs elsewhere. Should your application store logs in another, ensure to run the same test on that location."
rationale: "It is important that log files have the correct permissions to ensure that sensitive data is protected and that only the appropriate users / groups have access to them."
remediation: "Run the following script to update permissions and ownership on files in /var/log. Although the script is not destructive, ensure that the output of the audit procedure is captured in the event that the remediation causes issues. #!/usr/bin/env bash { a_output2=() f_file_test_fix() { a_out2=() maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\" if [ $(( $l_mode & $perm_mask )) -gt 0 ]; then a_out2+=(\" o Mode: \\\"$l_mode\\\" should be \\\"$maxperm\\\" or more restrictive\" \" x Removing excess permissions\") chmod \"$l_rperms\" \"$l_fname\" fi if [[ ! \"$l_user\" =~ $l_auser ]]; then a_out2+=(\" o Owned by: \\\"$l_user\\\" and should be owned by \\\"${l_auser//|/ or }\\\"\" \" x Changing ownership to: \\\"$l_fix_account\\\"\") chown \"$l_fix_account\" \"$l_fname\" fi if [[ ! \"$l_group\" =~ $l_agroup ]]; then a_out2+=(\" o Group owned by: \\\"$l_group\\\" and should be group owned by \\\"${l_agroup//|/ or }\\\"\" \" x Changing group ownership to: \\\"$l_fix_account\\\"\") chgrp \"$l_fix_account\" \"$l_fname\" fi [ \"${#a_out2[@]}\" -gt 0 ] && a_output2+=(\" - File: \\\"$l_fname\\\" is:\" \"${a_out2[@]}\") } l_fix_account='root' while IFS= read -r -d $'\\0' l_file; do while IFS=: read -r l_fname l_mode l_user l_group; do if grep -Pq -- '\\/(apt)\\h*$' <<< \"$(dirname \"$l_fname\")\"; then perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"root\" l_agroup=\"(root|adm)\"; f_file_test_fix else case \"$(basename \"$l_fname\")\" in lastlog | lastlog.* | wtmp | wtmp.* | wtmp-* | btmp | btmp.* | btmp-* | README) perm_mask='0113' l_rperms=\"ug-x,o-wx\" l_auser=\"root\" l_agroup=\"(root|utmp)\" f_file_test_fix ;; cloud-init.log* | localmessages* | waagent.log*) perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\" file_test_fix ;; secure | auth.log | syslog | messages) perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\" f_file_test_fix ;; SSSD | sssd) perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"(root|SSSD)\" l_agroup=\"(root|SSSD)\" f_file_test_fix ;; gdm | gdm3) perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"root\" l_agroup=\"(root|gdm|gdm3)\" f_file_test_fix ;; *.journal | *.journal~) perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"root\" l_agroup=\"(root|systemd-journal)\" f_file_test_fix ;; *) perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\" if [ \"$l_user\" = \"root\" ] || ! grep -Pq -- \"^\\h*$(awk -F: '$1==\"'\"$l_user\"'\" {print $7}' /etc/passwd)\\b\" /etc/shells; then ! grep -Pq -- \"$l_auser\" <<< \"$l_user\" && l_auser=\"(root|syslog|$l_user)\" ! grep -Pq -- \"$l_agroup\" <<< \"$l_group\" && l_agroup=\"(root|adm|$l_group)\" fi f_file_test_fix ;; esac fi done < <(stat -Lc '%n:%#a:%U:%G' \"$l_file\") done < <(find -L /var/log -type f \\( -perm /0137 -o ! -user root -o ! - group root \\) -print0) if [ \"${#a_output2[@]}\" -le 0 ]; then # If all files passed, then we report no changes a_output+=(\" - All files in \\\"/var/log/\\\" have appropriate permissions and ownership\") printf '\\n%s' \"- All files in \\\"/var/log/\\\" have appropriate permissions and ownership\" \" o No changes required\" \"\" else printf '\\n%s' \"${a_output2[@]}\" \"\" fi } Note: You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions. If there are services that log to other locations, ensure that those log files have the appropriate permissions."
compliance:
- cis: ["6.1.4.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1028"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: none
rules:
- 'c:find /var/log -type f -ls -> r:-\w\w\w\ww\w\w\w\w|-\w\w\w\w\wx\w\w\w|-\w\w\w\w\w\w\ww\w|-\w\w\w\w\w\wr\w\w|-\w\w\w\w\w\w\w\wx'
# 6.2.1.1 Ensure auditd packages are installed. (Automated)
- id: 35723
title: "Ensure auditd packages are installed."
description: "auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk."
rationale: "The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring."
remediation: "Run the following command to Install auditd and audispd-plugins # apt install auditd audispd-plugins."
compliance:
- cis: ["6.2.1.1"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1018"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- "c:dpkg-query -s auditd -> r:^Status: install ok installed"
- "c:dpkg-query -s audispd-plugins -> r:^Status: install ok installed"
# 6.2.1.2 Ensure auditd service is enabled and active. (Automated)
- id: 35724
title: "Ensure auditd service is enabled and active."
description: "Turn on the auditd daemon to record system events."
rationale: "The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring."
remediation: "Run the following commands to unmask, enable and start auditd: # systemctl unmask auditd # systemctl enable auditd # systemctl start auditd."
compliance:
- cis: ["6.2.1.2"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1028"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- "c:systemctl is-enabled auditd -> r:^enabled"
- "c:systemctl is-active auditd -> r:^active"
# 6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled. (Automated)
- id: 35725
title: "Ensure auditing for processes that start prior to auditd is enabled."
description: "Configure grub2 so that processes that are capable of being audited can be audited even if they start up prior to auditd startup."
rationale: "Audit events need to be captured on processes that start up prior to auditd , so that potential malicious activity cannot go undetected."
remediation: "Edit /etc/default/grub and add audit=1 to GRUB_CMDLINE_LINUX: Example: GRUB_CMDLINE_LINUX=\"audit=1\" Run the following command to update the grub2 configuration: # update-grub."
compliance:
- cis: ["6.2.1.3"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'f:/boot/grub/grub.cfg -> r:^\s*\t*linux && r:audit=1'
# 6.2.1.4 Ensure audit_backlog_limit is sufficient. (Automated)
- id: 35726
title: "Ensure audit_backlog_limit is sufficient."
description: "In the kernel-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue. The kernel boot parameter audit_backlog_limit=N, with N representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration."
rationale: "If an audit event is logged which would grow the queue beyond the audit_backlog_limit, then a failure occurs, auditd records will be lost, and potential malicious activity could go undetected."
remediation: "Edit /etc/default/grub and add audit_backlog_limit=N to GRUB_CMDLINE_LINUX. The recommended size for N is 8192 or larger. Example: GRUB_CMDLINE_LINUX=\"audit_backlog_limit=8192\" Run the following command to update the grub2 configuration: # update-grub."
compliance:
- cis: ["6.2.1.4"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1028"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'f:/boot/grub/grub.cfg -> r:^\s*\t*linux && n:audit_backlog_limit=(\p*\d+) compare >= 8192'
# 6.2.2.1 Ensure audit log storage size is configured. (Automated)
- id: 35727
title: "Ensure audit log storage size is configured."
description: "Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started."
rationale: "It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost."
remediation: "Set the following parameter in /etc/audit/auditd.conf in accordance with site policy: max_log_file = <MB>."
compliance:
- cis: ["6.2.2.1"]
- cis_csc_v8: ["8.3"]
- cis_csc_v7: ["6.4"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1053"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1562", "T1562.006"]
- pci_dss_v3.2.1: ["10.7"]
- soc_2: ["A1.1"]
condition: all
rules:
- 'f:/etc/audit/auditd.conf -> r:max_log_file\s*\t*=\s*\t*\d+'
# 6.2.2.2 Ensure audit logs are not automatically deleted. (Automated)
- id: 35728
title: "Ensure audit logs are not automatically deleted."
description: "The max_log_file_action setting determines how to handle the audit log file reaching the max file size. A value of keep_logs will rotate the logs but never delete old logs."
rationale: "In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history."
remediation: "Set the following parameter in /etc/audit/auditd.conf: max_log_file_action = keep_logs."
compliance:
- cis: ["6.2.2.2"]
- cis_csc_v8: ["8.3"]
- cis_csc_v7: ["6.4"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1053"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- pci_dss_v3.2.1: ["10.7"]
- soc_2: ["A1.1"]
condition: all
rules:
- 'f:/etc/audit/auditd.conf -> r:max_log_file_action\s*\t*=\s*\t*keep_logs'
# 6.2.2.3 Ensure system is disabled when audit logs are full. (Automated)
- id: 35729
title: "Ensure system is disabled when audit logs are full."
description: "The auditd daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files. The disk_full_action parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are ignore, syslog, rotate, exec, suspend, single, and halt. - ignore, the audit daemon will issue a syslog message but no other action is taken - syslog, the audit daemon will issue a warning to syslog - rotate, the audit daemon will rotate logs, losing the oldest to free up space - exec, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action - suspend, the audit daemon will stop writing records to the disk - single, the audit daemon will put the computer system in single user mode - halt, the audit daemon will shut down the system The disk_error_action parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are ignore, syslog, exec, suspend, single, and halt. - ignore, the audit daemon will not take any action - syslog, the audit daemon will issue no more than 5 consecutive warnings to syslog - exec, /path-to-script will execute the script. You cannot pass parameters to the script - suspend, the audit daemon will stop writing records to the disk - single, the audit daemon will put the computer system in single user mode - halt, the audit daemon will shut down the system."
rationale: "In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability."
impact: "Disk-full-action parameter - Set to halt - the auditd daemon will shutdown the system when the disk partition containing the audit logs becomes full - Set to single - the auditd daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full. disk_error_action parameter - Set to halt - the auditd daemon will shutdown the system when an error is detected on the partition that holds the audit log files - Set to single - the auditd daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files - Set to syslog - the auditd daemon will issue no more than consecutive warnings to syslog when an error is detected on the partition that holds the audit log files."
remediation: "Set one of the following parameters in /etc/audit/auditd.conf depending on your local security policies. disk_full_action = <halt|single> disk_error_action = <syslog|single|halt> Example: disk_full_action = halt disk_error_action = halt."
compliance:
- cis: ["6.2.2.3"]
- cis_csc_v8: ["8.2", "8.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- mitre_mitigations: ["M1028"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3", "10.7"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
- soc_2: ["A1.1"]
condition: all
rules:
- 'f:/etc/audit/auditd.conf -> r:disk_full_action\s*\t*= && r:halt|single'
- 'f:/etc/audit/auditd.conf -> r:disk_error_action\s*\t*= && r:syslog|single|halt'
# 6.2.2.4 Ensure system warns when audit logs are low on space. (Automated)
- id: 35730
title: "Ensure system warns when audit logs are low on space."
description: "The auditd daemon can be configured to halt the system, put the system in single user mode or send a warning message, if the partition that holds the audit log files is low on space. The space_left_action parameter tells the system what action to take when the system has detected that it is starting to get low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. - ignore, the audit daemon does nothing - syslog, the audit daemon will issue a warning to syslog - rotate, the audit daemon will rotate logs, losing the oldest to free up space - email, the audit daemon will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog - exec, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action - suspend, the audit daemon will stop writing records to the disk - single, the audit daemon will put the computer system in single user mode - halt, the audit daemon will shut down the system The admin_space_left_action parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are ignore, syslog, rotate, email, exec, suspend, single, and halt. - ignore, the audit daemon does nothing - syslog, the audit daemon will issue a warning to syslog - rotate, the audit daemon will rotate logs, losing the oldest to free up space - email, the audit daemon will send a warning to the email account specified in action_mail_acct as well as sending the message to syslog - exec, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action - suspend, the audit daemon will stop writing records to the disk - single, the audit daemon will put the computer system in single user mode - halt, the audit daemon will shut down the system."
rationale: "In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability."
impact: "If the admin_space_left_action is set to single the audit daemon will put the computer system in single user mode."
remediation: "Set the space_left_action parameter in /etc/audit/auditd.conf to email, exec, single, or halt: Example: space_left_action = email Set the admin_space_left_action parameter in /etc/audit/auditd.conf to single or halt: Example: admin_space_left_action = single Note: A Mail Transfer Agent (MTA) must be installed and configured properly to set space_left_action = email."
compliance:
- cis: ["6.2.2.4"]
- cis_csc_v8: ["8.2", "8.3"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3", "10.7"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
- soc_2: ["A1.1"]
condition: all
rules:
- 'f:/etc/audit/auditd.conf -> r:space_left_action\s*\t*= && r:email|exec|single|halt'
- 'f:/etc/audit/auditd.conf -> r:admin_space_left_action\s*\t*= && r:single|halt'
# 6.2.3.1 Ensure changes to system administration scope (sudoers) is collected. (Automated)
- id: 35731
title: "Ensure changes to system administration scope (sudoers) is collected."
description: "Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the sudo command to execute privileged commands, it is possible to monitor changes in scope. The file /etc/sudoers, or files in /etc/sudoers.d, will be written to when the file(s) or related attributes have changed. The audit records will be tagged with the identifier \"scope\"."
rationale: "Changes in the /etc/sudoers and /etc/sudoers.d files can indicate that an unauthorized change has been made to the scope of system administrator activity."
remediation: "Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor scope changes for system administrators. Example: # printf \" -w /etc/sudoers -p wa -k scope -w /etc/sudoers.d -p wa -k scope \" >> /etc/audit/rules.d/50-scope.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.1"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.8"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-w && r:/etc/sudoers && r:-p wa && r:-k scope'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-w && r:/etc/sudoers.d && r:-p wa && r:-k scope'
- "c:auditctl -l -> r:^-w && r:/etc/sudoers && r:-p wa && r:-k scope"
- "c:auditctl -l -> r:^-w && r:/etc/sudoers.d && r:-p wa && r:-k scope"
# 6.2.3.2 Ensure actions as another user are always logged. (Automated)
- id: 35732
title: "Ensure actions as another user are always logged."
description: "sudo provides users with temporary elevated privileges to perform operations, either as the superuser or another user."
rationale: "Creating an audit log of users with temporary elevated privileges and the operation(s) they performed is essential to reporting. Administrators will want to correlate the events written to the audit trail with the records written to sudo's logfile to verify if unauthorized commands have been executed."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor elevated privileges. Example: # printf \" -a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation -a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation \" >> /etc/audit/rules.d/50-user_emulation.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.2"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.9"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.9.4.2"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-a && r:exit,always|always,exit && r:-F arch=b64 && r:-C euid!=uid|-C uid!=euid && r:-F auid!=unset|auid!=-1|-F unset!=auid && r:-S execve && r:-k user_emulation|-F key=user_emulation'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-a && r:exit,always|always,exit && r:-F arch=b32 && r:-C euid!=uid|-C uid!=euid && r:-F auid!=unset|auid!=-1|-F unset!=auid && r:-S execve && r:-k user_emulation|-F key=user_emulation'
- "c:auditctl -l -> r:^-a && r:exit,always|always,exit && r:-F arch=b64 && r:-C euid!=uid|-C uid!=euid && r:-F auid!=unset|auid!=-1|-F unset!=auid && r:-S execve && r:-k user_emulation|-F key=user_emulation"
- "c:auditctl -l -> r:^-a && r:exit,always|always,exit && r:-F arch=b32 && r:-C euid!=uid|-C uid!=euid && r:-F auid!=unset|auid!=-1|-F unset!=auid && r:-S execve && r:-k user_emulation|-F key=user_emulation"
# 6.2.3.3 Ensure events that modify the sudo log file are collected. (Automated)
- id: 35733
title: "Ensure events that modify the sudo log file are collected."
description: "Monitor the sudo log file. If the system has been properly configured to disable the use of the su command and force all administrators to have to log in first and then use sudo to execute privileged commands, then all administrator commands will be logged to /var/log/sudo.log. Any time a command is executed, an audit event will be triggered as the /var/log/sudo.log file will be opened for write and the executed administration command will be written to the log."
rationale: "Changes in /var/log/sudo.log indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to /var/log/sudo.log to verify if unauthorized commands have been executed."
remediation: "Note: This recommendation requires that the sudo logfile is configured. See guidance provided in the recommendation \"Ensure sudo log file exists\" Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the sudo log file. Example: # { SUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g') [ -n \"${SUDO_LOG_FILE}\" ] && printf \" -w ${SUDO_LOG_FILE} -p wa -k sudo_log_file \" >> /etc/audit/rules.d/50-sudo.rules || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\" } Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.3"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.9"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.9.4.2"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-w && r:/var/log/sudo.log && r:-p wa && r:-k sudo_log_file'
- "c:auditctl -l -> r:^-w && r:/var/log/sudo.log && r:-p wa && r:-k sudo_log_file"
# 6.2.3.4 Ensure events that modify date and time information are collected. (Automated)
- id: 35734
title: "Ensure events that modify date and time information are collected."
description: "Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the; - adjtimex - tune kernel clock - settimeofday - set time using timeval and timezone structures - stime - using seconds since 1/1/1970 - clock_settime - allows for the setting of several internal clocks and timers system calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as \"time-change\"."
rationale: "Unexpected changes in system date and/or time could be a sign of malicious activity on the system."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify date and time information. Example: # printf \" -a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change -a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change -a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change -a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change -w /etc/localtime -p wa -k time-change \" >> /etc/audit/rules.d/50-time-change.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.4"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["5.5"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.1.2"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:adjtimex,settimeofday|settimeofday,adjtimex'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:adjtimex,settimeofday|settimeofday,adjtimex'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S clock_settime && r:-F a0=0x0'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S clock_settime && r:-F a0=0x0'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k time-change|-F key=time-change && r:^-w && r:/etc/localtime && r:-p wa'
- "c:auditctl -l -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:adjtimex,settimeofday|settimeofday,adjtimex"
- "c:auditctl -l -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:adjtimex,settimeofday|settimeofday,adjtimex"
- "c:auditctl -l -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S clock_settime && r:-F a0=0x0"
- "c:auditctl -l -> r:-k time-change|-F key=time-change && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S clock_settime && r:-F a0=0x0"
- "c:auditctl -l -> r:-k time-change|-F key=time-change && r:^-w && r:/etc/localtime && r:-p wa"
# 6.2.3.5 Ensure events that modify the system's network environment are collected. (Automated)
- id: 35735
title: "Ensure events that modify the system's network environment are collected."
description: "Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit: - sethostname - set the systems host name - setdomainname - set the systems domain name The files being monitored are: - /etc/issue and /etc/issue.net - messages displayed pre-login - /etc/hosts - file containing host names and associated IP addresses - /etc/networks - symbolic names for networks - /etc/network/ - directory containing network interface scripts and configurations files - /etc/netplan/ - central location for YAML networking configurations files."
rationale: "Monitoring system events that change network environments, such as sethostname and setdomainname, helps identify unauthorized alterations to host and domain names, which could compromise security settings reliant on these names. Changes to /etc/hosts can signal unauthorized attempts to alter machine associations with IP addresses, potentially redirecting users and processes to unintended destinations. Surveillance of /etc/issue and /etc/issue.net is crucial to detect intruders inserting false information to deceive users. Monitoring /etc/network/ reveals modifications to network interfaces or scripts that may jeopardize system availability or security. Additionally, tracking changes in the /etc/netplan/ directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's network environment. Example: # printf \" -a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale -a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale -w /etc/issue -p wa -k system-locale -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale -w /etc/networks -p wa -k system-locale -w /etc/network/ -p wa -k system-locale -w /etc/netplan/ -p wa -k system-locale \" >> /etc/audit/rules.d/50-system_locale.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
references:
- 'https://netplan.io/faq'
compliance:
- cis: ["6.2.3.5"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["5.5"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.1.2"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-a && r:exit,always|always,exit && r:-F arch=b64 && r:-S && r:sethostname,setdomainname|setdomainname,sethostname'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-a && r:exit,always|always,exit && r:-F arch=b32 && r:-S && r:sethostname,setdomainname|setdomainname,sethostname'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/issue && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/issue.net && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/hosts && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/networks && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/network && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/netplan && r:-p wa'
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-a && r:exit,always|always,exit && r:-F arch=b64 && r:-S && r:sethostname,setdomainname|setdomainname,sethostname"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-a && r:exit,always|always,exit && r:-F arch=b32 && r:-S && r:sethostname,setdomainname|setdomainname,sethostname"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/issue && r:-p wa"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/issue.net && r:-p wa"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/hosts && r:-p wa"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/networks && r:-p wa"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/network && r:-p wa"
- "c:auditctl -l -> r:-k system-locale|-F key=system-locale && r:^-w && r:/etc/netplan && r:-p wa"
# 6.2.3.6 Ensure use of privileged commands are collected. (Automated) - Not Implemented
# 6.2.3.7 Ensure unsuccessful file access attempts are collected. (Automated)
- id: 35736
title: "Ensure unsuccessful file access attempts are collected."
description: "Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files: - creation - creat - opening - open , openat - truncation - truncate , ftruncate An audit log record will only be written if all of the following criteria is met for the user when trying to access a file: - a non-privileged user (auid>=UID_MIN) - - is not a Daemon event (auid=4294967295/unset/-1) if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)."
rationale: "Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor unsuccessful file access attempts. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=- EACCES -F auid>=${UID_MIN} -F auid!=unset -k access -a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=- EPERM -F auid>=${UID_MIN} -F auid!=unset -k access -a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=- EACCES -F auid>=${UID_MIN} -F auid!=unset -k access -a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=- EPERM -F auid>=${UID_MIN} -F auid!=unset -k access \" >> /etc/audit/rules.d/50-access.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.7"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["14.9"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EACCES && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EACCES && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EPERM && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EPERM && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EACCES && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EACCES && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EPERM && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k access|-F key=access && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:creat && r:open && r:openat && r:truncate && r:ftruncate && r:-F exit=-EPERM && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.8 Ensure events that modify user/group information are collected. (Automated)
- id: 35737
title: "Ensure events that modify user/group information are collected."
description: "Record events affecting the modification of user or group information, including that of passwords and old passwords if in use. - /etc/group - system groups - /etc/passwd - system users - /etc/gshadow - encrypted password for each group - /etc/shadow - system user passwords - /etc/security/opasswd - storage of old passwords if the relevant PAM module is in use - /etc/nsswitch.conf - file configures how the system uses various databases and name resolution mechanisms - /etc/pam.conf - file determines the authentication services to be used, and the order in which the services are used. - /etc/pam.d - directory contains the PAM configuration files for each PAM-aware application. The parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier \"identity\" in the audit log file."
rationale: "Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts."
remediation: "Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify user/group information. Example: # printf \" -w /etc/group -p wa -k identity -w /etc/passwd -p wa -k identity -w /etc/gshadow -p wa -k identity -w /etc/shadow -p wa -k identity -w /etc/security/opasswd -p wa -k identity -w /etc/nsswitch.conf -p wa -k identity -w /etc/pam.conf -p wa -k identity -w /etc/pam.d -p wa -k identity \" >> /etc/audit/rules.d/50-identity.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
references:
- 'https://manpages.debian.org/bookworm/manpages/nsswitch.conf.5.en.html'
- 'https://access.redhat.com/documentation/en-'
compliance:
- cis: ["6.2.3.8"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.8"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/group && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/passwd && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/gshadow && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/shadow && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/security/opasswd && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/nsswitch.conf && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/pam.conf && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k identity|-F key=identity && r:^-w && r:/etc/pam.d && r:-p wa'
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/group && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/passwd && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/gshadow && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/shadow && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/security/opasswd && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/nsswitch.conf && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/pam.conf && r:-p wa"
- "c:auditctl -l -> r:-k identity|-F key=identity && r:^-w && r:/etc/pam.d && r:-p wa"
# 6.2.3.9 Ensure discretionary access control permission modification events are collected. (Automated)
- id: 35738
title: "Ensure discretionary access control permission modification events are collected."
description: "Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls effect the permissions, ownership and various attributes of files. - chmod - fchmod - fchmodat - chown - fchown - fchownat - lchown - setxattr - lsetxattr - fsetxattr - removexattr - lremovexattr - fremovexattr In all cases, an audit record will only be written for non-system user ids and will ignore Daemon events. All audit records will be tagged with the identifier \"perm_mod.\"."
rationale: "Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor discretionary access control permission modification events. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod \" >> /etc/audit/rules.d/50-perm_mod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.9"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["5.5"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.1.2"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:chmod && r:fchmod && r:fchmodat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:chown && r:fchown && r:lchown && r:fchownat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:chmod && r:fchmod && r:fchmodat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:lchown && r:fchown && r:chown && r:fchownat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:setxattr && r:lsetxattr && r:fsetxattr && r:removexattr && r:lremovexattr && r:fremovexattr && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:setxattr && r:lsetxattr && r:fsetxattr && r:removexattr && r:lremovexattr && r:fremovexattr && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:chmod && r:fchmod && r:fchmodat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:chown && r:fchown && r:lchown && r:fchownat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:chmod && r:fchmod && r:fchmodat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:lchown && r:fchown && r:chown && r:fchownat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:setxattr && r:lsetxattr && r:fsetxattr && r:removexattr && r:lremovexattr && r:fremovexattr && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_mod|-F key=perm_mod && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:setxattr && r:lsetxattr && r:fsetxattr && r:removexattr && r:lremovexattr && r:fremovexattr && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.10 Ensure successful file system mounts are collected. (Automated)
- id: 35739
title: "Ensure successful file system mounts are collected."
description: "Monitor the use of the mount system call. The mount (and umount) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user."
rationale: "It is highly unusual for a non privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open, creat and truncate system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor successful file system mounts. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F arch=b32 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts -a always,exit -F arch=b64 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts \" >> /etc/audit/rules.d/50-mounts.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.10"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1034"]
- mitre_tactics: ["TA0010"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k mounts|-F key=mounts && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S mount && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k mounts|-F key=mounts && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S mount && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k mounts|-F key=mounts && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S mount && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k mounts|-F key=mounts && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S mount && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.11 Ensure session initiation information is collected. (Automated)
- id: 35740
title: "Ensure session initiation information is collected."
description: "Monitor session initiation events. The parameters in this section track changes to the files associated with session events. - /var/run/utmp - tracks all currently logged in users. - /var/log/wtmp - file tracks logins, logouts, shutdown, and reboot events. - /var/log/btmp - keeps track of failed login attempts and can be read by entering the command /usr/bin/last -f /var/log/btmp. All audit records will be tagged with the identifier \"session.\"."
rationale: "Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in)."
remediation: "Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor session initiation information. Example: # printf \" -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k session -w /var/log/btmp -p wa -k session \" >> /etc/audit/rules.d/50-session.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.11"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.9", "16.13"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.9.4.2"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k session|-F key=session && r:^-w && r:/var/run/utmp && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k session|-F key=session && r:^-w && r:/var/log/wtmp && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k session|-F key=session && r:^-w && r:/var/log/btmp && r:-p wa'
- "c:auditctl -l -> r:-k session|-F key=session && r:^-w && r:/var/run/utmp && r:-p wa"
- "c:auditctl -l -> r:-k session|-F key=session && r:^-w && r:/var/log/wtmp && r:-p wa"
- "c:auditctl -l -> r:-k session|-F key=session && r:^-w && r:/var/log/btmp && r:-p wa"
# 6.2.3.12 Ensure login and logout events are collected. (Automated)
- id: 35741
title: "Ensure login and logout events are collected."
description: "Monitor login and logout events. The parameters below track changes to files associated with login/logout events. - /var/log/lastlog - maintain records of the last time a user successfully logged in. - /var/run/faillock - directory maintains records of login failures via the pam_faillock module."
rationale: "Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins."
remediation: "Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor login and logout events. Example: # printf \" -w /var/log/lastlog -p wa -k logins -w /var/run/faillock -p wa -k logins \" >> /etc/audit/rules.d/50-login.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.12"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["4.9", "16.11", "16.13"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.8.1.3", "A.9.4.2"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k logins|-F key=logins && r:^-w && r:/var/log/lastlog && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k logins|-F key=logins && r:^-w && r:/var/run/faillock && r:-p wa'
- "c:auditctl -l -> r:-k logins|-F key=logins && r:^-w && r:/var/log/lastlog && r:-p wa"
- "c:auditctl -l -> r:-k logins|-F key=logins && r:^-w && r:/var/run/faillock && r:-p wa"
# 6.2.3.13 Ensure file deletion events by users are collected. (Automated)
- id: 35742
title: "Ensure file deletion events by users are collected."
description: "Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for: - unlink - remove a file - unlinkat - remove a file attribute - rename - rename a file - renameat rename a file attribute system calls and tags them with the identifier \"delete\"."
rationale: "Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor file deletion events by users. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete -a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete \" >> /etc/audit/rules.d/50-delete.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.13"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k delete|-F key=delete && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:unlink && r:unlinkat && r:rename && r:renameat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k delete|-F key=delete && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:unlink && r:unlinkat && r:rename && r:renameat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k delete|-F key=delete && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:unlink && r:unlinkat && r:rename && r:renameat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k delete|-F key=delete && r:^-a && r:always,exit|exit,always && r:-F arch=b32 && r:-S && r:unlink && r:unlinkat && r:rename && r:renameat && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected. (Automated)
- id: 35743
title: "Ensure events that modify the system's Mandatory Access Controls are collected."
description: "Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the /etc/apparmor/ and /etc/apparmor.d/ directories. Note: If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited."
rationale: "Changes to files in the /etc/apparmor/ and /etc/apparmor.d/ directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system."
remediation: "Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. Example: # printf \" -w /etc/apparmor/ -p wa -k MAC-policy -w /etc/apparmor.d/ -p wa -k MAC-policy \" >> /etc/audit/rules.d/50-MAC-policy.rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.14"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["5.5"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.1.2"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k MAC-policy|-F key=MAC-policy && r:^-w && r:/etc/apparmor && r:-p wa'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k MAC-policy|-F key=MAC-policy && r:^-w && r:/etc/apparmor.d && r:-p wa'
- "c:auditctl -l -> r:-k MAC-policy|-F key=MAC-policy && r:^-w && r:/etc/apparmor && r:-p wa"
- "c:auditctl -l -> r:-k MAC-policy|-F key=MAC-policy && r:^-w && r:/etc/apparmor.d && r:-p wa"
# 6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected. (Automated)
- id: 35744
title: "Ensure successful and unsuccessful attempts to use the chcon command are collected."
description: "The operating system must generate audit records for successful/unsuccessful uses of the chcon command."
rationale: "The chcon command is used to change file security context. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter)."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor successful and unsuccessful attempts to use the chcon command. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng \" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.15"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/chcon && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/chcon && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected. (Automated)
- id: 35745
title: "Ensure successful and unsuccessful attempts to use the setfacl command are collected."
description: "The operating system must generate audit records for successful/unsuccessful uses of the setfacl command."
rationale: "This utility sets Access Control Lists (ACLs) of files and directories. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter)."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor successful and unsuccessful attempts to use the setfacl command. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng \" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.16"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/setfacl && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|auid!=-1'
- 'c:auditctl -l -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/setfacl && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected. (Automated)
- id: 35746
title: "Ensure successful and unsuccessful attempts to use the chacl command are collected."
description: "The operating system must generate audit records for successful/unsuccessful uses of the chacl command. chacl is an IRIX-compatibility command, and is maintained for those users who are familiar with its use from either XFS or IRIX."
rationale: "chacl changes the ACL(s) for a file or directory. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter)."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor successful and unsuccessful attempts to use the chacl command. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng \" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.17"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/chacl && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k perm_chng|-F key=perm_chng && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/chacl && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected. (Automated)
- id: 35747
title: "Ensure successful and unsuccessful attempts to use the usermod command are collected."
description: "The operating system must generate audit records for successful/unsuccessful uses of the usermod command."
rationale: "The usermod command modifies the system account files to reflect the changes that are specified on the command line. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter)."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor successful and unsuccessful attempts to use the usermod command. Example: # { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k usermod \" >> /etc/audit/rules.d/50-usermod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.18"]
- cis_csc_v8: ["8.2"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- hipaa: ["164.312(b)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-7"]
- pci_dss_v3.2.1: ["10.2", "10.3"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1", "10.2.1.2", "10.2.1.3", "10.2.1.4", "10.2.1.5", "10.2.1.6", "10.2.1.7", "10.2.2", "5.3.4", "6.4.1", "6.4.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k usermod|-F key=usermod && r:^-a && r:always,exit|exit,always && r:-F path=/usr/sbin/usermod && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k usermod|-F key=usermod && r:^-a && r:always,exit|exit,always && r:-F path=/usr/sbin/usermod && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.19 Ensure kernel module loading unloading and modification is collected. (Automated)
- id: 35748
title: "Ensure kernel module loading unloading and modification is collected."
description: "Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by kmod via symbolic links. The following system calls control loading and unloading of modules: - init_module - load a module - finit_module - load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided) - delete_module - delete a module - create_module - create a loadable module entry - query_module - query the kernel for various bits pertaining to modules Any execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of modules."
rationale: "Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system."
remediation: "Create audit rules Edit or create a file in the /etc/audit/rules.d/ directory, ending in .rules extension, with the relevant rules to monitor kernel module modification. Example: #!/usr/bin/env bash { UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs) [ -n \"${UID_MIN}\" ] && printf \" -a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules \" >> /etc/audit/rules.d/50-kernel_modules.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\" } Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.19"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.2"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1047"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1562", "T1562.006"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k kernel_modules|-F key=kernel_modules && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:init_module && r:finit_module && r:delete_module && r:create_module && r:query_module && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:-k kernel_modules|-F key=kernel_modules && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/kmod && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k kernel_modules|-F key=kernel_modules && r:^-a && r:always,exit|exit,always && r:-F arch=b64 && r:-S && r:init_module && r:finit_module && r:delete_module && r:create_module && r:query_module && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
- 'c:auditctl -l -> r:-k kernel_modules|-F key=kernel_modules && r:^-a && r:always,exit|exit,always && r:-F path=/usr/bin/kmod && r:-F perm=x && r:-F auid>=\d+ && r:-F auid!=unset|-F auid!=-1'
# 6.2.3.20 Ensure the audit configuration is immutable. (Automated)
- id: 35749
title: "Ensure the audit configuration is immutable."
description: "Set system audit so that audit rules cannot be modified with auditctl. Setting the flag \"-e 2\" forces audit to be put in immutable mode. Audit changes can only be made on system reboot. Note: This setting will require the system to be rebooted to update the active auditd configuration settings."
rationale: "In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes."
remediation: "Edit or create the file /etc/audit/rules.d/99-finalize.rules and add the line -e 2 at the end of the file: Example: # printf '\\n%s' \"-e 2\" >> /etc/audit/rules.d/99-finalize.rules Load audit rules Merge and load the rules into active configuration: # augenrules --load Check if reboot is required. # if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi."
compliance:
- cis: ["6.2.3.20"]
- cis_csc_v8: ["3.3", "8.5"]
- cis_csc_v7: ["6.2", "6.3"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "AU.L2-3.3.1", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.12.4.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1562", "T1562.001"]
- nist_sp_800-53: ["AC-5", "AC-6", "AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3", "7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "7.1", "9.4.5"]
- soc_2: ["CC5.2", "CC6.1", "CC7.2"]
condition: all
rules:
- 'd:/etc/audit/rules.d -> r:\.+.rules$ -> r:^-e\s*\t*2'
# 6.2.3.21 Ensure the running and on disk configuration is the same. (Manual)
- id: 35750
title: "Ensure the running and on disk configuration is the same."
description: "The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ. Note: Due to the limitations of augenrules and auditctl, it is not absolutely guaranteed that loading the rule sets via augenrules --load will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules."
rationale: "Configuration differences between what is currently running and what is on disk could cause unexpected problems or may give a false impression of compliance requirements."
remediation: "If the rules are not aligned across all three () areas, run the following command to merge and load all rules: # augenrules --load Check if reboot is required. if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then echo \"Reboot required to load rules\"; fi."
compliance:
- cis: ["6.2.3.21"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["6.3"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.1"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- 'c:augenrules --check -> r:augenrules: && r:No\s*\t*change'
# 6.2.4.1 Ensure audit log files mode is configured. (Automated) - Not Implemented
# 6.2.4.2 Ensure audit log files owner is configured. (Automated) - Not Implemented
# 6.2.4.3 Ensure audit log files group owner is configured. (Automated)
- id: 35751
title: "Ensure audit log files group owner is configured."
description: "Audit log files contain information about the system and system activity."
rationale: "Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality."
remediation: "Run the following command to configure the audit log files to be group owned by adm: # find $(dirname $(awk -F\"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \\( ! -group adm -a ! -group root \\) -exec chgrp adm {} + Run the following command to set the log_group parameter in the audit configuration file to log_group = adm: # sed -ri 's/^\\s*#?\\s*log_group\\s*=\\s*\\S+(\\s*#.*)?.*$/log_group = adm\\1/' /etc/audit/auditd.conf Run the following command to restart the audit daemon to reload the configuration file: # systemctl restart auditd."
compliance:
- cis: ["6.2.4.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'f:/etc/audit/auditd.conf -> r:^log_group\s*\t*= && r:adm|root'
# 6.2.4.4 Ensure the audit log file directory mode is configured. (Automated) - Not Implemented
# 6.2.4.5 Ensure audit configuration files mode is configured. (Automated)
- id: 35752
title: "Ensure audit configuration files mode is configured."
description: "Audit configuration files control auditd and what events are audited."
rationale: "Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Misconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."
remediation: "Run the following command to remove more permissive mode than 0640 from the audit configuration files: # find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) -exec chmod u-x,g-wx,o-rwx {} +."
compliance:
- cis: ["6.2.4.5"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:sh -c "find /etc/audit/ -type f \\( -name ''*.conf'' -o -name ''*.rules'' \\) -exec stat -Lc ''%a'' {} + | grep -cvE ''^(000|040|200|400|600|240|440|640)''" -> n:^(\p*\d+) compare == 0'
# 6.2.4.6 Ensure audit configuration files owner is configured. (Automated)
- id: 35753
title: "Ensure audit configuration files owner is configured."
description: "Audit configuration files control auditd and what events are audited."
rationale: "Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Misconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."
remediation: "Run the following command to change ownership to root user: # find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -user root -exec chown root {} +."
compliance:
- cis: ["6.2.4.6"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:sh -c "find /etc/audit/ -type f \\( -name ''*.conf'' -o -name ''*.rules'' \\) -exec stat -Lc ''%U'' {} + | grep -cvE ''^root''" -> n:^(\p*\d+) compare == 0'
# 6.2.4.7 Ensure audit configuration files group owner is configured. (Automated)
- id: 35754
title: "Ensure audit configuration files group owner is configured."
description: "Audit configuration files control auditd and what events are audited."
rationale: "Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Misconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."
remediation: "Run the following command to change group to root: # find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -group root -exec chgrp root {} +."
compliance:
- cis: ["6.2.4.7"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:sh -c "find /etc/audit/ -type f \\( -name ''*.conf'' -o -name ''*.rules'' \\) -exec stat -Lc ''%G'' {} + | grep -cvE ''^root''" -> n:^(\p*\d+) compare == 0'
# 6.2.4.8 Ensure audit tools mode is configured. (Automated)
- id: 35755
title: "Ensure audit tools mode is configured."
description: "Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."
rationale: "Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."
remediation: "Run the following command to remove more permissive mode from the audit tools: # chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules."
compliance:
- cis: ["6.2.4.8"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat -c "%n %a" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules -> r:\w+ && !r:000|010|040|050|001|011|041|051|004|014|044|054|005|015|045|055|700|710|740|750|701|711|741|751|704|714|744|754|705|715|745|755'
# 6.2.4.9 Ensure audit tools owner is configured. (Automated)
- id: 35756
title: "Ensure audit tools owner is configured."
description: "Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."
rationale: "Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."
remediation: "Run the following command to change the owner of the audit tools to the root user: # chown root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules."
compliance:
- cis: ["6.2.4.9"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat -Lc "%U" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules -> r:^root$'
# 6.2.4.10 Ensure audit tools group owner is configured. (Automated)
- id: 35757
title: "Ensure audit tools group owner is configured."
description: "Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."
rationale: "Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."
remediation: "Run the following command to change group ownership to the groop root: # chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules."
compliance:
- cis: ["6.2.4.10"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat -Lc "%G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules -> r:^root$'
# 6.3.1 Ensure AIDE is installed. (Automated)
- id: 35758
title: "Ensure AIDE is installed."
description: "AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system."
rationale: "By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries."
remediation: "Install AIDE using the appropriate package manager or manual installation: # apt install aide aide-common Configure AIDE as appropriate for your environment. Consult the AIDE documentation for options. Run the following commands to initialize AIDE: # aideinit # mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db."
compliance:
- cis: ["6.3.1"]
- cis_csc_v8: ["3.14"]
- cis_csc_v7: ["14.9"]
- cmmc_v2.0: ["AC.L2-3.1.7"]
- hipaa: ["164.312(b)", "164.312(c)(1)", "164.312(c)(2)"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0001"]
- mitre_techniques: ["T1565", "T1565.001"]
- nist_sp_800-53: ["AC-6(9)"]
- pci_dss_v3.2.1: ["10.2.1", "11.5"]
- pci_dss_v4.0: ["10.2.1", "10.2.1.1"]
- soc_2: ["CC6.1"]
condition: all
rules:
- "c:dpkg-query -s aide -> r:^Status: install ok installed"
- "c:dpkg-query -s aide-common -> r:^Status: install ok installed"
# 6.3.2 Ensure filesystem integrity is regularly checked. (Automated)
- id: 35759
title: "Ensure filesystem integrity is regularly checked."
description: "Periodic checking of the filesystem integrity is needed to detect changes to the filesystem."
rationale: "Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion."
remediation: "Run the following command to unmask dailyaidecheck.timer and dailyaidecheck.service: # systemctl unmask dailyaidecheck.timer dailyaidecheck.service Run the following command to enable and start dailyaidecheck.timer: # systemctl --now enable dailyaidecheck.timer."
references:
- 'https://github.com/konstruktoid/hardening/blob/master/config/aidecheck.service'
- 'https://github.com/konstruktoid/hardening/blob/master/config/aidecheck.timer'
compliance:
- cis: ["6.3.2"]
- cis_csc_v8: ["8.5"]
- cis_csc_v7: ["14.9"]
- cmmc_v2.0: ["AU.L2-3.3.1"]
- iso_27001-2013: ["A.12.4.3"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0040"]
- mitre_techniques: ["T1036", "T1036.002", "T1036.003", "T1036.004", "T1036.005", "T1565", "T1565.001"]
- nist_sp_800-53: ["AU-3(1)", "AU-7"]
- pci_dss_v3.2.1: ["10.1", "10.2.2", "10.2.4", "10.2.5", "10.3"]
- pci_dss_v4.0: ["10.2", "10.2.1", "10.2.1.2", "10.2.1.5", "9.4.5"]
- soc_2: ["CC5.2", "CC7.2"]
condition: all
rules:
- "c:systemctl show dailyaidecheck.service -> r:^LoadState=loaded"
- "c:systemctl show dailyaidecheck.service -> r:^UnitFileState=static"
- "c:systemctl show dailyaidecheck.timer -> r:^LoadState=loaded"
- "c:systemctl show dailyaidecheck.timer -> r:^ActiveState=active"
# 6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tools. (Automated)
- id: 35760
title: "Ensure cryptographic mechanisms are used to protect the integrity of audit tools."
description: "Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators. aide.conf is case-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line. AIDE uses the backslash character \\ as escape character for ' ' (space), '@' and '' (backslash) (e.g. '\\ ' or '@'). To literally match a '' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\\\'). There are three types of lines in aide.conf: - The configuration options which are used to set configuration parameters and define groups. (restricted) rules that are used to indicate which files are added to the database. - - Macro lines define or undefine variables within the config file. Note: Lines beginning with # are ignored as comments. @@include <FILE> - Include <FILE>. - The content of the file is used as if it were inserted in this part of the config file. - The maximum depth of nested includes is 16. `@@include <DIRECTORY> <REGEX> - [RULE_PREFIX] (added in AIDE v0.17) - Include all (regular) files found in <DIRECTORY> matching regular expression <REGEX> (sub-directories are ignored). - The file are included in lexical sort order. - If RULE_PREFIX is set, all rules included by the statement are prefixed with given <RULE_PREFIX> (added in AIDE v0.18). Prefixes from nested include statements are concatenated. - The content of the files is used as if it were inserted in this part of the config file. @x_include: - - is identical to @@include, except that if a config file is executable is is run and the output is used as config. If the executable file exits with status greater than zero or writes to stderr aide stops with an error. - For security reasons <DIRECTORY> and each executable config file must be owned by the current user or root. They must not be group or world-writable. - @@x_include _<FILE>_ (added in AIDE v0.17): - `@@x_include <DIRECTORY> <REGEX> [RULE_PREFIX] (added in AIDE v0.17) @@x_include_setenv <VAR> <VALUE> (added in AIDE v0.17) - Adds the variable <VAR> with the value <VALUE> to the environment used for config file execution. - Environment variable names are limited to alphanumeric characters (A-Za-z0-9) and the underscore and must not begin with a digit."
rationale: "Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. Attackers may replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs. Audit tools should be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files."
remediation: "Run the following command to determine the absolute path to the non-symlinked version on the audit tools: # readlink -f /sbin The output will be either /usr/sbin - OR - /sbin. Ensure the correct path is used. Edit /etc/aide/aide.conf and add or update the following selection lines replacing <PATH> with the correct path returned in the command above: # Audit Tools <PATH>/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 <PATH>/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512 Example # printf '%s\\n' \"\" \"# Audit Tools\" \"$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/auditd) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/ausearch) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/aureport) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/autrace) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/augenrules) p+i+n+u+g+s+b+acl+xattrs+sha512\" >> /etc/aide/aide.conf Note: - IF - /etc/aide/aide.conf includes a @@x_include statement: - <DIRECTORY> and each executable config file must be owned by the current user or root - They must not be group or world-writable Example: @@x_include /etc/aide.conf.d ^[a-zA-Z0-9_-]+$."
compliance:
- cis: ["6.3.3"]
- mitre_tactics: ["TA0007"]
- mitre_techniques: ["T1070", "T1070.002", "T1083"]
condition: all
rules:
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/auditctl\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/auditd\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/ausearch\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/aureport\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/autrace\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
- 'f:/etc/aide/aide.conf -> r:^/sbin|/usr/sbin && r:/augenrules\s*\t*p\pi\pn\pu\pg\ps\pb\pacl\pxattrs\psha512'
# 7.1.1 Ensure permissions on /etc/passwd are configured. (Automated)
- id: 35761
title: "Ensure permissions on /etc/passwd are configured."
description: "The /etc/passwd file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate."
rationale: "It is critical to ensure that the /etc/passwd file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/passwd: # chmod u-x,go-wx /etc/passwd # chown root:root /etc/passwd."
compliance:
- cis: ["7.1.1"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/passwd -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.2 Ensure permissions on /etc/passwd- are configured. (Automated)
- id: 35762
title: "Ensure permissions on /etc/passwd- are configured."
description: "The /etc/passwd- file contains backup user account information."
rationale: "It is critical to ensure that the /etc/passwd- file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/passwd-: # chmod u-x,go-wx /etc/passwd- # chown root:root /etc/passwd-."
compliance:
- cis: ["7.1.2"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/passwd- -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.3 Ensure permissions on /etc/group are configured. (Automated)
- id: 35763
title: "Ensure permissions on /etc/group are configured."
description: "The /etc/group file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else."
rationale: "The /etc/group file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/group: # chmod u-x,go-wx /etc/group # chown root:root /etc/group."
compliance:
- cis: ["7.1.3"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/group -> r:^Access:\s*\(0644/-rw-r--r--\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.4 Ensure permissions on /etc/group- are configured. (Automated)
- id: 35764
title: "Ensure permissions on /etc/group- are configured."
description: "The /etc/group- file contains a backup list of all the valid groups defined in the system."
rationale: "It is critical to ensure that the /etc/group- file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/group-: # chmod u-x,go-wx /etc/group- # chown root:root /etc/group-."
compliance:
- cis: ["7.1.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/group- -> r:^Access:\s*\(0644/-rw-r--r--\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.5 Ensure permissions on /etc/shadow are configured. (Automated)
- id: 35765
title: "Ensure permissions on /etc/shadow are configured."
description: "The /etc/shadow file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."
rationale: "If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert the user accounts."
remediation: "Run one of the following commands to set ownership of /etc/shadow to root and group to either root or shadow: # chown root:shadow /etc/shadow -OR- # chown root:root /etc/shadow Run the following command to remove excess permissions form /etc/shadow: # chmod u-x,g-wx,o-rwx /etc/shadow."
compliance:
- cis: ["7.1.5"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/shadow -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
- 'c:stat /etc/shadow -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*\d+/\s*\t*shadow\)'
# 7.1.6 Ensure permissions on /etc/shadow- are configured. (Automated)
- id: 35766
title: "Ensure permissions on /etc/shadow- are configured."
description: "The /etc/shadow- file is used to store backup information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."
rationale: "It is critical to ensure that the /etc/shadow- file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run one of the following commands to set ownership of /etc/shadow- to root and group to either root or shadow: # chown root:shadow /etc/shadow- -OR- # chown root:root /etc/shadow- Run the following command to remove excess permissions form /etc/shadow-: # chmod u-x,g-wx,o-rwx /etc/shadow-."
compliance:
- cis: ["7.1.6"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/shadow- -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
- 'c:stat /etc/shadow- -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*\d+/\s*\t*shadow\)'
# 7.1.7 Ensure permissions on /etc/gshadow are configured. (Automated)
- id: 35767
title: "Ensure permissions on /etc/gshadow are configured."
description: "The /etc/gshadow file is used to store the information about groups that is critical to the security of those accounts, such as the hashed password and other security information."
rationale: "If attackers can gain read access to the /etc/gshadow file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the /etc/gshadow file (such as group administrators) could also be useful to subvert the group."
remediation: "Run one of the following commands to set ownership of /etc/gshadow to root and group to either root or shadow: # chown root:shadow /etc/gshadow -OR- # chown root:root /etc/gshadow Run the following command to remove excess permissions form /etc/gshadow: # chmod u-x,g-wx,o-rwx /etc/gshadow."
compliance:
- cis: ["7.1.7"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/gshadow -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
- 'c:stat /etc/gshadow -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*\d+/\s*\t*shadow\)'
# 7.1.8 Ensure permissions on /etc/gshadow- are configured. (Automated)
- id: 35768
title: "Ensure permissions on /etc/gshadow- are configured."
description: "The /etc/gshadow- file is used to store backup information about groups that is critical to the security of those accounts, such as the hashed password and other security information."
rationale: "It is critical to ensure that the /etc/gshadow- file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run one of the following commands to set ownership of /etc/gshadow- to root and group to either root or shadow: # chown root:shadow /etc/gshadow- -OR- # chown root:root /etc/gshadow- Run the following command to remove excess permissions form /etc/gshadow-: # chmod u-x,g-wx,o-rwx /etc/gshadow-."
compliance:
- cis: ["7.1.8"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/gshadow- -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
- 'c:stat /etc/gshadow- -> r:^Access:\s*\(0640/-rw-r-----\)|Access:\s*\(0600/-rw-------\) && r:\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*\d+/\s*\t*shadow\)'
# 7.1.9 Ensure permissions on /etc/shells are configured. (Automated)
- id: 35769
title: "Ensure permissions on /etc/shells are configured."
description: "/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs."
rationale: "It is critical to ensure that the /etc/shells file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/shells: # chmod u-x,go-wx /etc/shells # chown root:root /etc/shells."
compliance:
- cis: ["7.1.9"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/shells -> r:Access:\s*\(0644/-rw-r--r--\)\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.10 Ensure permissions on /etc/security/opasswd are configured. (Automated)
- id: 35770
title: "Ensure permissions on /etc/security/opasswd are configured."
description: "/etc/security/opasswd and it's backup /etc/security/opasswd.old hold user's previous passwords if pam_unix or pam_pwhistory is in use on the system."
rationale: "It is critical to ensure that /etc/security/opasswd is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."
remediation: "Run the following commands to remove excess permissions, set owner, and set group on /etc/security/opasswd and /etc/security/opasswd.old is they exist: # [ -e \"/etc/security/opasswd\" ] && chmod u-x,go-rwx /etc/security/opasswd # [ -e \"/etc/security/opasswd\" ] && chown root:root /etc/security/opasswd # [ -e \"/etc/security/opasswd.old\" ] && chmod u-x,go-rwx /etc/security/opasswd.old # [ -e \"/etc/security/opasswd.old\" ] && chown root:root /etc/security/opasswd.old."
compliance:
- cis: ["7.1.10"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008", "T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'c:stat /etc/security/opasswd -> r:Access:\s*\(0600/-rw-r--r--\)\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
- 'c:stat /etc/security/opasswd.old -> r:Access:\s*\(0600/-rw-r--r--\)\s*Uid:\s*\(\s*\t*0/\s*\t*root\)\s*\t*Gid:\s*\(\s*\t*0/\s*\t*root\)'
# 7.1.11 Ensure world writable files and directories are secured. (Automated) - Not Implemented
# 7.1.12 Ensure no files or directories without an owner and a group exist. (Automated) - Not Implemented
# 7.1.13 Ensure SUID and SGID files are reviewed. (Manual) - Not Implemented
# 7.2.1 Ensure accounts in /etc/passwd use shadowed passwords. (Automated)
- id: 35771
title: "Ensure accounts in /etc/passwd use shadowed passwords."
description: "Local accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, /etc/shadow, encrypted by a salted one-way hash. Accounts with a shadowed password have an x in the second field in /etc/passwd."
rationale: "The /etc/passwd file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the /etc/passwd file must remain world readable. In spite of encoding the password with a randomly-generated one-way hash function, an attacker could still break the system if they got access to the /etc/passwd file. This can be mitigated by using shadowed passwords, thus moving the passwords in the /etc/passwd file to /etc/shadow. The /etc/shadow file is set so only root will be able to read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords with which to perform a dictionary attack. Note: - All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user. - A user account with an empty second field in /etc/passwd allows the account to be logged into by providing only the username."
remediation: "Run the following command to set accounts to use shadowed passwords and migrate passwords in /etc/passwd to /etc/shadow: # pwconv Investigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off."
compliance:
- cis: ["7.2.1"]
- cis_csc_v8: ["3.11"]
- cis_csc_v7: ["16.4"]
- cmmc_v2.0: ["AC.L2-3.1.19", "IA.L2-3.5.10", "MP.L2-3.8.1", "SC.L2-3.13.11", "SC.L2-3.13.16"]
- hipaa: ["164.312(a)(2)(iv)", "164.312(e)(2)(ii)"]
- iso_27001-2013: ["A.10.1.1"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1003", "T1003.008"]
- nist_sp_800-53: ["SC-28", "SC-28(1)"]
- pci_dss_v3.2.1: ["3.4", "3.4.1", "8.2.1"]
- pci_dss_v4.0: ["3.1.1", "3.3.2", "3.3.3", "3.5.1", "3.5.1.2", "3.5.1.3", "8.3.2"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'not f:/etc/passwd -> !r:^\w+:x:'
# 7.2.2 Ensure /etc/shadow password fields are not empty. (Automated)
- id: 35772
title: "Ensure /etc/shadow password fields are not empty."
description: "An account with an empty password field means that anybody may log in as that user without providing a password."
rationale: "All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user."
remediation: "If any accounts in the /etc/shadow file do not have a password, run the following command to lock the account until it can be determined why it does not have a password: # passwd -l <username> Also, check to see if the account is logged in and investigate what it is being used for to determine if it needs to be forced off."
compliance:
- cis: ["7.2.2"]
- cis_csc_v8: ["5.2"]
- cis_csc_v7: ["4.4"]
- cmmc_v2.0: ["IA.L2-3.5.7"]
- iso_27001-2013: ["A.9.4.3"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
- pci_dss_v4.0: ["2.2.2", "8.3.5", "8.3.6", "8.6.3"]
- soc_2: ["CC6.1"]
condition: all
rules:
- 'not f:/etc/shadow -> !r:^# && r:^\w+::'
# 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group. (Automated)
- id: 35773
title: "Ensure all groups in /etc/passwd exist in /etc/group."
description: "Over time, system administration errors and changes can lead to groups being defined in /etc/passwd but not in /etc/group."
rationale: "Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed."
remediation: "Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found."
compliance:
- cis: ["7.2.3"]
- cis_csc_v8: ["3.3", "14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "AT.L2-3.2.3", "IR.L2-3.6.2", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.308(a)(6)(ii)", "164.312(a)(1)"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0003"]
- mitre_techniques: ["T1222", "T1222.002"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'f:/etc/group -> !r:^# && r:shadow:\w*:\d+:$'
# 7.2.4 Ensure shadow group is empty. (Automated)
- id: 35774
title: "Ensure shadow group is empty."
description: "The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group."
rationale: "Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert additional user accounts."
remediation: "Run the following command to remove all users from the shadow group # sed -ri 's/(^shadow:[^:]*:[^:]*:)([^:]+$)/\\1/' /etc/group Change the primary group of any users with shadow as their primary group. # usermod -g <primary group> <user>."
compliance:
- cis: ["7.2.4"]
- cis_csc_v8: ["3.3"]
- cis_csc_v7: ["14.6"]
- cmmc_v2.0: ["AC.L1-3.1.1", "AC.L1-3.1.2", "AC.L2-3.1.3", "AC.L2-3.1.5", "MP.L2-3.8.2"]
- hipaa: ["164.308(a)(3)(i)", "164.308(a)(3)(ii)(A)", "164.312(a)(1)"]
- iso_27001-2013: ["A.9.1.1"]
- mitre_mitigations: ["M1022"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1003", "T1003.008"]
- nist_sp_800-53: ["AC-5", "AC-6"]
- pci_dss_v3.2.1: ["7.1", "7.1.1", "7.1.2", "7.1.3"]
- pci_dss_v4.0: ["1.3.1", "7.1"]
- soc_2: ["CC5.2", "CC6.1"]
condition: all
rules:
- 'f:/etc/group -> !r:^# && r:^shadow:\w*:\d+:$'
# 7.2.5 Ensure no duplicate UIDs exist. (Automated)
- id: 35775
title: "Ensure no duplicate UIDs exist."
description: "Although the useradd program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the /etc/passwd file and change the UID field."
rationale: "Users must be assigned unique UIDs for accountability and to ensure appropriate access protections."
remediation: "Based on the results of the audit script, establish unique UIDs and review all files owned by the shared UIDs to determine which UID they are supposed to belong to."
compliance:
- cis: ["7.2.5"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
condition: all
rules:
- 'c:sh -c "cut -f3 -d\":\" /etc/passwd | sort | uniq -dc | wc -l" -> n:^(\p*\d+)$ compare == 0'
# 7.2.6 Ensure no duplicate GIDs exist. (Automated)
- id: 35776
title: "Ensure no duplicate GIDs exist."
description: "Although the groupadd program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the /etc/group file and change the GID field."
rationale: "User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections."
remediation: "Based on the results of the audit script, establish unique GIDs and review all files owned by the shared GID to determine which group they are supposed to belong to."
compliance:
- cis: ["7.2.6"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0005"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
condition: all
rules:
- 'c:sh -c "cut -f3 -d\":\" /etc/group | sort | uniq -dc | wc -l" -> n:^(\p*\d+)$ compare == 0'
# 7.2.7 Ensure no duplicate user names exist. (Automated)
- id: 35777
title: "Ensure no duplicate user names exist."
description: "Although the useradd program will not let you create a duplicate user name, it is possible for an administrator to manually edit the /etc/passwd file and change the user name."
rationale: "If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in /etc/passwd . For example, if \"test4\" has a UID of 1000 and a subsequent \"test4\" entry has a UID of 2000, logging in as \"test4\" will use UID 1000. Effectively, the UID is shared, which is a security problem."
remediation: "Based on the results of the audit script, establish unique user names for the users. File ownerships will automatically reflect the change as long as the users have unique UIDs."
compliance:
- cis: ["7.2.7"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
condition: all
rules:
- 'c:sh -c "cut -f1 -d\":\" /etc/passwd | sort | uniq -dc | wc -l" -> n:^(\p*\d+)$ compare == 0'
# 7.2.8 Ensure no duplicate group names exist. (Automated)
- id: 35778
title: "Ensure no duplicate group names exist."
description: "Although the groupadd program will not let you create a duplicate group name, it is possible for an administrator to manually edit the /etc/group file and change the group name."
rationale: "If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in /etc/group . Effectively, the GID is shared, which is a security problem."
remediation: "Based on the results of the audit script, establish unique names for the user groups. File group ownerships will automatically reflect the change as long as the groups have unique GIDs."
compliance:
- cis: ["7.2.8"]
- mitre_mitigations: ["M1027"]
- mitre_tactics: ["TA0004"]
- mitre_techniques: ["T1078", "T1078.001", "T1078.003"]
condition: all
rules:
- 'c:sh -c "cut -f1 -d\":\" /etc/group | sort | uniq -dc | wc -l" -> n:^(\p*\d+)$ compare == 0'
# 7.2.9 Ensure local interactive user home directories are configured. (Automated) - Not Implemented
# 7.2.10 Ensure local interactive user dot files access is configured. (Automated) - Not Implemented
Reference in New Issue View Git Blame Copy Permalink