{"assessment-plan":{"uuid":"b9107dc8-c095-52d0-b810-dee61c0d0597","metadata":{"props":[{"ns":"https://cisecurity.org/ns","name":"cis-benchmark-id","value":"xccdf_org.cisecurity.benchmarks_benchmark_1.0.0_CIS_Ubuntu_Linux_24.04_LTS_Benchmark"}],"roles":[{"id":"assessor","title":"Assessor"},{"id":"asset-owner","title":"Asset Owner"}],"title":"CIS Ubuntu Linux 24.04 LTS Benchmark","parties":[{"name":"Assessment Organization","type":"organization","uuid":"2a2679a8-d838-5631-b6c4-ec03ff965304"}],"version":"1.0.0","published":"2024-08-26T00:00:00Z","document-ids":[{"scheme":"http://oscal.io/oscal/identifier/content-uuid","identifier":"da469781-eda0-4e7d-9a1a-8850d21fd2f1"}],"last-modified":"2026-04-19T14:21:03Z","oscal-version":"1.2.1","responsible-parties":[{"role-id":"assessor","party-uuids":["2a2679a8-d838-5631-b6c4-ec03ff965304"]}]},"import-ssp":{"href":"https://registry.oscal.io/api/v1/pirooz-javan/system-security-plans/17eb373b-6c3a-4ef9-a021-0f8995cb4ce2"},"local-definitions":{"activities":[{"uuid":"f297e734-e36d-5233-82ae-b20545acc315","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.1_Ensure_cramfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.1"}],"steps":[{"uuid":"5c4c3bec-7bbe-521d-9a90-c04102edce9b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.1_Ensure_cramfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"stig-finding-id","value":"V-230498"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure cramfs kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `cramfs` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `cramfs` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"cramfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"7be22348-467b-563a-9c21-d438e47df7df","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.1_Ensure_cramfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure cramfs kernel module is not available","description":"Run the following script to unload and disable the `cramfs` module:\n\n**- IF -** the `cramfs` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install cramfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist cramfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r cramfs 2>/dev/null; rmmod cramfs 2>/dev/null` to remove `cramfs` from the kernel\n\n**- IF -** the `cramfs` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"cramfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"1.1.1.1 Ensure cramfs kernel module is not available","description":"The `cramfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image."},{"uuid":"3883fd5f-7390-5103-ad00-e3a17a2ad1ec","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.2_Ensure_freevxfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.2"}],"steps":[{"uuid":"f6b700ea-7df0-5251-a5c8-46bf6af13628","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.2_Ensure_freevxfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure freevxfs kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `freevxfs` filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP-UX operating systems.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `freevxfs` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `freevxfs` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"freevxfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"698ec30c-29f6-5a7a-82d3-10cde3574713","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.2_Ensure_freevxfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure freevxfs kernel module is not available","description":"Run the following script to unload and disable the `freevxfs` module:\n\n**- IF -** the `freevxfs` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install freevxfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist freevxfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r freevxfs 2>/dev/null; rmmod freevxfs 2>/dev/null` to remove `freevxfs` from the kernel\n\n**- IF -** the `freevxfs` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"freevxfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"1.1.1.2 Ensure freevxfs kernel module is not available","description":"The `freevxfs` filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP-UX operating systems."},{"uuid":"654d5ff2-2136-5ec2-b7af-c14cd1899a07","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.3_Ensure_hfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.3"}],"steps":[{"uuid":"8f55d489-c204-5846-876b-2d7a02fd0fad","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.3_Ensure_hfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure hfs kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `hfs` filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `hfs` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `hfs` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"d50a6865-a325-5675-be7c-e5c99c4fa9bb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.3_Ensure_hfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure hfs kernel module is not available","description":"Run the following script to unload and disable the `hfs` module:\n\n**- IF -** the `hfs` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install hfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfs 2>/dev/null; rmmod hfs 2>/dev/null` to remove `hfs` from the kernel\n\n**- IF -** the `hfs` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"1.1.1.3 Ensure hfs kernel module is not available","description":"The `hfs` filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems."},{"uuid":"a14cdd87-d71f-5c9b-9990-52289d75b119","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.4_Ensure_hfsplus_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.4"}],"steps":[{"uuid":"49abc574-940b-5313-92f8-b5c512c38f4c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.4_Ensure_hfsplus_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure hfsplus kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `hfsplus` filesystem type is a hierarchical filesystem designed to replace `hfs` that allows you to mount Mac OS filesystems.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `hfsplus` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `hfsplus` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfsplus\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"90236308-ba88-5c28-b29d-38250a788cd1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.4_Ensure_hfsplus_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure hfsplus kernel module is not available","description":"Run the following script to unload and disable the `hfsplus` module:\n\n**- IF -** the `hfsplus` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install hfsplus /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfsplus` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfsplus 2>/dev/null; rmmod hfsplus 2>/dev/null` to remove `hfsplus` from the kernel\n\n**- IF -** the `hfsplus` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfsplus\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"1.1.1.4 Ensure hfsplus kernel module is not available","description":"The `hfsplus` filesystem type is a hierarchical filesystem designed to replace `hfs` that allows you to mount Mac OS filesystems."},{"uuid":"b0f75797-dbce-582b-b03d-87911cc67812","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.5_Ensure_jffs2_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.5"}],"steps":[{"uuid":"d33182ed-958f-5364-a5eb-98bbc7665c47","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.5_Ensure_jffs2_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure jffs2 kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `jffs2` (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `jffs2` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `jffs2` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"jffs2\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"e0ea6d77-d028-5759-aa83-822b99272d48","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.5_Ensure_jffs2_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure jffs2 kernel module is not available","description":"Run the following script to unload and disable the `jffs2` module:\n\n**- IF -** the `jffs2` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install jffs2 /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist jffs2` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r jffs2 2>/dev/null; rmmod jffs2 2>/dev/null` to remove `jffs2` from the kernel\n\n**- IF -** the `jffs2` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"jffs2\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"1.1.1.5 Ensure jffs2 kernel module is not available","description":"The `jffs2` (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices."},{"uuid":"818ddede-a02a-592e-b3ab-8aa8eb73ce38","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.6_Ensure_overlayfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.6"}],"steps":[{"uuid":"7a8575b7-44a4-5060-9fd5-4c458818487a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.6_Ensure_overlayfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure overlayfs kernel module is not available","remarks":"The `overlayfs` has known CVE's: CVE-2023-32629, CVE-2023-2640, CVE-2023-0386. Disabling the `overlayfs` reduces the local attack surface by removing support for unnecessary filesystem types and mitigates potential risks associated with unauthorized execution of setuid files, enhancing the overall system security.","description":"## Description\n\n`overlayfs` is a Linux filesystem that layers multiple filesystems to create a single unified view which allows a user to \"merge\" several mount points into a unified filesystem.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `overlayfs` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `overlayfs` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"overlayfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"05f0c6b3-0553-5590-bf47-f4eb4d6a8c09","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.6_Ensure_overlayfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure overlayfs kernel module is not available","description":"Run the following script to unload and disable the `overlayfs` module:\n\n**- IF -** the `overlayfs` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install overlayfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist overlayfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r overlayfs 2>/dev/null; rmmod overlayfs 2>/dev/null` to remove `overlayfs` from the kernel\n\n**- IF -** the `overlayfs` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"overlayfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\nImpact:\n\n**WARNING:** **If Container applications such as Docker, Kubernetes, Podman, Linux Containers (LXC), etc. are in use proceed with caution and consider the impact on containerized workloads, as disabling the `overlayfs` may severely disrupt containerization.**"}],"title":"1.1.1.6 Ensure overlayfs kernel module is not available","description":"`overlayfs` is a Linux filesystem that layers multiple filesystems to create a single unified view which allows a user to \"merge\" several mount points into a unified filesystem."},{"uuid":"c73c17d1-8bfc-5844-b34d-b64bb0ffa627","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.7_Ensure_squashfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.7"}],"steps":[{"uuid":"13281b0e-a50b-5a2e-a744-ea7ae79dd1ed","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.7_Ensure_squashfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure squashfs kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `squashfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `squashfs` image can be used without having to first decompress the image.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `squashfs` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `squashfs` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"squashfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```\n\n**Note:** On operating systems where `squashfs` is pre-build into the kernel:\n\n- This is considered an acceptable \"passing\" state\n- The kernel **should not** be re-compiled to remove `squashfs`\n- This audit will return a passing state with \"module: \"squashfs\" doesn't exist in ...\""},{"uuid":"00297fc3-7fbb-5994-bb69-3cbb78bd5214","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.7_Ensure_squashfs_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure squashfs kernel module is not available","description":"Run the following script to unload and disable the `udf` module:\n\n**- IF -** the `squashfs` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install squashfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist squashfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r squashfs 2>/dev/null; rmmod squashfs 2>/dev/null` to remove `squashfs` from the kernel\n\n**- IF -** the `squashfs` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"squashfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\nImpact:\n\nAs Snap packages utilize `squashfs` as a compressed filesystem, disabling `squashfs` will cause Snap packages to fail.\n\n`Snap` application packages of software are self-contained and work across a range of Linux distributions. This is unlike traditional Linux package management approaches, like APT or RPM, which require specifically adapted packages per Linux distribution on an application update and delay therefore application deployment from developers to their software's end-user. Snaps themselves have no dependency on any external store (\"App store\"), can be obtained from any source and can be therefore used for upstream software deployment."}],"title":"1.1.1.7 Ensure squashfs kernel module is not available","description":"The `squashfs` filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A `squashfs` image can be used without having to first decompress the image."},{"uuid":"f1a08cb5-c34d-5c64-b3d3-45485bb1e195","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.8_Ensure_udf_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.8"}],"steps":[{"uuid":"89e72242-fd8a-5dab-a812-4942feaf0cfb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.8_Ensure_udf_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure udf kernel module is not available","remarks":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.","description":"## Description\n\nThe `udf` filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `udf` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `udf` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"udf\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"c5c287d7-bd98-50f4-af51-81e2d19010d3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.8_Ensure_udf_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure udf kernel module is not available","description":"Run the following script to unload and disable the `udf` module:\n\n**- IF -** the `udf` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install udf /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist udf` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r udf 2>/dev/null; rmmod udf 2>/dev/null` to remove `udf` from the kernel\n\n**- IF -** the `udf` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"udf\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\nImpact:\n\nMicrosoft Azure requires the usage of `udf`.\n\n`udf` **should not** be disabled on systems run on Microsoft Azure."}],"title":"1.1.1.8 Ensure udf kernel module is not available","description":"The `udf` filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats."},{"uuid":"5dc10df5-9873-5faf-b378-676047ae6685","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.9_Ensure_usb-storage_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.9"}],"steps":[{"uuid":"d54a2cbb-624e-5899-9a0f-0befdf529534","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.9_Ensure_usb-storage_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/13/subcontrol/7"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:13:7"}],"title":"Audit for Ensure usb-storage kernel module is not available","remarks":"Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware.","description":"## Description\n\nUSB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `usb-storage` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `usb-storage` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"usb-storage\" l_mod_type=\"drivers\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"79bca155-277b-5bbd-b52f-b2d90d143457","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.9_Ensure_usb-storage_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure usb-storage kernel module is not available","description":"Run the following script to unload and disable the `usb-storage` module:\n\n**- IF -** the `usb-storage` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install usb-storage /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist usb-storage` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r usb-storage 2>/dev/null; rmmod usb-storage 2>/dev/null` to remove `usb-storage` from the kernel\n\n**- IF -** the `usb-storage` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"usb-storage\" l_mod_type=\"drivers\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\nImpact:\n\nDisabling the `usb-storage` module will disable any usage of USB storage devices.\n\nIf requirements and local site policy allow the use of such devices, other solutions should be configured accordingly instead. One example of a commonly used solution is `USBGuard`."}],"title":"1.1.1.9 Ensure usb-storage kernel module is not available","description":"USB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment."},{"uuid":"acb2abee-cfe1-52d5-9a96-e522e3619516","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.1 Configure Filesystem Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.10_Ensure_unused_filesystems_kernel_modules_are_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.1.10"}],"steps":[{"uuid":"3807836b-a218-5b68-9414-449491a6fd30","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.10_Ensure_unused_filesystems_kernel_modules_are_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure unused filesystems kernel modules are not available","remarks":"While loadable filesystem kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of loadable filesystem kernel modules in this way.\n\nRemoving support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it. The following filesystem kernel modules have known CVE's and should be made unavailable if no dependencies exist:\n\n- `afs` - CVE-2022-37402\n- `ceph` - CVE-2022-0670\n- `cifs` - CVE-2022-29869\n- `exfat` CVE-2022-29973\n- `ext` CVE-2022-1184\n- `fat` CVE-2022-22043\n- `fscache` CVE-2022-3630\n- `fuse` CVE-2023-0386\n- `gfs2` CVE-2023-3212\n- `nfs_common` CVE-2023-6660\n- `nfsd` CVE-2022-43945\n- `smbfs_common` CVE-2022-2585","description":"## Description\n\nFilesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls.\n\n## Audit\n\nRun the following script to:\n\n- Look at the filesystem kernel modules available to the currently running kernel.\n- Exclude mounted filesystem kernel modules that don't currently have a CVE\n- List filesystem kernel modules that are not fully disabled, or are loaded into the kernel\n\nReview the generated output\n\n```bash\n#! /usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_modprope_config=(); a_excluded=(); a_available_modules=()\n a_ignore=(\"xfs\" \"vfat\" \"ext2\" \"ext3\" \"ext4\")\n a_cve_exists=(\"afs\" \"ceph\" \"cifs\" \"exfat\" \"ext\" \"fat\" \"fscache\" \"fuse\" \"gfs2\" \"nfs_common\" \"nfsd\" \"smbfs_common\")\n f_module_chk()\n {\n l_out2=\"\"; grep -Pq -- \"\\b$l_mod_name\\b\" /dev/null; then # Check if the module is currently loaded\n l_output2+=(\" - Kernel module: \\\"$l_mod_name\\\" is loaded\" \"\")\n fi\n }\n while IFS= read -r -d $'\\0' l_module_dir; do\n a_available_modules+=(\"$(basename \"$l_module_dir\")\")\n done < <(find \"$(readlink -f /lib/modules/\"$(uname -r)\"/kernel/fs)\" -mindepth 1 -maxdepth 1 -type d ! -empty -print0)\n while IFS= read -r l_exclude; do\n if grep -Pq -- \"\\b$l_exclude\\b\" <<< \"${a_cve_exists[*]}\"; then\n a_output2+=(\" - ** WARNING: kernel module: \\\"$l_exclude\\\" has a CVE and is currently mounted! **\")\n elif \n grep -Pq -- \"\\b$l_exclude\\b\" <<< \"${a_available_modules[*]}\"; then\n a_output+=(\" - Kernel module: \\\"$l_exclude\\\" is currently mounted - do NOT unload or disable\")\n fi\n ! grep -Pq -- \"\\b$l_exclude\\b\" <<< \"${a_ignore[*]}\" && a_ignore+=(\"$l_exclude\")\n done < <(findmnt -knD | awk '{print $2}' | sort -u)\n while IFS= read -r l_config; do\n a_modprope_config+=(\"$l_config\")\n done < <(modprobe --showconfig | grep -P '^\\h*(blacklist|install)')\n for l_mod_name in \"${a_available_modules[@]}\"; do # Iterate over all filesystem modules\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_name=\"${l_mod_name::-2}\"\n if grep -Pq -- \"\\b$l_mod_name\\b\" <<< \"${a_ignore[*]}\"; then\n a_excluded+=(\" - Kernel module: \\\"$l_mod_name\\\"\")\n else\n f_module_chk\n fi\n done\n [ \"${#a_excluded[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \\\n \"The following intentionally skipped\" \\\n \"${a_excluded[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \" - No unused filesystem kernel modules are enabled\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"-- Audit Result: --\" \" ** REVIEW the following **\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"-- Correctly set: --\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\n**WARNING**: disabling or denylisting filesystem modules that are in use on the system may be FATAL. It is extremely important to thoroughly review this list."},{"uuid":"79c52384-d8d8-5e7e-b274-58637f64cf60","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.1.10_Ensure_unused_filesystems_kernel_modules_are_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure unused filesystems kernel modules are not available","description":"**- IF -** the module is available in the running kernel:\n\n- Unload the filesystem kernel module from the kernel\n- Create a file ending in `.conf` with install filesystem kernel modules `/bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with deny list filesystem kernel modules in the `/etc/modprobe.d/` directory\n\n**WARNING**: unloading, disabling or denylisting filesystem modules that are in use on the system maybe FATAL. It is extremely important to thoroughly review the filesystems returned by the audit before following the remediation procedure.\n\nExample of unloading the `gfs2`kernel module:\n\n```bash\n# modprobe -r gfs2 2>/dev/null\n# rmmod gfs2 2>/dev/null\n```\n\nExample of fully disabling the `gfs2` kernel module:\n\n```bash\n# printf '%s\\n' \"blacklist gfs2\" \"install gfs2 /bin/false\" >> /etc/modprobe.d/gfs2.conf\n```\n\n**Note:**\n\n- Disabling a kernel module by modifying the command above for each unused filesystem kernel module\n- The example `gfs2` must be updated with the appropriate module name for the command or example script bellow to run correctly.\n\n**Below is an example Script that can be modified to use on various filesystem kernel modules manual remediation process:**\n\nExample Script\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=(); l_dl=\"\" # Initialize arrays and clear variables\n l_mod_name=\"gfs2\" # set module name\n l_mod_type=\"fs\" # set module type\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" # Set to ignore duplicate checks\n a_showconfig=() # Create array with modprobe output\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then # Check if the module is currently loaded\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n echo -e \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\nImpact:\n\nThis list may be quite extensive and covering all edges cases is difficult. Therefore, it's crucial to carefully consider the implications and dependencies before making any changes to the filesystem kernel module configurations."}],"title":"1.1.1.10 Ensure unused filesystems kernel modules are not available","description":"Filesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls."},{"uuid":"ad698a90-9fc8-5d7a-b458-bb654f354e64","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.1 Configure /tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.1_Ensure_tmp_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.1.1"}],"steps":[{"uuid":"d0fe5c4a-8701-510c-a3a9-e21a39b9d4b0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.1_Ensure_tmp_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure /tmp is a separate partition","remarks":"Making `/tmp` its own file system allows an administrator to set additional mount options such as the `noexec` option on the mount, making `/tmp` useless for an attacker to install executable code. It would also prevent an attacker from establishing a hard link to a system `setuid` program and wait for it to be updated. Once the program was updated, the hard link would be broken, and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.\n\nThis can be accomplished by either mounting `tmpfs` to `/tmp`, or creating a separate partition for `/tmp`.","description":"## Description\n\nThe `/tmp` directory is a world-writable directory used for temporary storage by all users and some applications.\n\n**- IF -** an entry for `/tmp` exists in `/etc/fstab` it will take precedence over entries in systemd default unit file.\n\n**Note:** In an environment where the main system is diskless and connected to iSCSI, entries in `/etc/fstab` may not take precedence.\n\n`/tmp` can be configured to use `tmpfs`.\n\n`tmpfs` puts everything into the kernel internal caches and grows and shrinks to accommodate the files it contains and is able to swap unneeded pages out to swap space. It has maximum size limits which can be adjusted on the fly via `mount -o remount`.\n\nSince `tmpfs` lives completely in the page cache and on swap, all `tmpfs` pages will be shown as \"Shmem\" in `/proc/meminfo` and \"Shared\" in `free`. Notice that these counters also include shared memory. The most reliable way to get the count is using `df` and `du`.\n\n`tmpfs` has three mount options for sizing:\n\n- `size`: The limit of allocated bytes for this `tmpfs` instance. The default is half of your physical RAM without swap. If you oversize your `tmpfs` instances the machine will deadlock since the OOM handler will not be able to free that memory.\n- `nr_blocks`: The same as size, but in blocks of PAGE_SIZE.\n- `nr_inodes`: The maximum number of inodes for this instance. The default is half of the number of your physical RAM pages, or (on a machine with highmem) the number of lowmem RAM pages, whichever is the lower.\n\nThese parameters accept a suffix k, m or g and can be changed on remount. The size parameter also accepts a suffix % to limit this `tmpfs` instance to that percentage of your physical RAM. The default, when neither `size` nor `nr_blocks` is specified, is `size=50%`.\n\n## Audit\n\nRun the following command and verify the output shows that `/tmp` is mounted. Particular requirements pertaining to mount options are covered in ensuing sections.\n\n```bash\n# findmnt -kn /tmp\n```\n\nExample output:\n\n```bash\n/tmp tmpfs tmpfs rw,nosuid,nodev,noexec\n```\n\nEnsure that systemd will mount the `/tmp` partition at boot time.\n\n```bash\n# systemctl is-enabled tmp.mount\n```\n\nExample output:\n\n```bash\ngenerated\n```\n\nVerify output is not `masked` or `disabled`.\n\n**Note:** By default, systemd will output `generated` if there is an entry in `/etc/fstab` for `/tmp`. This just means systemd will use the entry in `/etc/fstab` instead of its default unit file configuration for `/tmp`."},{"uuid":"110b2cea-a1f8-5480-bbf4-ffefcdae15a1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.1_Ensure_tmp_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure /tmp is a separate partition","description":"First ensure that systemd is correctly configured to ensure that `/tmp` will be mounted at boot time.\n\n```bash\n# systemctl unmask tmp.mount\n```\n\nFor specific configuration requirements of the `/tmp` mount for your environment, modify `/etc/fstab`.\n\nExample of using `tmpfs` with specific mount options:\n\n```bash\ntmpfs\t/tmp\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```\n\n**Note:** the `size=2G` is an example of setting a specific size for `tmpfs`.\n\nExample of using a volume or disk with specific mount options. The source location of the volume or disk will vary depending on your environment:\n\n```bash\n/tmp defaults,nodev,nosuid,noexec 0 0\n```\n\nImpact:\n\nBy design files saved to `/tmp` should have no expectation of surviving a reboot of the system. `tmpfs` is ram based and all files stored to `tmpfs` will be lost when the system is rebooted.\n\nIf files need to be persistent through a reboot, they should be saved to `/var/tmp` not `/tmp`.\n\nSince the `/tmp` directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to `tmpfs` or a separate partition.\n\nRunning out of `/tmp` space is a problem regardless of what kind of filesystem lies under it, but in a configuration where `/tmp` is not a separate file system it will essentially have the whole disk available, as the default installation only creates a single `/` partition. On the other hand, a RAM-based `/tmp` (as with `tmpfs`) will almost certainly be much smaller, which can lead to applications filling up the filesystem much more easily. Another alternative is to create a dedicated partition for `/tmp` from a separate volume or disk. One of the downsides of a disk-based dedicated partition is that it will be slower than `tmpfs` which is RAM-based."}],"title":"1.1.2.1.1 Ensure /tmp is a separate partition","description":"The `/tmp` directory is a world-writable directory used for temporary storage by all users and some applications.\n\n**- IF -** an entry for `/tmp` exists in `/etc/fstab` it will take precedence over entries in systemd default unit file.\n\n**Note:** In an environment where the main system is diskless and connected to iSCSI, entries in `/etc/fstab` may not take precedence.\n\n`/tmp` can be configured to use `tmpfs`.\n\n`tmpfs` puts everything into the kernel internal caches and grows and shrinks to accommodate the files it contains and is able to swap unneeded pages out to swap space. It has maximum size limits which can be adjusted on the fly via `mount -o remount`.\n\nSince `tmpfs` lives completely in the page cache and on swap, all `tmpfs` pages will be shown as \"Shmem\" in `/proc/meminfo` and \"Shared\" in `free`. Notice that these counters also include shared memory. The most reliable way to get the count is using `df` and `du`.\n\n`tmpfs` has three mount options for sizing:\n\n- `size`: The limit of allocated bytes for this `tmpfs` instance. The default is half of your physical RAM without swap. If you oversize your `tmpfs` instances the machine will deadlock since the OOM handler will not be able to free that memory.\n- `nr_blocks`: The same as size, but in blocks of PAGE_SIZE.\n- `nr_inodes`: The maximum number of inodes for this instance. The default is half of the number of your physical RAM pages, or (on a machine with highmem) the number of lowmem RAM pages, whichever is the lower.\n\nThese parameters accept a suffix k, m or g and can be changed on remount. The size parameter also accepts a suffix % to limit this `tmpfs` instance to that percentage of your physical RAM. The default, when neither `size` nor `nr_blocks` is specified, is `size=50%`."},{"uuid":"f5304ad3-9f34-5cb2-9317-4981d13c5e78","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.1 Configure /tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.2_Ensure_nodev_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.1.2"}],"steps":[{"uuid":"69c7976e-0d11-5aaa-af5a-72d4b7cdf409","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.2_Ensure_nodev_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure nodev option set on /tmp partition","remarks":"Since the `/tmp` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/tmp`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/tmp`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /tmp | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"21c4f41d-06d0-512d-ae57-87cb6cd1146e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.2_Ensure_nodev_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /tmp partition","description":"**- IF -** a separate partition exists for `/tmp`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/tmp` partition.\n\nExample:\n\n```bash\n/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/tmp` with the configured options:\n\n```bash\n# mount -o remount /tmp\n```"}],"title":"1.1.2.1.2 Ensure nodev option set on /tmp partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"0579851b-5bbc-56e3-a929-46b859a66fdc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.1 Configure /tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.3_Ensure_nosuid_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.1.3"}],"steps":[{"uuid":"ff1d84a3-9b7c-5111-a7b7-4ea416c23e98","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.3_Ensure_nosuid_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /tmp partition","remarks":"Since the `/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot create `setuid` files in `/tmp`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/tmp`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /tmp | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"db47d586-8674-5b95-bf48-15a5ef5c1c99","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.3_Ensure_nosuid_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /tmp partition","description":"**- IF -** a separate partition exists for `/tmp`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/tmp` partition.\n\nExample:\n\n```bash\n/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/tmp` with the configured options:\n\n```bash\n# mount -o remount /tmp\n```"}],"title":"1.1.2.1.3 Ensure nosuid option set on /tmp partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"b4355757-b187-5b55-9164-b09cf38b12ae","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.1 Configure /tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.4_Ensure_noexec_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.1.4"}],"steps":[{"uuid":"e7b5ca79-4d82-55b1-a279-d629173763f6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.4_Ensure_noexec_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure noexec option set on /tmp partition","remarks":"Since the `/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from `/tmp`.","description":"## Description\n\nThe `noexec` mount option specifies that the filesystem cannot contain executable binaries.\n\n## Audit\n\n**- IF -** a separate partition exists for `/tmp`, verify that the `noexec` option is set.\n\nRun the following command to verify that the `noexec` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /tmp | grep -v noexec\n\nNothing should be returned\n```"},{"uuid":"525e87dc-e7b6-5009-9ec3-b3172d5a5739","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.4_Ensure_noexec_option_set_on_tmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure noexec option set on /tmp partition","description":"**- IF -** a separate partition exists for `/tmp`.\n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/tmp` partition.\n\nExample:\n\n```bash\n/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/tmp` with the configured options:\n\n```bash\n# mount -o remount /tmp\n```\n\nImpact:\n\nSetting the `noexec` option on `/tmp` may prevent installation and/or updating of some 3rd party software."}],"title":"1.1.2.1.4 Ensure noexec option set on /tmp partition","description":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"uuid":"8f62e24e-2614-5159-ade5-44e23b2539be","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.2 Configure /dev/shm"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.1_Ensure_devshm_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.2.1"}],"steps":[{"uuid":"f2f91ce7-e73d-5e9e-8e4e-5e0dfd277740","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.1_Ensure_devshm_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure /dev/shm is a separate partition","remarks":"Making `/dev/shm` its own file system allows an administrator to set additional mount options such as the `noexec` option on the mount, making `/dev/shm` useless for an attacker to install executable code. It would also prevent an attacker from establishing a hard link to a system `setuid` program and wait for it to be updated. Once the program was updated, the hard link would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.\n\nThis can be accomplished by mounting `tmpfs` to `/dev/shm`.","description":"## Description\n\nThe `/dev/shm` directory is a world-writable directory that can function as shared memory that facilitates inter process communication (IPC).\n\n## Audit\n\n**-IF-** `/dev/shm` is to be used on the system, run the following command and verify the output shows that `/dev/shm` is mounted. Particular requirements pertaining to mount options are covered in ensuing sections.\n\n```bash\n# findmnt -kn /dev/shm\n```\n\nExample output:\n\n```bash\n/dev/shm tmpfs tmpfs rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"2f6005f2-20ca-52c6-818c-7895f12ea9fa","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.1_Ensure_devshm_is_a_separate_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure /dev/shm is a separate partition","description":"For specific configuration requirements of the `/dev/shm` mount for your environment, modify `/etc/fstab`.\n\nExample:\n\n```bash\ntmpfs\t/dev/shm\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```\n\nImpact:\n\nSince the `/dev/shm` directory is intended to be world-writable, there is a risk of resource exhaustion if it is not bound to a separate partition.\n\n`/dev/shm` utilizing `tmpfs` can be resized using the `size={size}` parameter in the relevant entry in `/etc/fstab`."}],"title":"1.1.2.2.1 Ensure /dev/shm is a separate partition","description":"The `/dev/shm` directory is a world-writable directory that can function as shared memory that facilitates inter process communication (IPC)."},{"uuid":"75ea7c86-0133-50d2-abba-26823610476c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.2 Configure /dev/shm"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.2_Ensure_nodev_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.2.2"}],"steps":[{"uuid":"7f30f60e-3ade-56d7-9a3f-8ddeedaf46b4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.2_Ensure_nodev_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /dev/shm partition","remarks":"Since the `/dev/shm` filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in `/dev/shm` partitions.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/dev/shm`, verify that the `nodev` option is set.\n\n```bash\n# findmnt -kn /dev/shm | grep -v 'nodev'\n\nNothing should be returned\n```"},{"uuid":"37604d85-4504-5e7a-a0ba-7e0975aee0e2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.2_Ensure_nodev_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /dev/shm partition","description":"**- IF -** a separate partition exists for `/dev/shm`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information.\n\nExample:\n\n```bash\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/dev/shm` with the configured options:\n\n```bash\n# mount -o remount /dev/shm\n```\n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications."}],"title":"1.1.2.2.2 Ensure nodev option set on /dev/shm partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"b1e6fa92-af6a-565f-98c3-957811b7e057","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.2 Configure /dev/shm"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.3_Ensure_nosuid_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.2.3"}],"steps":[{"uuid":"72741ddc-f975-5fda-92ff-94b207b49a6d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.3_Ensure_nosuid_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /dev/shm partition","remarks":"Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non-root users to execute them.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/dev/shm`, verify that the `nosuid` option is set.\n\n```bash\n# findmnt -kn /dev/shm | grep -v 'nosuid'\n\nNothing should be returned\n```"},{"uuid":"c2cb254d-52f7-55c0-a605-67a2dd42037c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.3_Ensure_nosuid_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /dev/shm partition","description":"**- IF -** a separate partition exists for `/dev/shm`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information.\n\nExample:\n\n```bash\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/dev/shm` with the configured options:\n\n```bash\n# mount -o remount /dev/shm\n```\n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications."}],"title":"1.1.2.2.3 Ensure nosuid option set on /dev/shm partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"0a0a3115-9bc6-5548-bbcb-64604e68784c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.2 Configure /dev/shm"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.4_Ensure_noexec_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.2.4"}],"steps":[{"uuid":"e30abcc2-445a-5113-b8b4-97c33c53c67c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.4_Ensure_noexec_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure noexec option set on /dev/shm partition","remarks":"Setting this option on a file system prevents users from executing programs from shared memory. This deters users from introducing potentially malicious software on the system.","description":"## Description\n\nThe `noexec` mount option specifies that the filesystem cannot contain executable binaries.\n\n## Audit\n\n**- IF -** a separate partition exists for `/dev/shm`, verify that the `noexec` option is set.\n\n```bash\n# findmnt -kn /dev/shm | grep -v 'noexec'\n\nNothing should be returned\n```"},{"uuid":"d172b7c8-d17a-5483-b3b8-f37aa5ef24c9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.4_Ensure_noexec_option_set_on_devshm_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure noexec option set on /dev/shm partition","description":"**- IF -** a separate partition exists for `/dev/shm`.\n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/dev/shm` partition.\n\nExample:\n\n```bash\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/dev/shm` with the configured options:\n\n```bash\n# mount -o remount /dev/shm\n```\n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications."}],"title":"1.1.2.2.4 Ensure noexec option set on /dev/shm partition","description":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"uuid":"da06952e-50ce-5af9-9918-1415047f0367","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.3 Configure /home"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.1_Ensure_separate_partition_exists_for_home"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.3.1"}],"steps":[{"uuid":"55388d0a-a395-59ee-8785-94195a1bb1aa","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.1_Ensure_separate_partition_exists_for_home"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure separate partition exists for /home","remarks":"The default installation only creates a single `/` partition. Since the `/home` directory contains user generated data, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole. In addition, other operations on the system could fill up the disk unrelated to `/home` and impact all local users.\n\nConfiguring `/home` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. In the case of `/home` options such as `usrquota/grpquota` may be considered to limit the impact that users can have on each other with regards to disk resource exhaustion. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem-independent and filesystem-specific options.\n\nAs `/home` contains user data, care should be taken to ensure the security and integrity of the data and mount point.","description":"## Description\n\nThe `/home` directory is used to support disk storage needs of local users.\n\n## Audit\n\nRun the following command and verify output shows `/home` is mounted:\n\n```bash\n# findmnt -kn /home\n\n/home /dev/sdb ext4 rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"fc4a0a77-1123-57c1-8959-4af349e4be7a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.1_Ensure_separate_partition_exists_for_home"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure separate partition exists for /home","description":"For new installations, during installation create a custom partition setup and specify a separate partition for `/home`.\n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate.\n\nImpact:\n\nResizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."}],"title":"1.1.2.3.1 Ensure separate partition exists for /home","description":"The `/home` directory is used to support disk storage needs of local users."},{"uuid":"6241884c-a015-53df-b689-36a9919d714d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.3 Configure /home"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.2_Ensure_nodev_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.3.2"}],"steps":[{"uuid":"f3af0d68-7163-5552-a8e8-f138535c2a50","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.2_Ensure_nodev_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /home partition","remarks":"Since the `/home` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/home`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/home`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /home | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"b5b15865-ca06-5655-9e91-30ba06773df8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.2_Ensure_nodev_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /home partition","description":"**- IF -** a separate partition exists for `/home`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/home` partition.\n\nExample:\n\n```bash\n/home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/home` with the configured options:\n\n```bash\n# mount -o remount /home\n```"}],"title":"1.1.2.3.2 Ensure nodev option set on /home partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"74e78db6-a7a1-5daa-89e9-826f76424e81","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.3 Configure /home"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.3_Ensure_nosuid_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.3.3"}],"steps":[{"uuid":"7031d772-3596-558b-bab3-a42525ba6d78","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.3_Ensure_nosuid_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /home partition","remarks":"Since the `/home` filesystem is only intended for user file storage, set this option to ensure that users cannot create `setuid` files in `/home`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/home`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /home | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"f33fb4f2-7a60-5990-b251-6c718a6a855f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.3_Ensure_nosuid_option_set_on_home_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /home partition","description":"**- IF -** a separate partition exists for `/home`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/home` partition.\n\nExample:\n\n```bash\n/home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/home` with the configured options:\n\n```bash\n# mount -o remount /home\n```"}],"title":"1.1.2.3.3 Ensure nosuid option set on /home partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"1cb67d21-b700-590d-afdd-9ff5b1f29f77","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.4 Configure /var"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.1_Ensure_separate_partition_exists_for_var"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.4.1"}],"steps":[{"uuid":"7fe7ec66-5e64-5484-80e9-ca97ed63e965","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.1_Ensure_separate_partition_exists_for_var"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure separate partition exists for /var","remarks":"The reasoning for mounting `/var` on a separate partition is as follows.\n\nThe default installation only creates a single `/` partition. Since the `/var` directory may contain world writable files and directories, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system. In addition, other operations on the system could fill up the disk unrelated to `/var` and cause unintended behavior across the system as the disk is full. See `man auditd.conf` for details.\n\nConfiguring `/var` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem-independent and filesystem-specific options.\n\nAn example of exploiting `/var` may be an attacker establishing a hard-link to a system `setuid` program and waiting for it to be updated. Once the program is updated, the hard-link can be broken and the attacker would have their own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.","description":"## Description\n\nThe `/var` directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.\n\n## Audit\n\nRun the following command and verify output shows `/var` is mounted.\n\nExample:\n\n```bash\n# findmnt -kn /var\n\n/var /dev/sdb ext4 rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"ed34bb57-2a6a-52a2-9f11-96b47697af94","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.1_Ensure_separate_partition_exists_for_var"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure separate partition exists for /var","description":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var`.\n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate.\n\nImpact:\n\nResizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."}],"title":"1.1.2.4.1 Ensure separate partition exists for /var","description":"The `/var` directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable."},{"uuid":"9f93a4b0-27e7-5a3b-976d-e2ee8c66995f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.4 Configure /var"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.2_Ensure_nodev_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.4.2"}],"steps":[{"uuid":"470efcc7-b7f4-558d-9aa4-0c8514e732ea","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.2_Ensure_nodev_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /var partition","remarks":"Since the `/var` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"f49741dd-ab44-5bcd-aee0-3c67bb9cff3d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.2_Ensure_nodev_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /var partition","description":"**- IF -** a separate partition exists for `/var`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var` partition.\n\nExample:\n\n```bash\n/var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var` with the configured options:\n\n```bash\n# mount -o remount /var\n```"}],"title":"1.1.2.4.2 Ensure nodev option set on /var partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"d316eb9c-bc7b-56ca-95b4-eef58d314de6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.4 Configure /var"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.3_Ensure_nosuid_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.4.3"}],"steps":[{"uuid":"2da15af0-6b47-5237-b1b2-7d7803e61f1c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.3_Ensure_nosuid_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /var partition","remarks":"Since the `/var` filesystem is only intended for variable files such as logs, set this option to ensure that users cannot create `setuid` files in `/var`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"91f19c77-077d-5d6c-ba98-5590b3245180","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.3_Ensure_nosuid_option_set_on_var_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /var partition","description":"**- IF -** a separate partition exists for `/var`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var` partition.\n\nExample:\n\n```bash\n/var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var` with the configured options:\n\n```bash\n# mount -o remount /var\n```"}],"title":"1.1.2.4.3 Ensure nosuid option set on /var partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"e9e1cd44-b52e-5374-857f-e6d8e94ac9a0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.5 Configure /var/tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.1_Ensure_separate_partition_exists_for_vartmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.5.1"}],"steps":[{"uuid":"b401fb69-5fbf-5eda-bc33-f1e338721ec7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.1_Ensure_separate_partition_exists_for_vartmp"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure separate partition exists for /var/tmp","remarks":"The default installation only creates a single `/` partition. Since the `/var/tmp` directory is world-writable, there is a risk of resource exhaustion. In addition, other operations on the system could fill up the disk unrelated to `/var/tmp` and cause potential disruption to daemons as the disk is full.\n\nConfiguring `/var/tmp` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system.","description":"## Description\n\nThe `/var/tmp` directory is a world-writable directory used for temporary storage by all users and some applications. Temporary files residing in `/var/tmp` are to be preserved between reboots.\n\n## Audit\n\nRun the following command and verify output shows `/var/tmp` is mounted.\n\nExample:\n\n```bash\n# findmnt -kn /var/tmp\n\n/var/tmp /dev/sdb ext4 rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"7d7bf265-19a4-5c2b-81f5-186e3c02b633","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.1_Ensure_separate_partition_exists_for_vartmp"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure separate partition exists for /var/tmp","description":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/tmp`.\n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate.\n\nImpact:\n\nResizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."}],"title":"1.1.2.5.1 Ensure separate partition exists for /var/tmp","description":"The `/var/tmp` directory is a world-writable directory used for temporary storage by all users and some applications. Temporary files residing in `/var/tmp` are to be preserved between reboots."},{"uuid":"55d88a49-8986-51f4-b0c8-d526f6a6412c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.5 Configure /var/tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.2_Ensure_nodev_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.5.2"}],"steps":[{"uuid":"029b80b6-0644-5575-b82e-f8b2443f9423","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.2_Ensure_nodev_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /var/tmp partition","remarks":"Since the `/var/tmp` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/tmp`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/tmp`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/tmp | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"1784301a-79e5-5462-b86d-7e5c3054bc80","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.2_Ensure_nodev_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /var/tmp partition","description":"**- IF -** a separate partition exists for `/var/tmp`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/tmp` partition.\n\nExample:\n\n```bash\n/var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```bash\n# mount -o remount /var/tmp\n```"}],"title":"1.1.2.5.2 Ensure nodev option set on /var/tmp partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"4a9be362-bee5-57cc-8e0e-209193916c27","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.5 Configure /var/tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.3_Ensure_nosuid_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.5.3"}],"steps":[{"uuid":"e7d0a6ef-b0ed-58f4-85c9-d989c25221fc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.3_Ensure_nosuid_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /var/tmp partition","remarks":"Since the `/var/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot create `setuid` files in `/var/tmp`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/tmp`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/tmp | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"df3f4809-c3b4-5265-bd31-a53fadda4409","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.3_Ensure_nosuid_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /var/tmp partition","description":"**- IF -** a separate partition exists for `/var/tmp`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/tmp` partition.\n\nExample:\n\n```bash\n/var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```bash\n# mount -o remount /var/tmp\n```"}],"title":"1.1.2.5.3 Ensure nosuid option set on /var/tmp partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"098a0d10-e1fa-518e-9e22-f6289d989101","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.5 Configure /var/tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.4_Ensure_noexec_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.5.4"}],"steps":[{"uuid":"d416dfd9-58eb-546e-baf0-fa0f27ad80b6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.4_Ensure_noexec_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure noexec option set on /var/tmp partition","remarks":"Since the `/var/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from `/var/tmp`.","description":"## Description\n\nThe `noexec` mount option specifies that the filesystem cannot contain executable binaries.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/tmp`, verify that the `noexec` option is set.\n\nRun the following command to verify that the `noexec` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/tmp | grep -v noexec\n\nNothing should be returned\n```"},{"uuid":"6c57222c-5dc6-5d02-a7bd-707d91d94631","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.4_Ensure_noexec_option_set_on_vartmp_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure noexec option set on /var/tmp partition","description":"**- IF -** a separate partition exists for `/var/tmp`.\n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/tmp` partition.\n\nExample:\n\n```bash\n/var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```bash\n# mount -o remount /var/tmp\n```"}],"title":"1.1.2.5.4 Ensure noexec option set on /var/tmp partition","description":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"uuid":"ee271c85-43a4-5f50-952a-3ae688e589d4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.6 Configure /var/log"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.1_Ensure_separate_partition_exists_for_varlog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.6.1"}],"steps":[{"uuid":"fd97edc4-f24a-5852-9fee-a6411504d877","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.1_Ensure_separate_partition_exists_for_varlog"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure separate partition exists for /var/log","remarks":"The default installation only creates a single `/` partition. Since the `/var/log` directory contains log files which can grow quite large, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole.\n\nConfiguring `/var/log` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attackers ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem-independent and filesystem-specific options.\n\nAs `/var/log` contains log files, care should be taken to ensure the security and integrity of the data and mount point.","description":"## Description\n\nThe `/var/log` directory is used by system services to store log data.\n\n## Audit\n\nRun the following command and verify output shows `/var/log` is mounted:\n\n```bash\n# findmnt -kn /var/log\n\n/var/log /dev/sdb ext4 rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"d80ed043-bb99-5bd0-ac4b-f7f2a194bf81","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.1_Ensure_separate_partition_exists_for_varlog"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure separate partition exists for /var/log","description":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log` .\n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate.\n\nImpact:\n\nResizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."}],"title":"1.1.2.6.1 Ensure separate partition exists for /var/log","description":"The `/var/log` directory is used by system services to store log data."},{"uuid":"0354448f-6154-587e-ad4b-4d4fd0ef7f8b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.6 Configure /var/log"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.2_Ensure_nodev_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.6.2"}],"steps":[{"uuid":"7af4b399-4f00-5419-86b1-55716fb95b63","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.2_Ensure_nodev_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /var/log partition","remarks":"Since the `/var/log` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/log`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"59ee07a3-c535-5c15-aae9-0659b217a9b3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.2_Ensure_nodev_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /var/log partition","description":"**- IF -** a separate partition exists for `/var/log`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log` partition.\n\nExample:\n\n```bash\n/var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log` with the configured options:\n\n```bash\n# mount -o remount /var/log\n```"}],"title":"1.1.2.6.2 Ensure nodev option set on /var/log partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"acbb25de-07d2-561d-8ab2-c84625e74931","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.6 Configure /var/log"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.3_Ensure_nosuid_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.6.3"}],"steps":[{"uuid":"d4aa271c-38be-5788-8fab-8b598e6a6b11","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.3_Ensure_nosuid_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /var/log partition","remarks":"Since the `/var/log` filesystem is only intended for log files, set this option to ensure that users cannot create `setuid` files in `/var/log`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"14c4ef9c-2620-5187-b5af-9f48a4c6403b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.3_Ensure_nosuid_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /var/log partition","description":"**- IF -** a separate partition exists for `/var/log`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log` partition.\n\nExample:\n\n```bash\n/var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log` with the configured options:\n\n```bash\n# mount -o remount /var/log\n```"}],"title":"1.1.2.6.3 Ensure nosuid option set on /var/log partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"e6860aab-adf9-532b-823c-9f18dfd16115","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.6 Configure /var/log"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.4_Ensure_noexec_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.6.4"}],"steps":[{"uuid":"a794c7a8-c065-5521-8ec0-bb8e9d27c670","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.4_Ensure_noexec_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure noexec option set on /var/log partition","remarks":"Since the `/var/log` filesystem is only intended for log files, set this option to ensure that users cannot run executable binaries from `/var/log`.","description":"## Description\n\nThe `noexec` mount option specifies that the filesystem cannot contain executable binaries.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log`, verify that the `noexec` option is set.\n\nRun the following command to verify that the `noexec` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log | grep -v noexec\n\nNothing should be returned\n```"},{"uuid":"3d737c3a-45bb-51c9-a9fd-821ac4c81c75","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.4_Ensure_noexec_option_set_on_varlog_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure noexec option set on /var/log partition","description":"**- IF -** a separate partition exists for `/var/log`.\n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log` partition.\n\nExample:\n\n```bash\n/var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log` with the configured options:\n\n```bash\n# mount -o remount /var/log\n```"}],"title":"1.1.2.6.4 Ensure noexec option set on /var/log partition","description":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"uuid":"5664f154-d298-5c79-b8da-8b4d297e57c1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.7 Configure /var/log/audit"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.1_Ensure_separate_partition_exists_for_varlogaudit"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.7.1"}],"steps":[{"uuid":"fbbb1d17-c705-5415-80d4-eac3cef12fe5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.1_Ensure_separate_partition_exists_for_varlogaudit"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure separate partition exists for /var/log/audit","remarks":"The default installation only creates a single `/` partition. Since the `/var/log/audit` directory contains the `audit.log` file which can grow quite large, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole. In addition, other operations on the system could fill up the disk unrelated to `/var/log/audit` and cause `auditd` to trigger its `space_left_action` as the disk is full. See `man auditd.conf` for details.\n\nConfiguring `/var/log/audit` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem-independent and filesystem-specific options.\n\nAs `/var/log/audit` contains audit logs, care should be taken to ensure the security and integrity of the data and mount point.","description":"## Description\n\nThe auditing daemon, `auditd`, stores log data in the `/var/log/audit` directory.\n\n## Audit\n\nRun the following command and verify output shows `/var/log/audit` is mounted:\n\n```bash\n# findmnt -kn /var/log/audit\n\n/var/log/audit /dev/sdb ext4 rw,nosuid,nodev,noexec,relatime,seclabel\n```"},{"uuid":"090612a2-8deb-5a58-bf2d-711c5c4e373a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.1_Ensure_separate_partition_exists_for_varlogaudit"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure separate partition exists for /var/log/audit","description":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log/audit`.\n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate.\n\nImpact:\n\nResizing filesystems is a common activity in cloud-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."}],"title":"1.1.2.7.1 Ensure separate partition exists for /var/log/audit","description":"The auditing daemon, `auditd`, stores log data in the `/var/log/audit` directory."},{"uuid":"b532c3b9-291b-59d8-b706-a191b671241d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.7 Configure /var/log/audit"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.2_Ensure_nodev_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.7.2"}],"steps":[{"uuid":"0fd7a359-420e-58b1-b3bb-42af8b37f1b4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.2_Ensure_nodev_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nodev option set on /var/log/audit partition","remarks":"Since the `/var/log/audit` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/log/audit`.","description":"## Description\n\nThe `nodev` mount option specifies that the filesystem cannot contain special devices.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log/audit`, verify that the `nodev` option is set.\n\nRun the following command to verify that the `nodev` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log/audit | grep -v nodev\n\nNothing should be returned\n```"},{"uuid":"edf25e3f-57c9-5584-b6b8-cb6e775a91b7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.2_Ensure_nodev_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nodev option set on /var/log/audit partition","description":"**- IF -** a separate partition exists for `/var/log/audit`.\n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log/audit` partition.\n\nExample:\n\n```bash\n/var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```bash\n# mount -o remount /var/log/audit\n```"}],"title":"1.1.2.7.2 Ensure nodev option set on /var/log/audit partition","description":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"uuid":"293bc7a7-e630-54dd-8913-f7b7903eb13a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.7 Configure /var/log/audit"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.3_Ensure_nosuid_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.7.3"}],"steps":[{"uuid":"1890cb25-c08d-56dc-9835-39f6a2d618e3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.3_Ensure_nosuid_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure nosuid option set on /var/log/audit partition","remarks":"Since the `/var/log/audit` filesystem is only intended for variable files such as logs, set this option to ensure that users cannot create `setuid` files in `/var/log/audit`.","description":"## Description\n\nThe `nosuid` mount option specifies that the filesystem cannot contain `setuid` files.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log/audit`, verify that the `nosuid` option is set.\n\nRun the following command to verify that the `nosuid` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log/audit | grep -v nosuid\n\nNothing should be returned\n```"},{"uuid":"eb2eb450-72cb-55d2-af87-a5b9f50308bd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.3_Ensure_nosuid_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nosuid option set on /var/log/audit partition","description":"**- IF -** a separate partition exists for `/var/log/audit`.\n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log/audit` partition.\n\nExample:\n\n```bash\n/var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```bash\n# mount -o remount /var/log/audit\n```"}],"title":"1.1.2.7.3 Ensure nosuid option set on /var/log/audit partition","description":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"uuid":"9bcbd4ec-0768-5382-b8a6-b0a7183fe7ad","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.1 Filesystem > 1.1.2 Configure Filesystem Partitions > 1.1.2.7 Configure /var/log/audit"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.4_Ensure_noexec_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.1.2.7.4"}],"steps":[{"uuid":"43d89e84-0a87-51cd-8aa1-f2012ba5d0b2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.4_Ensure_noexec_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure noexec option set on /var/log/audit partition","remarks":"Since the `/var/log/audit` filesystem is only intended for audit logs, set this option to ensure that users cannot run executable binaries from `/var/log/audit`.","description":"## Description\n\nThe `noexec` mount option specifies that the filesystem cannot contain executable binaries.\n\n## Audit\n\n**- IF -** a separate partition exists for `/var/log/audit`, verify that the `noexec` option is set.\n\nRun the following command to verify that the `noexec` mount option is set.\n\nExample:\n\n```bash\n# findmnt -kn /var/log/audit | grep -v noexec\n\nNothing should be returned\n```"},{"uuid":"e0015092-b556-5ca6-8a3c-8e3556f1e4e4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.4_Ensure_noexec_option_set_on_varlogaudit_partition"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure noexec option set on /var/log/audit partition","description":"**- IF -** a separate partition exists for `/var/log/audit`.\n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log/audit` partition.\n\nExample:\n\n```bash\n/var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```\n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```bash\n# mount -o remount /var/log/audit\n```"}],"title":"1.1.2.7.4 Ensure noexec option set on /var/log/audit partition","description":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"uuid":"ea2c8c25-bfff-5415-b29f-1b62f707ec4a","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.2 Package Management > 1.2.1 Configure Package Repositories"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.1_Ensure_GPG_keys_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.2.1.1"}],"steps":[{"uuid":"68f42798-8178-5f6d-9221-19108c989695","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.1_Ensure_GPG_keys_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:5"}],"title":"Audit for Ensure GPG keys are configured","remarks":"It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system.","description":"## Description\n\nMost package managers implement GPG key signing to verify package integrity during installation.\n\n## Audit\n\nVerify GPG keys are configured correctly for your package manager:\n\n```bash\n# apt-key list\n```\n\n**Note:**\n\n- `apt-key list` is deprecated. Manage keyring files in `trusted.gpg.d` instead (see apt-key(8)).\n- With the deprecation of `apt-key` it is recommended to use the `Signed-By` option in `sources.list` to require a repository to pass apt-secure(8) verification with a certain set of keys rather than all trusted keys apt has configured.\n\n**- OR -**\n\n- Run the following script and verify GPG keys are configured correctly for your package manager:\n\n```bash\n#! /usr/bin/env bash\n\n{\n for file in /etc/apt/trusted.gpg.d/*.{gpg,asc} /etc/apt/sources.list.d/*.{gpg,asc} ; do\n if [ -f \"$file\" ]; then\n echo -e \"File: $file\"\n gpg --list-packets \"$file\" 2>/dev/null | awk '/keyid/ && !seen[$NF]++ {print \"keyid:\", $NF}'\n gpg --list-packets \"$file\" 2>/dev/null | awk '/Signed-By:/ {print \"signed-by:\", $NF}'\n echo -e\n fi\n done\n}\n```\n\n- REVIEW and VERIFY to ensure that GPG keys are configured correctly for your package manager IAW site policy."},{"uuid":"79bed512-d741-52cf-920e-ce346ceb8700","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.1_Ensure_GPG_keys_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GPG keys are configured","description":"Update your package manager GPG keys in accordance with site policy."}],"title":"1.2.1.1 Ensure GPG keys are configured","description":"Most package managers implement GPG key signing to verify package integrity during installation."},{"uuid":"cdae1991-2faf-54c5-b4f2-63f0b1b7afc0","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.2 Package Management > 1.2.1 Configure Package Repositories"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.2_Ensure_package_manager_repositories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.2.1.2"}],"steps":[{"uuid":"6db83f5e-21b8-55df-ba6a-f011c7ea5d44","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.2_Ensure_package_manager_repositories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:5"}],"title":"Audit for Ensure package manager repositories are configured","remarks":"If a system's package repositories are misconfigured important patches may not be identified or a rogue repository could introduce compromised software.","description":"## Description\n\nSystems need to have package manager repositories configured to ensure they receive the latest patches and updates.\n\n## Audit\n\nRun the following command and verify package repositories are configured correctly:\n\n```bash\n# apt-cache policy\n```"},{"uuid":"46416a0e-f5df-5c18-86ed-2944dade3954","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.1.2_Ensure_package_manager_repositories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure package manager repositories are configured","description":"Configure your package manager repositories according to site policy."}],"title":"1.2.1.2 Ensure package manager repositories are configured","description":"Systems need to have package manager repositories configured to ensure they receive the latest patches and updates."},{"uuid":"3ad4c68e-c0f3-506f-936d-8f1404b7633b","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.2 Package Management > 1.2.2 Configure Package Updates"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.2.1_Ensure_updates_patches_and_additional_security_software_are_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.2.2.1"}],"steps":[{"uuid":"d5d6949a-b7e7-59b5-954f-a41a08d3ec20","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.2.1_Ensure_updates_patches_and_additional_security_software_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/3/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/7/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:7:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:3:5"}],"title":"Audit for Ensure updates, patches, and additional security software are installed","remarks":"Newer patches may contain security enhancements that would not be available through the latest full update. As a result, it is recommended that the latest software patches be used to take advantage of the latest functionality. As with any software installation, organizations need to determine if a given update meets their requirements and verify the compatibility and supportability of any additional software against the update revision that is selected.","description":"## Description\n\nPeriodically patches are released for included software either due to security flaws or to include additional functionality.\n\n## Audit\n\nVerify there are no updates or patches to install:\n\n```bash\n# apt update\n# apt -s upgrade\n```"},{"uuid":"4b2d8340-df90-596c-860b-1e53dc87c9d4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.2.2.1_Ensure_updates_patches_and_additional_security_software_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure updates, patches, and additional security software are installed","description":"Run the following command to update all packages following local site policy guidance on applying updates and patches:\n\n```bash\n# apt update\n\n# apt upgrade\n - OR -\n# apt dist-upgrade\n```"}],"title":"1.2.2.1 Ensure updates, patches, and additional security software are installed","description":"Periodically patches are released for included software either due to security flaws or to include additional functionality."},{"uuid":"9ee278d6-553e-5bc9-8298-8c251060a728","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.3 Mandatory Access Control > 1.3.1 Configure AppArmor"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.1_Ensure_AppArmor_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.3.1.1"}],"steps":[{"uuid":"be5aad17-8cb9-5065-bc25-8ec49e5dfaeb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.1_Ensure_AppArmor_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure AppArmor is installed","remarks":"Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available.","description":"## Description\n\nAppArmor provides Mandatory Access Controls.\n\n## Audit\n\nRun the following command to verify that `apparmor` is installed:\n\n```bash\n# dpkg-query -s apparmor &>/dev/null && echo \"apparmor is installed\" \n\napparmor is installed\n```\n\nRun the following command to verify that `apparmor-utils` is installed:\n\n```bash\n# dpkg-query -s apparmor-utils &>/dev/null && echo \"apparmor-utils is installed\" \n\napparmor-utils is installed\n```"},{"uuid":"52544467-f70e-58c2-8ce4-86dda1e81388","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.1_Ensure_AppArmor_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure AppArmor is installed","description":"Install AppArmor.\n\n```bash\n# apt install apparmor apparmor-utils\n```"}],"title":"1.3.1.1 Ensure AppArmor is installed","description":"AppArmor provides Mandatory Access Controls."},{"uuid":"293ad609-7036-53ca-99e5-95ff43bbdc37","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.3 Mandatory Access Control > 1.3.1 Configure AppArmor"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.2_Ensure_AppArmor_is_enabled_in_the_bootloader_configuration"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.3.1.2"}],"steps":[{"uuid":"28a6916c-02fe-5b0c-be00-0ecfc181964b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.2_Ensure_AppArmor_is_enabled_in_the_bootloader_configuration"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure AppArmor is enabled in the bootloader configuration","remarks":"AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden.","description":"## Description\n\nConfigure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters.\n\n**Note:** This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.\n\n## Audit\n\nRun the following command to verify that all `linux` lines have the `apparmor=1` parameter set:\n\n```bash\n# grep \"^\\s*linux\" /boot/grub/grub.cfg | grep -v \"apparmor=1\"\n```\n\nNothing should be returned.\n\nRun the following command to verify that all `linux` lines have the `security=apparmor` parameter set:\n\n```bash\n# grep \"^\\s*linux\" /boot/grub/grub.cfg | grep -v \"security=apparmor\"\n```\n\nNothing should be returned."},{"uuid":"5264323e-eb32-503e-9061-7aa31f341ef3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.2_Ensure_AppArmor_is_enabled_in_the_bootloader_configuration"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure AppArmor is enabled in the bootloader configuration","description":"Edit `/etc/default/grub` and add the `apparmor=1` and `security=apparmor` parameters to the `GRUB_CMDLINE_LINUX=` line\n\n```bash\nGRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\"\n```\n\nRun the following command to update the `grub2` configuration:\n\n```bash\n# update-grub\n```"}],"title":"1.3.1.2 Ensure AppArmor is enabled in the bootloader configuration","description":"Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters.\n\n**Note:** This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings."},{"uuid":"dc364849-b4af-581c-b939-40a980821684","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.3 Mandatory Access Control > 1.3.1 Configure AppArmor"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.3_Ensure_all_AppArmor_Profiles_are_in_enforce_or_complain_mode"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.3.1.3"}],"steps":[{"uuid":"44e35fa8-07a3-5ff2-860c-e3404d924f70","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.3_Ensure_all_AppArmor_Profiles_are_in_enforce_or_complain_mode"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure all AppArmor Profiles are in enforce or complain mode","remarks":"Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.","description":"## Description\n\nAppArmor profiles define what resources applications are able to access.\n\n## Audit\n\nRun the following command and verify that profiles are loaded, and are in either enforce or complain mode:\n\n```bash\n# apparmor_status | grep profiles\n```\n\nReview output and ensure that profiles are loaded, and in either enforce or complain mode:\n\n```bash\n37 profiles are loaded.\n35 profiles are in enforce mode.\n2 profiles are in complain mode.\n4 processes have profiles defined.\n```\n\nRun the following command and verify no processes are unconfined\n\n```bash\n# apparmor_status | grep processes\n```\n\nReview the output and ensure no processes are unconfined:\n\n```bash\n4 processes have profiles defined.\n4 processes are in enforce mode.\n0 processes are in complain mode.\n0 processes are unconfined but have a profile defined.\n```"},{"uuid":"2c8889fa-6797-53b5-8d88-612b219b36bb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.3_Ensure_all_AppArmor_Profiles_are_in_enforce_or_complain_mode"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure all AppArmor Profiles are in enforce or complain mode","description":"Run the following command to set all profiles to enforce mode:\n\n```bash\n# aa-enforce /etc/apparmor.d/*\n```\n\n**- OR -**\n\nRun the following command to set all profiles to complain mode:\n\n```bash\n# aa-complain /etc/apparmor.d/*\n```\n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted."}],"title":"1.3.1.3 Ensure all AppArmor Profiles are in enforce or complain mode","description":"AppArmor profiles define what resources applications are able to access."},{"uuid":"b54ffd76-b548-57d4-af35-da78a042b257","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.3 Mandatory Access Control > 1.3.1 Configure AppArmor"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.4_Ensure_all_AppArmor_Profiles_are_enforcing"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.3.1.4"}],"steps":[{"uuid":"50a5b01e-ba17-550b-b390-9994fab6821c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.4_Ensure_all_AppArmor_Profiles_are_enforcing"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure all AppArmor Profiles are enforcing","remarks":"Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated.","description":"## Description\n\nAppArmor profiles define what resources applications are able to access.\n\n## Audit\n\nRun the following commands and verify that profiles are loaded and are not in complain mode:\n\n```bash\n# apparmor_status | grep profiles\n```\n\nReview output and ensure that profiles are loaded, and in enforce mode:\n\n```bash\n34 profiles are loaded.\n34 profiles are in enforce mode.\n0 profiles are in complain mode.\n2 processes have profiles defined.\n```\n\nRun the following command and verify that no processes are unconfined:\n\n```bash\napparmor_status | grep processes\n```\n\nReview the output and ensure no processes are unconfined:\n\n```bash\n2 processes have profiles defined.\n2 processes are in enforce mode.\n0 processes are in complain mode.\n0 processes are unconfined but have a profile defined.\n```"},{"uuid":"bacb5715-03a6-5a8d-93d4-6e85c050f6a6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.3.1.4_Ensure_all_AppArmor_Profiles_are_enforcing"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure all AppArmor Profiles are enforcing","description":"Run the following command to set all profiles to enforce mode:\n\n```bash\n# aa-enforce /etc/apparmor.d/*\n```\n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted"}],"title":"1.3.1.4 Ensure all AppArmor Profiles are enforcing","description":"AppArmor profiles define what resources applications are able to access."},{"uuid":"0fa7d625-cc5c-56f5-b814-08c1f775085c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.4 Configure Bootloader"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.1_Ensure_bootloader_password_is_set"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.4.1"}],"steps":[{"uuid":"c7df90a1-47ee-5650-af47-da7313b234c3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.1_Ensure_bootloader_password_is_set"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure bootloader password is set","remarks":"Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. turning off AppArmor at boot time).","description":"## Description\n\nSetting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters\n\n## Audit\n\nRun the following commands and verify output matches:\n\n```bash\n# grep \"^set superusers\" /boot/grub/grub.cfg\n\nset superusers=\"\"\n```\n\n```bash\n# awk -F. '/^\\s*password/ {print $1\".\"$2\".\"$3}' /boot/grub/grub.cfg\n\npassword_pbkdf2 grub.pbkdf2.sha512\n```"},{"uuid":"e21e5194-9277-529f-99fe-fbca3b353a4e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.1_Ensure_bootloader_password_is_set"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure bootloader password is set","description":"Create an encrypted password with `grub-mkpasswd-pbkdf2`:\n\n```bash\n# grub-mkpasswd-pbkdf2 --iteration-count=600000 --salt=64\n\nEnter password: \nReenter password: \nPBKDF2 hash of your password is\n```\n\nAdd the following into a custom `/etc/grub.d` configuration file:\n\n```bash\ncat \"\npassword_pbkdf2 \nEOF\n```\n\nThe superuser/user information and password should not be contained in the `/etc/grub.d/00_header` file as this file could be overwritten in a package update.\n\nIf there is a requirement to be able to boot/reboot without entering the password, edit `/etc/grub.d/10_linux` and add `--unrestricted` to the line `CLASS=`\n\nExample:\n\n```bash\nCLASS=\"--class gnu-linux --class gnu --class os --unrestricted\"\n```\n\nRun the following command to update the `grub2` configuration:\n\n```bash\n# update-grub\n```\n\nImpact:\n\nIf password protection is enabled, only the designated superuser can edit a GRUB 2 menu item by pressing \"e\" or access the GRUB 2 command line by pressing \"c\"\n\nIf GRUB 2 is set up to boot automatically to a password-protected menu entry the user has no option to back out of the password prompt to select another menu entry. Holding the SHIFT key will not display the menu in this case. The user must enter the correct username and password. If unable to do so, the configuration files will have to be edited via a LiveCD or other means to fix the problem\n\nYou can add `--unrestricted` to the menu entries to allow the system to boot without entering a password. A password will still be required to edit menu items.\n\nMore Information: https://help.ubuntu.com/community/Grub2/Passwords"}],"title":"1.4.1 Ensure bootloader password is set","description":"Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters"},{"uuid":"032b3810-a9e2-590d-baf4-7497f6323344","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.4 Configure Bootloader"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.2_Ensure_access_to_bootloader_config_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.4.2"}],"steps":[{"uuid":"c32159bc-f368-5997-8d83-88e9cf338661","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.2_Ensure_access_to_bootloader_config_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to bootloader config is configured","remarks":"Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.","description":"## Description\n\nThe grub configuration file contains information on boot settings and passwords for unlocking boot options.\n\n## Audit\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` is `0600` or more restrictive.\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /boot/grub/grub.cfg\n\nAccess: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"967f6948-b53f-5eeb-a330-eeb7484d7d44","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.4.2_Ensure_access_to_bootloader_config_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to bootloader config is configured","description":"Run the following commands to set permissions on your grub configuration:\n\n```bash\n# chown root:root /boot/grub/grub.cfg\n# chmod u-x,go-rwx /boot/grub/grub.cfg\n```"}],"title":"1.4.2 Ensure access to bootloader config is configured","description":"The grub configuration file contains information on boot settings and passwords for unlocking boot options."},{"uuid":"7db4ab92-97cf-5b6e-86fc-ee531bf958c0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.5 Configure Additional Process Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.1_Ensure_address_space_layout_randomization_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.5.1"}],"steps":[{"uuid":"ce3468de-8148-50ef-99c4-ee6df4b94da1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.1_Ensure_address_space_layout_randomization_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:8:3"}],"title":"Audit for Ensure address space layout randomization is enabled","remarks":"Randomly placing virtual memory regions will make it difficult to write memory page exploits as the memory placement will be consistently shifting.","description":"## Description\n\nAddress space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process.\n\n## Audit\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `kernel.randomize_va_space` is set to `2`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_parlist=(kernel.randomize_va_space=2)\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_kernel_parameter_chk\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"7d72e8b6-d374-5ddf-baec-1413ab7283eb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.1_Ensure_address_space_layout_randomization_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure address space layout randomization is enabled","description":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `kernel.randomize_va_space = 2`\n\nExample:\n\n```bash\n# printf \"%s\\n\" \"kernel.randomize_va_space = 2\" >> /etc/sysctl.d/60-kernel_sysctl.conf\n```\n\nRun the following command to set the active kernel parameter:\n\n```bash\n# sysctl -w kernel.randomize_va_space=2\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"1.5.1 Ensure address space layout randomization is enabled","description":"Address space layout randomization (ASLR) is an exploit mitigation technique which randomly arranges the address space of key data areas of a process."},{"uuid":"e0815aa6-cb31-5b24-b570-0761552f8e85","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.5 Configure Additional Process Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.2_Ensure_ptrace_scope_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.5.2"}],"steps":[{"uuid":"39c8bf74-44e8-5560-af0a-af400e6337a8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.2_Ensure_ptrace_scope_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ptrace_scope is restricted","remarks":"If one application is compromised, it would be possible for an attacker to attach to other running processes (e.g. Bash, Firefox, SSH sessions, GPG agent, etc) to extract additional credentials and continue to expand the scope of their attack.\n\nEnabling restricted mode will limit the ability of a compromised process to PTRACE_ATTACH on other processes running under the same user. With restricted mode, ptrace will continue to work with root user.","description":"## Description\n\nThe `ptrace()` system call provides a means by which one process (the \"tracer\") may observe and control the execution of another process (the \"tracee\"), and examine and change the tracee's memory and registers.\n\nThe sysctl settings (writable only with CAP_SYS_PTRACE) are:\n\n- `0` - classic ptrace permissions: a process can PTRACE_ATTACH to any other process running under the same uid, as long as it is dumpable (i.e. did not transition uids, start privileged, or have called prctl(PR_SET_DUMPABLE...) already). Similarly, PTRACE_TRACEME is unchanged.\n- `1` - restricted ptrace: a process must have a predefined relationship with the inferior it wants to call PTRACE_ATTACH on. By default, this relationship is that of only its descendants when the above classic criteria is also met. To change the relationship, an inferior can call prctl(PR_SET_PTRACER, debugger, ...) to declare an allowed debugger PID to call PTRACE_ATTACH on the inferior. Using PTRACE_TRACEME is unchanged.\n- `2` - admin-only attach: only processes with CAP_SYS_PTRACE may use ptrace with PTRACE_ATTACH, or through children calling PTRACE_TRACEME.\n- `3` - no attach: no processes may use ptrace with PTRACE_ATTACH nor via PTRACE_TRACEME. Once set, this sysctl value cannot be changed.\n\n## Audit\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `kernel.yama.ptrace_scope` is set to a value of: `1`, `2`, or `3`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_parlist=(\"kernel.yama.ptrace_scope=(1|2|3)\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_kernel_parameter_chk\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"6cb5efb0-3269-50f2-ad2c-4a5197cb9a87","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.2_Ensure_ptrace_scope_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ptrace_scope is restricted","description":"Set the `kernel.yama.ptrace_scope` parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf` to a value of `1`, `2`, or `3`:\n\n```bash\nkernel.yama.ptrace_scope = 1\n - OR -\nkernel.yama.ptrace_scope = 2\n - OR -\nkernel.yama.ptrace_scope = 3\n```\n\nExample:\n\n```bash\n# printf \"%s\\n\" \"kernel.yama.ptrace_scope = 1\" >> /etc/sysctl.d/60-kernel_sysctl.conf\n```\n\nRun the following command to set the active kernel parameter:\n\n```bash\n# sysctl -w kernel.yama.ptrace_scope=1\n```\n\n**Note:**\n\n- If a value of `2` or `3` is preferred, or required by local site policy, replace the `1` with the desired value of `2` or `3` in the example above\n- If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten"}],"title":"1.5.2 Ensure ptrace_scope is restricted","description":"The `ptrace()` system call provides a means by which one process (the \"tracer\") may observe and control the execution of another process (the \"tracee\"), and examine and change the tracee's memory and registers.\n\nThe sysctl settings (writable only with CAP_SYS_PTRACE) are:\n\n- `0` - classic ptrace permissions: a process can PTRACE_ATTACH to any other process running under the same uid, as long as it is dumpable (i.e. did not transition uids, start privileged, or have called prctl(PR_SET_DUMPABLE...) already). Similarly, PTRACE_TRACEME is unchanged.\n- `1` - restricted ptrace: a process must have a predefined relationship with the inferior it wants to call PTRACE_ATTACH on. By default, this relationship is that of only its descendants when the above classic criteria is also met. To change the relationship, an inferior can call prctl(PR_SET_PTRACER, debugger, ...) to declare an allowed debugger PID to call PTRACE_ATTACH on the inferior. Using PTRACE_TRACEME is unchanged.\n- `2` - admin-only attach: only processes with CAP_SYS_PTRACE may use ptrace with PTRACE_ATTACH, or through children calling PTRACE_TRACEME.\n- `3` - no attach: no processes may use ptrace with PTRACE_ATTACH nor via PTRACE_TRACEME. Once set, this sysctl value cannot be changed."},{"uuid":"a9741177-054f-5ab5-ab57-b5686658fee6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.5 Configure Additional Process Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.3_Ensure_core_dumps_are_restricted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.5.3"}],"steps":[{"uuid":"637cd2e3-2d20-569a-8f4f-8aaca908fcbb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.3_Ensure_core_dumps_are_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"}],"title":"Audit for Ensure core dumps are restricted","remarks":"Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see `limits.conf(5)` ). In addition, setting the `fs.suid_dumpable` variable to 0 will prevent setuid programs from dumping core.","description":"## Description\n\nA core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user.\n\n## Audit\n\nRun the following command and verify output matches:\n\n```bash\n# grep -Ps -- '^\\h*\\*\\h+hard\\h+core\\h+0\\b' /etc/security/limits.conf /etc/security/limits.d/*\n\n* hard core 0\n```\n\nRun the following script to verify `fs.suid_dumpable = 0`:\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `fs.suid_dumpable` is set to `0`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_parlist=(\"fs.suid_dumpable=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_kernel_parameter_chk\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\nRun the following command to check if systemd-coredump is installed:\n\n```bash\n# systemctl list-unit-files | grep coredump\n```\n\nif anything is returned systemd-coredump is installed"},{"uuid":"94bc0511-5a5d-5eae-95b1-d57fce63f422","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.3_Ensure_core_dumps_are_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure core dumps are restricted","description":"Add the following line to `/etc/security/limits.conf` or a `/etc/security/limits.d/*` file:\n\n```bash\n* hard core 0\n```\n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `fs.suid_dumpable = 0`\n\nExample:\n\n```bash\n# printf \"\\n%s\" \"fs.suid_dumpable = 0\" >> /etc/sysctl.d/60-fs_sysctl.conf\n```\n\nRun the following command to set the active kernel parameter:\n\n```bash\n# sysctl -w fs.suid_dumpable=0\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n**-IF-** systemd-coredump is installed:\n\nedit `/etc/systemd/coredump.conf` and add/modify the following lines:\n\n```bash\nStorage=none\nProcessSizeMax=0\n```\n\nRun the command:\n\n```bash\nsystemctl daemon-reload\n```"}],"title":"1.5.3 Ensure core dumps are restricted","description":"A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user."},{"uuid":"2bceb27f-69f5-5a2a-a8a6-87d66c6b91a0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.5 Configure Additional Process Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.4_Ensure_prelink_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.5.4"}],"steps":[{"uuid":"e924cf69-e17a-5278-aa8a-97e8bd001956","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.4_Ensure_prelink_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/14"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:14"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:9"}],"title":"Audit for Ensure prelink is not installed","remarks":"The prelinking feature can interfere with the operation of AIDE, because it changes binaries. Prelinking can also increase the vulnerability of the system if a malicious user is able to compromise a common library such as libc.","description":"## Description\n\n`prelink` is a program that modifies ELF shared libraries and ELF dynamically linked binaries in such a way that the time needed for the dynamic linker to perform relocations at startup significantly decreases.\n\n## Audit\n\nVerify `prelink` is not installed:\n\n```bash\n# dpkg-query -s prelink &>/dev/null && echo \"prelink is installed\"\n```\n\nNothing should be returned."},{"uuid":"825e624e-50c4-5e1e-8cfa-dce908fa5044","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.4_Ensure_prelink_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure prelink is not installed","description":"Run the following command to restore binaries to normal:\n\n```bash\n# prelink -ua\n```\n\nUninstall `prelink` using the appropriate package manager or manual installation:\n\n```bash\n# apt purge prelink\n```"}],"title":"1.5.4 Ensure prelink is not installed","description":"`prelink` is a program that modifies ELF shared libraries and ELF dynamically linked binaries in such a way that the time needed for the dynamic linker to perform relocations at startup significantly decreases."},{"uuid":"db71fb97-08b7-51b0-ac20-5f5f7cb4a918","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.5 Configure Additional Process Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.5_Ensure_Automatic_Error_Reporting_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.5.5"}],"steps":[{"uuid":"82c734d0-40ce-5120-9565-6d693723c351","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.5_Ensure_Automatic_Error_Reporting_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure Automatic Error Reporting is not enabled","remarks":"Apport collects potentially sensitive data, such as core dumps, stack traces, and log files. They can contain passwords, credit card numbers, serial numbers, and other private material.","description":"## Description\n\nThe Apport Error Reporting Service automatically generates crash reports for debugging\n\n## Audit\n\nRun the following command to verify that the Apport Error Reporting Service is not enabled:\n\n```bash\n# dpkg-query -s apport &> /dev/null && grep -Psi -- '^\\h*enabled\\h*=\\h*[^0]\\b' /etc/default/apport\n```\n\nNothing should be returned\n\nRun the following command to verify that the apport service is not active:\n\n```bash\n# systemctl is-active apport.service | grep '^active'\n```\n\nNothing should be returned"},{"uuid":"600fa547-ed19-529d-b312-ffbeccb4e603","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.5.5_Ensure_Automatic_Error_Reporting_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure Automatic Error Reporting is not enabled","description":"Edit `/etc/default/apport` and add or edit the enabled parameter to equal `0`:\n\n```bash\nenabled=0\n```\n\nRun the following commands to stop and mask the apport service\n\n```bash\n# systemctl stop apport.service\n# systemctl mask apport.service\n```\n\n**- OR -**\n\nRun the following command to remove the apport package:\n\n```bash\n# apt purge apport\n```"}],"title":"1.5.5 Ensure Automatic Error Reporting is not enabled","description":"The Apport Error Reporting Service automatically generates crash reports for debugging"},{"uuid":"464861a0-608c-5b8c-80ad-b0d79aadc836","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.1_Ensure_message_of_the_day_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.1"}],"steps":[{"uuid":"bc24022c-d62e-56ab-a496-19a122ca12d3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.1_Ensure_message_of_the_day_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-3"}],"title":"Audit for Ensure message of the day is configured properly","remarks":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in.","description":"## Description\n\nThe contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version\n\n## Audit\n\nRun the following command and verify that the contents match site policy:\n\n```bash\n# cat /etc/motd\n```\n\nRun the following command and verify no results are returned:\n\n```bash\n# grep -E -i \"(\\\\\\v|\\\\\\r|\\\\\\m|\\\\\\s|$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/\"//g'))\" /etc/motd\n```"},{"uuid":"ebd265b1-e517-5580-896b-6960a1dd970a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.1_Ensure_message_of_the_day_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure message of the day is configured properly","description":"Edit the `/etc/motd` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform`\n\n**- OR -**\n\n**- IF -** the `motd` is not used, this file can be removed.\n\nRun the following command to remove the `motd` file:\n\n```bash\n# rm /etc/motd\n```"}],"title":"1.6.1 Ensure message of the day is configured properly","description":"The contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version"},{"uuid":"68a0885b-f75f-507a-add3-2aff22657823","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.2_Ensure_local_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.2"}],"steps":[{"uuid":"2aada55e-6c2e-5985-bd6f-f2d4974ec01f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.2_Ensure_local_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-3"}],"title":"Audit for Ensure local login warning banner is configured properly","remarks":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in.","description":"## Description\n\nThe contents of the `/etc/issue` file are displayed to users prior to login for local terminals.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version - or the operating system's name\n\n## Audit\n\nRun the following command and verify that the contents match site policy:\n\n```bash\n# cat /etc/issue\n```\n\nRun the following command and verify no results are returned:\n\n```bash\n# grep -E -i \"(\\\\\\v|\\\\\\r|\\\\\\m|\\\\\\s|$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/\"//g'))\" /etc/issue\n```"},{"uuid":"610eeba3-68f9-5527-b372-d8af26bb1c9e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.2_Ensure_local_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure local login warning banner is configured properly","description":"Edit the `/etc/issue` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform`\n\nExample:\n\n```bash\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue\n```"}],"title":"1.6.2 Ensure local login warning banner is configured properly","description":"The contents of the `/etc/issue` file are displayed to users prior to login for local terminals.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version - or the operating system's name"},{"uuid":"375f994c-2d02-5c2e-bb97-4ed74b1034f8","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.3_Ensure_remote_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.3"}],"steps":[{"uuid":"f5e119ee-96ec-5a10-ac26-eb607612c48c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.3_Ensure_remote_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-3"}],"title":"Audit for Ensure remote login warning banner is configured properly","remarks":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in.","description":"## Description\n\nThe contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version\n\n## Audit\n\nRun the following command and verify that the contents match site policy:\n\n```bash\n# cat /etc/issue.net\n```\n\nRun the following command and verify no results are returned:\n\n```bash\n# grep -E -i \"(\\\\\\v|\\\\\\r|\\\\\\m|\\\\\\s|$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/\"//g'))\" /etc/issue.net\n```"},{"uuid":"60245afd-93dc-5fd8-8c84-6af173c8dc96","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.3_Ensure_remote_login_warning_banner_is_configured_properly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure remote login warning banner is configured properly","description":"Edit the `/etc/issue.net` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform`\n\nExample:\n\n```bash\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue.net\n```"}],"title":"1.6.3 Ensure remote login warning banner is configured properly","description":"The contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services.\n\nUnix-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` - machine architecture `\\r` - operating system release `\\s` - operating system name `\\v` - operating system version"},{"uuid":"74ee21fd-e8de-5c38-b21c-e5c766c08e13","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.4_Ensure_access_to_etcmotd_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.4"}],"steps":[{"uuid":"086a8214-50ae-5bc0-94f5-916ae7e218ab","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.4_Ensure_access_to_etcmotd_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to /etc/motd is configured","remarks":"**- IF -** the `/etc/motd` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information.","description":"## Description\n\nThe contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users.\n\n## Audit\n\nRun the following command and verify that if `/etc/motd` exists, `Access` is `644` or more restrictive, `Uid` and `Gid` are both `0/root`:\n\n```bash\n# [ -e /etc/motd ] && stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: { %g/ %G)' /etc/motd\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n -- OR --\nNothing is returned\n```"},{"uuid":"8573c306-4282-5ba9-9ef9-1561829109a0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.4_Ensure_access_to_etcmotd_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to /etc/motd is configured","description":"Run the following commands to set mode, owner, and group on `/etc/motd`:\n\n```bash\n# chown root:root $(readlink -e /etc/motd)\n# chmod u-x,go-wx $(readlink -e /etc/motd)\n```\n\n**- OR -**\n\nRun the following command to remove the `/etc/motd` file:\n\n```bash\n# rm /etc/motd\n```"}],"title":"1.6.4 Ensure access to /etc/motd is configured","description":"The contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users."},{"uuid":"2c51eec9-16e5-5bce-9c06-8135a7838851","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.5_Ensure_access_to_etcissue_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.5"}],"steps":[{"uuid":"0910c855-aa03-5cda-8591-07256b29477d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.5_Ensure_access_to_etcissue_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to /etc/issue is configured","remarks":"**- IF -** the `/etc/issue` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information.","description":"## Description\n\nThe contents of the `/etc/issue` file are displayed to users prior to login for local terminals.\n\n## Audit\n\nRun the following command and verify `Access` is `644` or more restrictive and `Uid` and `Gid` are both `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: { %g/ %G)' /etc/issue\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: { 0/ root)\n```"},{"uuid":"0a2763b5-1588-5b04-ab23-30bf921af590","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.5_Ensure_access_to_etcissue_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to /etc/issue is configured","description":"Run the following commands to set mode, owner, and group on `/etc/issue`:\n\n```bash\n# chown root:root $(readlink -e /etc/issue)\n# chmod u-x,go-wx $(readlink -e /etc/issue)\n```"}],"title":"1.6.5 Ensure access to /etc/issue is configured","description":"The contents of the `/etc/issue` file are displayed to users prior to login for local terminals."},{"uuid":"3ea6e5d8-bd28-55c7-9519-2761cdc4906f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.6 Configure Command Line Warning Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.6_Ensure_access_to_etcissue.net_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.6.6"}],"steps":[{"uuid":"1320cf90-6735-504a-b18a-2e54393328a9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.6_Ensure_access_to_etcissue.net_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to /etc/issue.net is configured","remarks":"**- IF -** the `/etc/issue.net` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information.","description":"## Description\n\nThe contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services.\n\n## Audit\n\nRun the following command and verify `Access` is `644` or more restrictive and `Uid` and `Gid` are both `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: { %g/ %G)' /etc/issue.net\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"62468b17-d196-5082-b7f0-e332bf949862","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.6.6_Ensure_access_to_etcissue.net_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to /etc/issue.net is configured","description":"Run the following commands to set mode, owner, and group on `/etc/issue.net`:\n\n```bash\n# chown root:root $(readlink -e /etc/issue.net)\n# chmod u-x,go-wx $(readlink -e /etc/issue.net)\n```"}],"title":"1.6.6 Ensure access to /etc/issue.net is configured","description":"The contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services."},{"uuid":"a708dac1-7928-50ed-9e9a-d9566dc71a53","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.1_Ensure_GDM_is_removed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.1"}],"steps":[{"uuid":"87da8efe-fc00-59d9-9e78-a309df634e20","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.1_Ensure_GDM_is_removed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure GDM is removed","remarks":"If a Graphical User Interface (GUI) is not required, it should be removed to reduce the attack surface of the system.","description":"## Description\n\nThe GNOME Display Manager (GDM) is a program that manages graphical display servers and handles graphical user logins.\n\n## Audit\n\nRun the following command and verify `gdm3` is not installed:\n\n```bash\n# dpkg-query -W -f='${binary:Package}\\t${Status}\\t${db:Status-Status}\\n' gdm3\n\ngdm3 unknown ok not-installed not-installed\n```"},{"uuid":"2ae7d510-c172-5078-bb65-c027f6548f27","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.1_Ensure_GDM_is_removed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM is removed","description":"Run the following commands to uninstall `gdm3` and remove unused dependencies:\n\n```bash\n# apt purge gdm3\n# apt autoremove gdm3\n```\n\nImpact:\n\nRemoving the GNOME Display manager will remove the Graphical User Interface (GUI) from the system."}],"title":"1.7.1 Ensure GDM is removed","description":"The GNOME Display Manager (GDM) is a program that manages graphical display servers and handles graphical user logins."},{"uuid":"30826985-517c-50bb-b3f4-e14301360369","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.2_Ensure_GDM_login_banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.2"}],"steps":[{"uuid":"ad1c6340-77b9-52f6-981d-d54d6c49e393","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.2_Ensure_GDM_login_banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure GDM login banner is configured","remarks":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place.","description":"## Description\n\nGDM is the GNOME Display Manager which handles graphical login for GNOME based systems.\n\n## Audit\n\nRun the following commands to verify that the text banner on the login screen is enabled and set:\n\n```bash\n# gsettings get org.gnome.login-screen banner-message-enable \ntrue\n```\n\n```bash\n# gsettings get org.gnome.login-screen banner-message-text \n'Authorized uses only. All activity may be monitored and reported'\n```"},{"uuid":"64aa8c6d-0368-54ae-ae23-da0461b2749d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.2_Ensure_GDM_login_banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM login banner is configured","description":"**- IF -** A user profile is already created run the following commands to set and enable the text banner message on the login screen:\n\n```bash\n# gsettings set org.gnome.login-screen banner-message-text 'Authorized uses only. All activity may be monitored and reported'\n```\n\n```bash\n# gsettings set org.gnome.login-screen banner-message-enable true\n```\n\n**Note:**\n\n- `banner-message-text` may be set in accordance with local site policy\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS-CAT Assessor to appropriately assess.\n\n**- OR/IF -** A user profile does not exist:\n\n- Create or edit the gdm profile in the `/etc/dconf/profile/gdm` with the following lines:\n\n```bash\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n**Note:** gdm is the name of a dconf database.\n\n- Create a gdm keyfile for machine-wide settings in `/etc/dconf/db/gdm.d/01-banner-message`:\n\n```bash\n[org/gnome/login-screen]\nbanner-message-enable=true\nbanner-message-text='Type the banner message here.'\n```\n\n- Update the system databases\n\n```bash\n# dconf update\n```\n\n**Note:**\n\n- Users must log out and back in again before the system-wide settings take effect.\n- There is no character limit for the banner message. gnome-shell autodetects longer stretches of text and enters two column mode.\n- The banner message cannot be read from an external file."}],"title":"1.7.2 Ensure GDM login banner is configured","description":"GDM is the GNOME Display Manager which handles graphical login for GNOME based systems."},{"uuid":"97ef1a9a-18bc-5e94-a701-6bf55cb8ae5f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.3_Ensure_GDM_disable-user-list_option_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.3"}],"steps":[{"uuid":"37d7c268-0afa-5cfe-8ed7-4093cd66f0f1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.3_Ensure_GDM_disable-user-list_option_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure GDM disable-user-list option is enabled","remarks":"Displaying the user list eliminates half of the Userid/Password equation that an unauthorized person would need to log on.","description":"## Description\n\nGDM is the GNOME Display Manager which handles graphical login for GNOME based systems.\n\nThe `disable-user-list` option controls if a list of users is displayed on the login screen\n\n## Audit\n\nRun the following command and to verify that the `disable-user-list` option is enabled:\n\n```bash\n# gsettings get org.gnome.login-screen disable-user-list\ntrue\n```"},{"uuid":"378562ec-49f0-5a27-ba6a-d038c0d74554","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.3_Ensure_GDM_disable-user-list_option_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM disable-user-list option is enabled","description":"**- IF -** A user profile exists run the following command to enable the `disable-user-list`:\n\n```bash\n# gsettings set org.gnome.login-screen disable-user-list true\n```\n\n**Note:**\n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS-CAT Assessor to appropriately assess.\n\n**- OR/IF -** A user profile does not exist:\n\n- Create or edit the gdm profile in `/etc/dconf/profile/gdm` with the following lines:\n\n```bash\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n**Note:** gdm is the name of a dconf database.\n\n- Create a gdm keyfile for machine-wide settings in `/etc/dconf/db/gdm.d/00-login-screen`:\n\n```bash\n[org/gnome/login-screen]\n# Do not show the user list\ndisable-user-list=true\n```\n\n- Update the system databases:\n\n```bash\n# dconf update\n```\n\n**Note:** When the user profile is created or changed, the user will need to log out and log in again before the changes will be applied."}],"title":"1.7.3 Ensure GDM disable-user-list option is enabled","description":"GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.\n\nThe `disable-user-list` option controls if a list of users is displayed on the login screen"},{"uuid":"3b3c1ba1-1808-5f43-8598-2b7ee71386d6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.4_Ensure_GDM_screen_locks_when_the_user_is_idle"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.4"}],"steps":[{"uuid":"8d58603d-e390-548c-b84b-9346845d88a9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.4_Ensure_GDM_screen_locks_when_the_user_is_idle"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:11"}],"title":"Audit for Ensure GDM screen locks when the user is idle","remarks":"Setting a lock-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.","description":"## Description\n\nGNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time.\n\n## Audit\n\nRun the following commands to verify that the screen locks when the user is idle:\n\n```bash\n# gsettings get org.gnome.desktop.screensaver lock-delay\nuint32 5\n```\n\n```bash\n# gsettings get org.gnome.desktop.session idle-delay\nuint32 900\n```\n\n**Notes:**\n\n- `lock-delay=uint32 {n}` - should be 5 seconds or less and follow local site policy\n- `idle-delay=uint32 {n}` - Should be 900 seconds (15 minutes) or less, not `0` (disabled) and follow local site policy"},{"uuid":"f2d33df6-07f0-56d9-8ca9-3614de17687f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.4_Ensure_GDM_screen_locks_when_the_user_is_idle"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM screen locks when the user is idle","description":"**- IF -** A user profile is already created run the following commands to enable screen locks when the user is idle:\n\n```bash\n# gsettings set org.gnome.desktop.screensaver lock-delay 5\n```\n\n```bash\n# gsettings set org.gnome.desktop.session idle-delay 900\n```\n\n**Note:**\n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS-CAT Assessor to appropriately assess.\n\n**- OR/IF-** A user profile does not exist:\n\n- Create or edit the user profile in the `/etc/dconf/profile/` and verify it includes the following:\n\n```bash\nuser-db:user\nsystem-db:{NAME_OF_DCONF_DATABASE}\n```\n\n**Note:** `local` is the name of a dconf database used in the examples.\n\n- \nCreate the directory `/etc/dconf/db/local.d/` if it doesn't already exist:\n\n- \nCreate the key file `/etc/dconf/db/local.d/00-screensaver` to provide information for the `local` database:\n\nExample key file:\n\n```bash\n# Specify the dconf path\n[org/gnome/desktop/session]\n\n# Number of seconds of inactivity before the screen goes blank\n# Set to 0 seconds if you want to deactivate the screensaver.\nidle-delay=uint32 180\n\n# Specify the dconf path\n[org/gnome/desktop/screensaver]\n\n# Number of seconds after the screen is blank before locking the screen\nlock-delay=uint32 0\n```\n\n**Note:** You must include the uint32 along with the integer key values as shown.\n\n- Run the following command to update the system databases:\n\n```bash\n# dconf update\n```\n\n- Users must log out and back in again before the system-wide settings take effect."}],"title":"1.7.4 Ensure GDM screen locks when the user is idle","description":"GNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time."},{"uuid":"ff3758fb-369d-56c4-b705-6232c42cf567","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.5_Ensure_GDM_screen_locks_cannot_be_overridden"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.5"}],"steps":[{"uuid":"85f99d0c-75b8-5ce9-bc06-b94c6630a784","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.5_Ensure_GDM_screen_locks_cannot_be_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:11"}],"title":"Audit for Ensure GDM screen locks cannot be overridden","remarks":"Setting a lock-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.\n\nWithout locking down the system settings, user settings take precedence over the system settings.","description":"## Description\n\nGNOME Desktop Manager can lock down specific settings by using the lockdown mode in dconf to prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory.\n\n## Audit\n\nRun the following script to verify that the screen lock cannot be overridden:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=()\n f_check_setting() \n {\n grep -Psrilq -- \"^\\h*$2\\b\" /etc/dconf/db/local.d/locks/* && \\\n echo \"- \\\"$3\\\" is locked\" || echo \"- \\\"$3\\\" is not locked or not set\"\n }\n declare -A settings=(\n [\"idle-delay\"]=\"/org/gnome/desktop/session/idle-delay\"\n [\"lock-delay\"]=\"/org/gnome/desktop/screensaver/lock-delay\"\n )\n for setting in \"${!settings[@]}\"; do\n result=$(f_check_setting \"$setting\" \"${settings[$setting]}\" \"$setting\")\n if [[ $result == *\"is not locked\"* || $result == *\"not set to false\"* ]]; then\n a_output2+=(\"$result\")\n else\n a_output+=(\"$result\")\n fi\n done\n printf '%s\\n' \"\" \"- Audit Result:\"\n if [ \"${#a_output2[@]}\" -gt 0 ]; then\n printf '%s\\n' \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\"\n else\n printf '%s\\n' \" ** PASS **\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"5844d0bc-6930-5fcc-8c27-1bf11413957a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.5_Ensure_GDM_screen_locks_cannot_be_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM screen locks cannot be overridden","description":"- To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-screensaver` with the following content:\n\n```bash\n# Lock desktop screensaver settings\n/org/gnome/desktop/session/idle-delay\n/org/gnome/desktop/screensaver/lock-delay\n```\n\n- Update the system databases:\n\n```bash\n# dconf update\n```\n\n**Note:**\n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system-wide settings take effect."}],"title":"1.7.5 Ensure GDM screen locks cannot be overridden","description":"GNOME Desktop Manager can lock down specific settings by using the lockdown mode in dconf to prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"uuid":"bce75eb5-1e09-5c5e-a43b-2607d36e2dd9","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.6_Ensure_GDM_automatic_mounting_of_removable_media_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.6"}],"steps":[{"uuid":"86f2e3f5-ffaf-5128-b455-a9115f725c19","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.6_Ensure_GDM_automatic_mounting_of_removable_media_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:8:5"}],"title":"Audit for Ensure GDM automatic mounting of removable media is disabled","remarks":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.","description":"## Description\n\nBy default GNOME automatically mounts removable media when inserted as a convenience to the user.\n\n## Audit\n\nRun the following commands to verify automatic mounting is disabled:\n\n```bash\n# gsettings get org.gnome.desktop.media-handling automount\nfalse\n```\n\n```bash\n# gsettings get org.gnome.desktop.media-handling automount-open \nfalse\n```"},{"uuid":"d51014ac-3c1e-5cb7-b7d5-8782eccf0a6b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.6_Ensure_GDM_automatic_mounting_of_removable_media_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM automatic mounting of removable media is disabled","description":"**- IF -** A user profile exists run the following commands to ensure automatic mounting is disabled:\n\n```bash\n# gsettings set org.gnome.desktop.media-handling automount false\n# gsettings set org.gnome.desktop.media-handling automount-open false\n```\n\n**Note:**\n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS-CAT Assessor to appropriately assess.\n\n**- OR/IF -** A user profile does not exist:\n\n- Create a file `/etc/dconf/db/local.d/00-media-automount` with following content:\n\n```bash\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```\n\n- After creating the file, apply the changes using below command :\n\n```bash\n# dconf update\n```\n\n**Note:** Users must log out and back in again before the system-wide settings take effect.\n\nImpact:\n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting."}],"title":"1.7.6 Ensure GDM automatic mounting of removable media is disabled","description":"By default GNOME automatically mounts removable media when inserted as a convenience to the user."},{"uuid":"0d2be8aa-14cc-56d1-8b0a-0dde634e5db1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.7_Ensure_GDM_disabling_automatic_mounting_of_removable_media_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.7"}],"steps":[{"uuid":"3e591346-d6a5-5bde-a532-a1509ab81a2a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.7_Ensure_GDM_disabling_automatic_mounting_of_removable_media_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure GDM disabling automatic mounting of removable media is not overridden","remarks":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.","description":"## Description\n\nBy default GNOME automatically mounts removable media when inserted as a convenience to the user.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings. To lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory.\n\n## Audit\n\nRun the following script to verify automatic mounting of removable media is not overridden and correctly configured in a configuration file:\n\n- `automount=false`\n- `automount-open=false`\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=()\n check_setting() \n {\n grep -Psrilq \"^\\h*$1\\h*=\\h*false\\b\" /etc/dconf/db/local.d/locks/* 2> /dev/null && \\\n echo \"- \\\"$3\\\" is locked and set to false\" || echo \"- \\\"$3\\\" is not locked or not set to false\" \n }\n declare -A settings=(\n [\"automount\"]=\"org/gnome/desktop/media-handling\"\n [\"automount-open\"]=\"org/gnome/desktop/media-handling\"\n )\n for setting in \"${!settings[@]}\"; do\n result=$(check_setting \"$setting\" \"${settings[$setting]}\" \"$setting\")\n if [[ $result == *\"is not locked\"* || $result == *\"not set to false\"* ]]; then\n a_output2+=(\"$result\")\n else\n a_output+=(\"$result\")\n fi\n done\n printf '%s\\n' \"\" \"- Audit Result:\"\n if [ \"${#a_output2[@]}\" -gt 0 ]; then\n printf '%s\\n' \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\"\n else\n printf '%s\\n' \" ** PASS **\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"69e5ef61-1267-519f-992a-7c40a7474c08","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.7_Ensure_GDM_disabling_automatic_mounting_of_removable_media_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM disabling automatic mounting of removable media is not overridden","description":"- To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-automount` with the following content:\n\n```bash\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```\n\n- Update the systems databases:\n\n```bash\n# dconf update\n```\n\n**Note:**\n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system-wide settings take effect.\n\nImpact:\n\nThe use of portable hard drives is very common for workstation users"}],"title":"1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden","description":"By default GNOME automatically mounts removable media when inserted as a convenience to the user.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings. To lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"uuid":"b1ef1cc3-6345-5d12-882e-c7b703e795c5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.8_Ensure_GDM_autorun-never_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.8"}],"steps":[{"uuid":"c962bb4a-0cc0-5691-9c84-cb820d7ab40b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.8_Ensure_GDM_autorun-never_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:8:5"}],"title":"Audit for Ensure GDM autorun-never is enabled","remarks":"Malware on removable media may taking advantage of Autorun features when the media is inserted into a system and execute.","description":"## Description\n\nThe `autorun-never` setting allows the GNOME Desktop Display Manager to disable autorun through GDM.\n\n## Audit\n\nRun the following command to verify that `autorun-never` is set to `true` for GDM:\n\n```bash\n# gsettings get org.gnome.desktop.media-handling autorun-never\ntrue\n```"},{"uuid":"5b7f2050-96d9-5eca-9389-faf82db89904","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.8_Ensure_GDM_autorun-never_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM autorun-never is enabled","description":"**- IF -** A user profile exists run the following command to set `autorun-never` to `true` for GDM users:\n\n```bash\n# gsettings set org.gnome.desktop.media-handling autorun-never true\n```\n\n**Note:**\n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS-CAT Assessor to appropriately assess.\n\n**- OR/IF -** A user profile does not exist:\n\n- create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n```bash\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```\n\n- Update the systems databases:\n\n```bash\n# dconf update\n```\n\n**Note:** Users must log out and back in again before the system-wide settings take effect."}],"title":"1.7.8 Ensure GDM autorun-never is enabled","description":"The `autorun-never` setting allows the GNOME Desktop Display Manager to disable autorun through GDM."},{"uuid":"b367e0aa-5bf3-5bb6-a6ec-4f175e90d0ac","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.9_Ensure_GDM_autorun-never_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.9"}],"steps":[{"uuid":"77cbbc07-4ee6-5cf7-b54a-c4026097d5df","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.9_Ensure_GDM_autorun-never_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:8:5"}],"title":"Audit for Ensure GDM autorun-never is not overridden","remarks":"Malware on removable media may taking advantage of Autorun features when the media is inserted into a system and execute.","description":"## Description\n\nThe autorun-never setting allows the GNOME Desktop Display Manager to disable autorun through GDM.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory.\n\n## Audit\n\nRun the following script to verify that `autorun-never=true` cannot be overridden:\n\n```bash\n#!/usr/bin/env bash\n\n{\n # Function to check and report if a specific setting is locked and set to true\n check_setting() {\n grep -Psrilq \"^\\h*$1\\h*=\\h*true\\b\" /etc/dconf/db/local.d/locks/* 2> /dev/null && echo \"- \\\"$3\\\" is locked and set to false\" || echo \"- \\\"$3\\\" is not locked or not set to false\" \n }\n # Array of settings to check\n declare -A settings=([\"autorun-never\"]=\"org/gnome/desktop/media-handling\")\n # Check GNOME Desktop Manager configurations\n l_output=() l_output2=()\n for setting in \"${!settings[@]}\"; do\n result=$(check_setting \"$setting\")\n l_output+=(\"$result\")\n if [[ $result == *\"is not locked\"* || $result == *\"not set to true\"* ]]; then\n l_output2+=(\"$result\")\n fi\n done\n # Report results\n if [ ${#l_output2[@]} -ne 0 ]; then\n printf '%s\\n' \"- Audit Result:\" \" ** FAIL **\"\n printf '%s\\n' \"- Reason(s) for audit failure:\"\n for msg in \"${l_output2[@]}\"; do\n printf '%s\\n' \"$msg\"\n done\n else\n printf '%s\\n' \"- Audit Result:\" \" ** PASS **\"\n fi\n}\n```"},{"uuid":"031ebacc-a3f9-5453-ae4a-100564edab9f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.9_Ensure_GDM_autorun-never_is_not_overridden"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure GDM autorun-never is not overridden","description":"- To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n```bash\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```\n\n- Update the systems databases:\n\n```bash\n# dconf update\n```\n\n**Note:**\n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system-wide settings take effect."}],"title":"1.7.9 Ensure GDM autorun-never is not overridden","description":"The autorun-never setting allows the GNOME Desktop Display Manager to disable autorun through GDM.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"uuid":"eb0d2c27-a5fa-56fb-9c2f-3b261dcd5272","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Initial Setup"},{"ns":"https://cisecurity.org/ns","name":"group","value":"1 Initial Setup > 1.7 Configure GNOME Display Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.10_Ensure_XDMCP_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"1.7.10"}],"steps":[{"uuid":"09e0d37d-9c38-557a-a252-efc63c178ab9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.10_Ensure_XDMCP_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure XDMCP is not enabled","remarks":"XDMCP is inherently insecure.\n\n- XDMCP is not a ciphered protocol. This may allow an attacker to capture keystrokes entered by a user\n- XDMCP is vulnerable to man-in-the-middle attacks. This may allow an attacker to steal the credentials of legitimate users by impersonating the XDMCP server.","description":"## Description\n\nX Display Manager Control Protocol (XDMCP) is designed to provide authenticated access to display management services for remote displays\n\n## Audit\n\nRun the following script and verify the output:\n\n```bash\n#!/usr/bin/env bash\n\n{\n while IFS= read -r l_file; do\n awk '/\\[xdmcp\\]/{ f = 1;next } /\\[/{ f = 0 } f {if (/^\\s*Enable\\s*=\\s*true/) print \"The file: \\\"'\"$l_file\"'\\\" includes: \\\"\" $0 \"\\\" in the \\\"[xdmcp]\\\" block\"}' \"$l_file\"\n done < <(grep -Psil -- '^\\h*\\[xdmcp\\]' /etc/{gdm3,gdm}/{custom,daemon}.conf)\n}\n```\n\nNothing should be returned"},{"uuid":"a8953816-bdb9-5589-8958-32e852c7c387","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_1.7.10_Ensure_XDMCP_is_not_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure XDMCP is not enabled","description":"Edit all files returned by the audit and remove or commend out the `Enable=true` line in the `[xdmcp]` block:\n\nExample file:\n\n```bash\n# GDM configuration storage\n#\n# See /usr/share/gdm/gdm.schemas for a list of available options.\n\n[daemon]\n# Uncomment the line below to force the login screen to use Xorg\n#WaylandEnable=false\n\n# Enabling automatic login\n# AutomaticLoginEnable = true\n# AutomaticLogin = user1\n\n# Enabling timed login\n# TimedLoginEnable = true\n# TimedLogin = user1\n# TimedLoginDelay = 10\n\n[security]\n\n[xdmcp]\n# Enable=true <- **This line should be removed or commented out**\n\n[chooser]\n\n[debug]\n# Uncomment the line below to turn on debugging\n# More verbose logs\n# Additionally lets the X server dump core if it crashes\n#Enable=true\n```"}],"title":"1.7.10 Ensure XDMCP is not enabled","description":"X Display Manager Control Protocol (XDMCP) is designed to provide authenticated access to display management services for remote displays"},{"uuid":"f9bac567-2f98-5050-9219-3d5e36874cea","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.1_Ensure_autofs_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.1"}],"steps":[{"uuid":"0de5a2e9-85ce-5944-8bf9-86f4aced234e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.1_Ensure_autofs_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/10/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:10:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:8:5"}],"title":"Audit for Ensure autofs services are not in use","remarks":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in the filesystem even if they lacked permissions to mount it themselves.","description":"## Description\n\n`autofs` allows automatic mounting of devices, typically including CD/DVDs and USB drives.\n\n## Audit\n\nAs a preference `autofs` should not be installed unless other packages depend on it.\n\nRun the following command to verify `autofs` is not installed:\n\n```bash\n# dpkg-query -s autofs &>/dev/null && echo \"autofs is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `autofs.service` is not enabled:\n\n```bash\n# systemctl is-enabled autofs.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `autofs.service` is not active:\n\n```bash\n# systemctl is-active autofs.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"bd0aeeb0-07e2-5796-89ee-c59457f38f58","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.1_Ensure_autofs_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure autofs services are not in use","description":"Run the following commands to stop `autofs.service` and remove the `autofs` package:\n\n```bash\n# systemctl stop autofs.service\n# apt purge autofs\n```\n\n**- OR -**\n\n**- IF -** the `autofs` package is required as a dependency:\n\nRun the following commands to stop and mask `autofs.service`:\n\n```bash\n# systemctl stop autofs.service\n# systemctl mask autofs.service\n```\n\nImpact:\n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting.\n\nThere may be packages that are dependent on the `autofs` package. If the `autofs` package is removed, these dependent packages will be removed as well. Before removing the `autofs` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `autofs.service` leaving the `autofs` package installed."}],"title":"2.1.1 Ensure autofs services are not in use","description":"`autofs` allows automatic mounting of devices, typically including CD/DVDs and USB drives."},{"uuid":"0c682a0e-e75b-585b-91a5-9320c6afb315","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.2_Ensure_avahi_daemon_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.2"}],"steps":[{"uuid":"6ed7c9f2-3ceb-54fa-a289-b0e0b04e5447","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.2_Ensure_avahi_daemon_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure avahi daemon services are not in use","remarks":"Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface.","description":"## Description\n\nAvahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plug a computer into a network and Avahi automatically finds printers to print to, files to look at and people to talk to, as well as network services running on the machine.\n\n## Audit\n\nRun the following command to verify `avahi-daemon` is not installed:\n\n```bash\n# dpkg-query -s avahi-daemon &>/dev/null && echo \"avahi-daemon is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the `avahi` package is required as a dependency:\n\nRun the following command to verify `avahi-daemon.socket` and `avahi-daemon.service` are not enabled:\n\n```bash\n# systemctl is-enabled avahi-daemon.socket avahi-daemon.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `avahi-daemon.socket` and `avahi-daemon.service` are not active:\n\n```bash\n# systemctl is-active avahi-daemon.socket avahi-daemon.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"47e37be6-6c17-5b8b-bc1c-86f869f3ea1e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.2_Ensure_avahi_daemon_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure avahi daemon services are not in use","description":"Run the following commands to stop `avahi-daemon.socket` and `avahi-daemon.service`, and remove the `avahi-daemon` package:\n\n```bash\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# apt purge avahi-daemon\n```\n\n**- OR -**\n\n**- IF -** the `avahi-daemon` package is required as a dependency:\n\nRun the following commands to stop and mask the `avahi-daemon.socket` and `avahi-daemon.service`:\n\n```bash\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# systemctl mask avahi-daemon.socket avahi-daemon.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `avahi` package. If the `avahi` package is removed, these dependent packages will be removed as well. Before removing the `avahi` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `avahi-daemon.socket` and `avahi-daemon.service` leaving the `avahi` package installed."}],"title":"2.1.2 Ensure avahi daemon services are not in use","description":"Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plug a computer into a network and Avahi automatically finds printers to print to, files to look at and people to talk to, as well as network services running on the machine."},{"uuid":"b962f059-56c2-5d2b-a424-70fc7410622c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.3_Ensure_dhcp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.3"}],"steps":[{"uuid":"78a82328-ddb2-5c7a-8246-d4622756c085","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.3_Ensure_dhcp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure dhcp server services are not in use","remarks":"Unless a system is specifically set up to act as a DHCP server, it is recommended that this package be removed to reduce the potential attack surface.","description":"## Description\n\nThe Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol `DHCPv4` and `DHCPv6`. At startup the server may be started for one or the other via the `-4` or `-6` arguments.\n\n## Audit\n\nRun the following commands to verify `isc-dhcp-server` is not installed:\n\n```bash\n# dpkg-query -s isc-dhcp-server &>/dev/null && echo \"isc-dhcp-server is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `isc-dhcp-server.service` and `isc-dhcp-server6.service` are not enabled:\n\n```bash\n# systemctl is-enabled isc-dhcp-server.service isc-dhcp-server6.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `isc-dhcp-server.service` and `isc-dhcp-server6.service` are not active:\n\n```bash\n# systemctl is-active isc-dhcp-server.service isc-dhcp-server6.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"afd16fed-52ab-5210-ac19-14ec5608e3e5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.3_Ensure_dhcp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure dhcp server services are not in use","description":"Run the following commands to stop `isc-dhcp-server.service` and `isc-dhcp-server6.service` and remove the `isc-dhcp-server` package:\n\n```bash\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# apt purge isc-dhcp-server\n```\n\n**- OR -**\n\n**- IF -** the `isc-dhcp-server` package is required as a dependency:\n\nRun the following commands to stop and mask `isc-dhcp-server.service` and `isc-dhcp-server6.service`:\n\n```bash\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# systemctl mask isc-dhcp-server isc-dhcp-server6.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `isc-dhcp-server` package. If the `isc-dhcp-server` package is removed, these dependent packages will be removed as well. Before removing the `isc-dhcp-server` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `isc-dhcp-server.service` and `isc-dhcp-server6.service` leaving the `isc-dhcp-server` package installed."}],"title":"2.1.3 Ensure dhcp server services are not in use","description":"The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol `DHCPv4` and `DHCPv6`. At startup the server may be started for one or the other via the `-4` or `-6` arguments."},{"uuid":"e39d0dc4-c7ff-54d2-8fba-57fde6ed45bd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.4_Ensure_dns_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.4"}],"steps":[{"uuid":"7b98bfab-50c9-5f70-847c-21e48fd12148","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.4_Ensure_dns_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure dns server services are not in use","remarks":"Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface.","description":"## Description\n\nThe Domain Name System (DNS) is a hierarchical naming system that maps names to IP addresses for computers, services and other resources connected to a network.\n\n**Note:** `bind9` is the package and `bind.service` is the alias for `named.service`.\n\n## Audit\n\nRun the following command to verify `bind9` is not installed:\n\n```bash\n# dpkg-query -s bind9 &>/dev/null && echo \"bind9 is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `named.service` is not enabled:\n\n```bash\n# systemctl is-enabled named.service 2>/dev/null | grep 'enabled'\n\nNothing should be returned\n```\n\nRun the following command to verify the `named.service` is not active:\n\n```bash\n# systemctl is-active named.service 2>/dev/null | grep '^active'\n\nNothing should be returned\n```\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"507f4a91-090a-5345-8087-788450742759","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.4_Ensure_dns_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure dns server services are not in use","description":"Run the following commands to stop `named.service` and remove the `bind9` package:\n\n```bash\n# systemctl stop named.service\n# apt purge bind9\n```\n\n**- OR -**\n\n**- IF -** the `bind9` package is required as a dependency:\n\nRun the following commands to stop and mask `bind9.service`:\n\n```bash\n# systemctl stop named.service\n# systemctl mask named.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `bind9` package. If the `bind9` package is removed, these dependent packages will be removed as well. Before removing the `bind9` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask `named.service` leaving the `bind9` package installed."}],"title":"2.1.4 Ensure dns server services are not in use","description":"The Domain Name System (DNS) is a hierarchical naming system that maps names to IP addresses for computers, services and other resources connected to a network.\n\n**Note:** `bind9` is the package and `bind.service` is the alias for `named.service`."},{"uuid":"ac3b85dd-78e8-53b0-9077-2461a2cb9cf4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.5_Ensure_dnsmasq_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.5"}],"steps":[{"uuid":"edfa6389-20a0-526a-8c51-b484b9996625","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.5_Ensure_dnsmasq_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure dnsmasq services are not in use","remarks":"Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface.","description":"## Description\n\n`dnsmasq` is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services.\n\n## Audit\n\nRun one of the following commands to verify `dnsmasq` is not installed:\n\n```bash\n# dpkg-query -s dnsmasq &>/dev/null && echo \"dnsmasq is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `dnsmasq.service` is not enabled:\n\n```bash\n# systemctl is-enabled dnsmasq.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `dnsmasq.service` is not active:\n\n```bash\n# systemctl is-active dnsmasq.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"8401c64f-a0d1-59e4-8a76-ef5a37155007","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.5_Ensure_dnsmasq_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure dnsmasq services are not in use","description":"Run the following commands to stop `dnsmasq.service` and remove `dnsmasq` package:\n\n```bash\n# systemctl stop dnsmasq.service\n# apt purge dnsmasq\n```\n\n**- OR -**\n\n**- IF -** the `dnsmasq` package is required as a dependency:\n\nRun the following commands to stop and mask the `dnsmasq.service`:\n\n```bash\n# systemctl stop dnsmasq.service\n# systemctl mask dnsmasq.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `dnsmasq` package. If the `dnsmasq` package is removed, these dependent packages will be removed as well. Before removing the `dnsmasq` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `dnsmasq.service` leaving the `dnsmasq` package installed."}],"title":"2.1.5 Ensure dnsmasq services are not in use","description":"`dnsmasq` is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services."},{"uuid":"e4f92df3-841e-5a1a-9393-acf0ca33b55e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.6_Ensure_ftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.6"}],"steps":[{"uuid":"a9df676c-fe04-59b2-8145-4759620bec68","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.6_Ensure_ftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ftp server services are not in use","remarks":"FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface.","description":"## Description\n\nThe File Transfer Protocol (FTP) provides networked computers with the ability to transfer files. `vsftpd` is the Very Secure File Transfer Protocol Daemon.\n\n## Audit\n\nRun the following command to verify `vsftpd` is not installed:\n\n```bash\n# dpkg-query -s vsftpd &>/dev/null && echo \"vsftpd is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `vsftpd` service is not enabled:\n\n```bash\n# systemctl is-enabled vsftpd.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `vsftpd` service is not active:\n\n```bash\n# systemctl is-active vsftpd.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:**\n\n- Other ftp server packages may exist. They should also be audited, if not required and authorized by local site policy\n- If the package is required for a dependency:\n\nEnsure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"ee18338f-69f3-561c-be04-5159c40863e3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.6_Ensure_ftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ftp server services are not in use","description":"Run the following commands to stop `vsftpd.service` and remove the `vsftpd` package:\n\n```bash\n# systemctl stop vsftpd.service\n# apt purge vsftpd\n```\n\n**- OR -**\n\n**- IF -** the `vsftpd` package is required as a dependency:\n\nRun the following commands to stop and mask the `vsftpd.service`:\n\n```bash\n# systemctl stop vsftpd.service\n# systemctl mask vsftpd.service\n```\n\n**Note:** Other ftp server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service should be stopped and masked.\n\nImpact:\n\nThere may be packages that are dependent on the `vsftpd` package. If the `vsftpd` package is removed, these dependent packages will be removed as well. Before removing the `vsftpd` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `vsftpd.service` leaving the `vsftpd` package installed."}],"title":"2.1.6 Ensure ftp server services are not in use","description":"The File Transfer Protocol (FTP) provides networked computers with the ability to transfer files. `vsftpd` is the Very Secure File Transfer Protocol Daemon."},{"uuid":"6399b67a-7f3e-5a02-a3c1-ae3191ac1b38","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.7_Ensure_ldap_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.7"}],"steps":[{"uuid":"ce7358c7-154c-51cf-aa0f-927e16316deb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.7_Ensure_ldap_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ldap server services are not in use","remarks":"If the system will not need to act as an LDAP server, it is recommended that the software be removed to reduce the potential attack surface.","description":"## Description\n\nThe Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database.\n\n## Audit\n\nRun the following command to verify `slapd` is not installed:\n\n```bash\n# dpkg-query -s slapd &>/dev/null && echo \"slapd is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `slapd.service` is not enabled:\n\n```bash\n# systemctl is-enabled slapd.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `slapd.service` is not active:\n\n```bash\n# systemctl is-active slapd.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"5e459aeb-372e-5b97-86ca-edc1febaf065","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.7_Ensure_ldap_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ldap server services are not in use","description":"Run the following commands to stop `slapd.service` and remove the `slapd` package:\n\n```bash\n# systemctl stop slapd.service\n# apt purge slapd\n```\n\n**- OR -**\n\n**- IF -** the `slapd` package is required as a dependency:\n\nRun the following commands to stop and mask `slapd.service`:\n\n```bash\n# systemctl stop slapd.service\n# systemctl mask slapd.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `slapd` package. If the `slapd` package is removed, these dependent packages will be removed as well. Before removing the `slapd` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `slapd.service` leaving the `slapd` package installed."}],"title":"2.1.7 Ensure ldap server services are not in use","description":"The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."},{"uuid":"971a3544-5339-5cb8-87c2-e6acfdb12b3d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.8_Ensure_message_access_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.8"}],"steps":[{"uuid":"10f2b24f-376c-52cc-a761-6abf88b0a856","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.8_Ensure_message_access_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure message access server services are not in use","remarks":"Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the package be removed to reduce the potential attack surface.\n\n**Note:** Several IMAP/POP3 servers exist and can use other service names. These should also be audited and the packages removed if not required.","description":"## Description\n\n`dovecot-imapd` and `dovecot-pop3d` are an open source IMAP and POP3 server for Linux based systems.\n\n## Audit\n\nRun the following command to verify `dovecot-imapd` and `dovecot-pop3d` are not installed:\n\n```bash\n# dpkg-query -s dovecot-imapd &>/dev/null && echo \"dovecot-imapd is installed\"\n```\n\nNothing should be returned.\n\n```bash\n# dpkg-query -s dovecot-pop3d &>/dev/null && echo \"dovecot-pop3d is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** a package is installed **and** is required for dependencies:\n\nRun the following commands to verify `dovecot.socket` and `dovecot.service` are not enabled:\n\n```bash\n# systemctl is-enabled dovecot.socket dovecot.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `dovecot.socket` and `dovecot.service` are not active:\n\n```bash\n# systemctl is-active dovecot.socket dovecot.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"f90cf583-3cdb-5cb6-a55f-29f9a3ccee58","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.8_Ensure_message_access_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure message access server services are not in use","description":"Run one of the following commands to remove `dovecot-imapd` and `dovecot-pop3d`:\n\nRun the following commands to stop `dovecot.socket` and `dovecot.service`, and remove the `dovecot-imapd` and `dovecot-pop3d` packages:\n\n```bash\n# systemctl stop dovecot.socket dovecot.service\n# apt purge dovecot-imapd dovecot-pop3d\n```\n\n**- OR -**\n\n**- IF -** a package is installed **and** is required for dependencies:\n\nRun the following commands to stop and mask `dovecot.socket` and `dovecot.service`:\n\n```bash\n# systemctl stop dovecot.socket dovecot.service\n# systemctl mask dovecot.socket dovecot.service\n```\n\nImpact:\n\nThere may be packages that are dependent on `dovecot-imapd` and/or `dovecot-pop3d` packages. If `dovecot-imapd` and `dovecot-pop3d` packages are removed, these dependent packages will be removed as well. Before removing `dovecot-imapd` and/or `dovecot-pop3d` packages, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask `dovecot.socket` and `dovecot.service` leaving `dovecot-imapd` and/or `dovecot-pop3d` packages installed."}],"title":"2.1.8 Ensure message access server services are not in use","description":"`dovecot-imapd` and `dovecot-pop3d` are an open source IMAP and POP3 server for Linux based systems."},{"uuid":"6f06a46c-a909-5805-87a3-3151963edab8","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.9_Ensure_network_file_system_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.9"}],"steps":[{"uuid":"b888122f-2186-5430-9032-eec67b2a1b64","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.9_Ensure_network_file_system_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure network file system services are not in use","remarks":"If the system does not export NFS shares, it is recommended that the `nfs-kernel-server` package be removed to reduce the remote attack surface.","description":"## Description\n\nThe Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network.\n\n## Audit\n\nRun the following command to verify `nfs-kernel-server` is not installed:\n\n```bash\n# dpkg-query -s nfs-kernel-server &>/dev/null && echo \"nfs-kernel-server is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** package is required for dependencies:\n\nRun the following command to verify that the `nfs-server.service` is not enabled:\n\n```bash\n# systemctl is-enabled nfs-server.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `nfs-server.service` is not active:\n\n```bash\n# systemctl is-active nfs-server.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"fa8d15f1-b995-5ef3-b94b-1d2fd0ed2279","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.9_Ensure_network_file_system_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure network file system services are not in use","description":"Run the following command to stop `nfs-server.service` and remove `nfs-kernel-server` package:\n\n```bash\n# systemctl stop nfs-server.service\n# apt purge nfs-kernel-server\n```\n\n**- OR -**\n\n**- IF -** the `nfs-kernel-server` package is required as a dependency:\n\nRun the following commands to stop and mask the `nfs-server.service`:\n\n```bash\n# systemctl stop nfs-server.service\n# systemctl mask nfs-server.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `nfs-kernel-server` package. If the `nfs-kernel-server` package is removed, these dependent packages will be removed as well. Before removing the `nfs-kernel-server` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `nfs-server.service` leaving the `nfs-kernel-server` package installed."}],"title":"2.1.9 Ensure network file system services are not in use","description":"The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network."},{"uuid":"edea0f6d-2d44-522f-b555-64306a633bb0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.10_Ensure_nis_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.10"}],"steps":[{"uuid":"bc78e481-cb3b-55fd-8e1b-88b1bbab53b8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.10_Ensure_nis_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure nis server services are not in use","remarks":"`ypserv.service` is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that `ypserv.service` be removed and other, more secure services be used","description":"## Description\n\nThe Network Information Service (NIS) (formally known as Yellow Pages) is a client-server directory service protocol for distributing system configuration files. The NIS server is a collection of programs that allow for the distribution of configuration files. The NIS client (`ypbind`) was used to bind a machine to an NIS server and receive the distributed configuration files.\n\n## Audit\n\nRun the following command to verify `ypserv` is not installed:\n\n```bash\n# dpkg-query -s ypserv &>/dev/null && echo \"ypserv is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `ypserv.service` is not enabled:\n\n```bash\n# systemctl is-enabled ypserv.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `ypserv.service` is not active:\n\n```bash\n# systemctl is-active ypserv.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"135b3527-e87c-532f-9154-f6b01acd12ef","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.10_Ensure_nis_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nis server services are not in use","description":"Run the following commands to stop `ypserv.service` and remove `ypserv` package:\n\n```bash\n# systemctl stop ypserv.service\n# apt purge ypserv\n```\n\n**- OR -**\n\n**- IF -** the `ypserv` package is required as a dependency:\n\nRun the following commands to stop and mask `ypserv.service`:\n\n```bash\n# systemctl stop ypserv.service\n# systemctl mask ypserv.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `ypserv` package. If the `ypserv` package is removed, these dependent packages will be removed as well. Before removing the `ypserv` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `ypserv.service` leaving the `ypserv` package installed."}],"title":"2.1.10 Ensure nis server services are not in use","description":"The Network Information Service (NIS) (formally known as Yellow Pages) is a client-server directory service protocol for distributing system configuration files. The NIS server is a collection of programs that allow for the distribution of configuration files. The NIS client (`ypbind`) was used to bind a machine to an NIS server and receive the distributed configuration files."},{"uuid":"1796774e-24a0-5de1-88b7-a3df2e7f67f9","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.11_Ensure_print_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.11"}],"steps":[{"uuid":"3af187a8-31ba-544a-870d-6f3f627092ae","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.11_Ensure_print_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure print server services are not in use","remarks":"If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface.","description":"## Description\n\nThe Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administration capability.\n\n## Audit\n\nRun the following command to verify `cups` is not Installed:\n\n```bash\n# dpkg-query -s cups &>/dev/null && echo \"cups is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the `cups` package is required as a dependency:\n\nRun the following command to verify the `cups.socket` and `cups.service` are not enabled:\n\n```bash\n# systemctl is-enabled cups.socket cups.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `cups.socket` and `cups.service` are not active:\n\n```bash\n# systemctl is-active cups.socket cups.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"aca77a81-dc85-5cd1-bde3-eff10f11218b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.11_Ensure_print_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure print server services are not in use","description":"Run the following commands to stop `cups.socket` and `cups.service`, and remove the `cups` package:\n\n```bash\n# systemctl stop cups.socket cups.service\n# apt purge cups\n```\n\n**- OR -**\n\n**- IF -** the `cups` package is required as a dependency:\n\nRun the following commands to stop and mask the `cups.socket` and `cups.service`:\n\n```bash\n# systemctl stop cups.socket cups.service\n# systemctl mask cups.socket cups.service\n```\n\nImpact:\n\nRemoving the cups package, or disabling `cups.socket` and/or `cups.service` will prevent printing from the system, a common task for workstation systems.\n\nThere may be packages that are dependent on the `cups` package. If the `cups` package is removed, these dependent packages will be removed as well. Before removing the `cups` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask `cups.socket` and `cups.service` leaving the `cups` package installed."}],"title":"2.1.11 Ensure print server services are not in use","description":"The Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administration capability."},{"uuid":"32883d03-ccf9-5aca-b684-01c20ba232cd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.12_Ensure_rpcbind_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.12"}],"steps":[{"uuid":"1f46cf32-6278-5ad8-8fca-3d735cbc65db","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.12_Ensure_rpcbind_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure rpcbind services are not in use","remarks":"A small request (~82 bytes via UDP) sent to the Portmapper generates a large response (7x to 28x amplification), which makes it a suitable tool for DDoS attacks. If `rpcbind` is not required, it is recommended to remove `rpcbind` package to reduce the potential attack surface.","description":"## Description\n\nThe `rpcbind` utility maps RPC services to the ports on which they listen. RPC processes notify `rpcbind` when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts `rpcbind` on the server with a particular RPC program number. The `rpcbind.service` redirects the client to the proper port number so it can communicate with the requested service.\n\nPortmapper is an RPC service, which always listens on tcp and udp 111, and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port number on the server. When a remote host makes an RPC call to that server, it first consults with portmap to determine where the RPC server is listening.\n\n## Audit\n\nRun the following command to verify `rpcbind` package is not installed:\n\n```bash\n# dpkg-query -s rpcbind &>/dev/null && echo \"rpcbind is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the `rpcbind` package is required as a dependency:\n\nRun the following command to verify `rpcbind.socket` and `rpcbind.service` are not enabled:\n\n```bash\n# systemctl is-enabled rpcbind.socket rpcbind.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `rpcbind.socket` and `rpcbind.service` are not active:\n\n```bash\n# systemctl is-active rpcbind.socket rpcbind.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"d4605dc6-5c9a-5f8c-8e5f-433410867c32","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.12_Ensure_rpcbind_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rpcbind services are not in use","description":"Run the following commands to stop `rpcbind.socket` and `rpcbind.service`, and remove the `rpcbind` package:\n\n```bash\n# systemctl stop rpcbind.socket rpcbind.service\n# apt purge rpcbind\n```\n\n**- OR -**\n\n**- IF -** the `rpcbind` package is required as a dependency:\n\nRun the following commands to stop and mask the `rpcbind.socket` and `rpcbind.service`:\n\n```bash\n# systemctl stop rpcbind.socket rpcbind.service\n# systemctl mask rpcbind.socket rpcbind.service\n```\n\nImpact:\n\nMany of the libvirt packages used by Enterprise Linux virtualization, and the `nfs-utils` package used for The Network File System (NFS), are dependent on the `rpcbind` package. If the `rpcbind` package is removed, these dependent packages will be removed as well. Before removing the `rpcbind` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `rpcbind.socket` and `rpcbind.service` leaving the `rpcbind` package installed."}],"title":"2.1.12 Ensure rpcbind services are not in use","description":"The `rpcbind` utility maps RPC services to the ports on which they listen. RPC processes notify `rpcbind` when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts `rpcbind` on the server with a particular RPC program number. The `rpcbind.service` redirects the client to the proper port number so it can communicate with the requested service.\n\nPortmapper is an RPC service, which always listens on tcp and udp 111, and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port number on the server. When a remote host makes an RPC call to that server, it first consults with portmap to determine where the RPC server is listening."},{"uuid":"6d6d8560-d6b0-5351-8344-2abb61e684bc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.13_Ensure_rsync_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.13"}],"steps":[{"uuid":"27ea9480-d870-56da-a94b-13d7cbfffc71","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.13_Ensure_rsync_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure rsync services are not in use","remarks":"`rsync.service` presents a security risk as the `rsync` protocol is unencrypted.\n\nThe `rsync` package should be removed to reduce the attack area of the system.","description":"## Description\n\nThe `rsync` service can be used to synchronize files between systems over network links.\n\n## Audit\n\nRun the following command to verify `rsync` is not installed:\n\n```bash\n# dpkg-query -s rsync &>/dev/null && echo \"rsync is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the `rsync` package is required as a dependency:\n\nRun the following command to verify `rsync.service` is not enabled:\n\n```bash\n# systemctl is-enabled rsync.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `rsync.service` is not active:\n\n```bash\n# systemctl is-active rsync.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"2ec7ee9e-b6de-5a58-8d00-6de207b46ab3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.13_Ensure_rsync_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsync services are not in use","description":"Run the following commands to stop `rsync.service`, and remove the `rsync` package:\n\n```bash\n# systemctl stop rsync.service\n# apt purge rsync\n```\n\n**- OR -**\n\n**- IF -** the `rsync` package is required as a dependency:\n\nRun the following commands to stop and mask `rsync.service`:\n\n```bash\n# systemctl stop rsync.service\n# systemctl mask rsync.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `rsync` package. If the `rsync` package is removed, these dependent packages will be removed as well. Before removing the `rsync` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask `rsync.service` leaving the `rsync` package installed."}],"title":"2.1.13 Ensure rsync services are not in use","description":"The `rsync` service can be used to synchronize files between systems over network links."},{"uuid":"3932ed95-5e6b-5936-aca8-76a6c764733d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.14_Ensure_samba_file_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.14"}],"steps":[{"uuid":"b27f2f07-2b9a-57ba-ba6f-15dd64682edf","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.14_Ensure_samba_file_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure samba file server services are not in use","remarks":"If there is no need to mount directories and file systems to Windows systems, then this service should be deleted to reduce the potential attack surface.","description":"## Description\n\nThe Samba daemon allows system administrators to configure their Linux systems to share file systems and directories with Windows desktops. Samba will advertise the file systems and directories via the Server Message Block (SMB) protocol. Windows desktop users will be able to mount these directories and file systems as letter drives on their systems.\n\n## Audit\n\nRun the following command to verify `samba` is not installed:\n\n```bash\n# dpkg-query -s samba &>/dev/null && echo \"samba is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `smbd.service` is not enabled:\n\n```bash\n# systemctl is-enabled smbd.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `smbd.service` is not active:\n\n```bash\n# systemctl is-active smbd.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned."},{"uuid":"e1e23dd9-4b42-5ace-b01d-d8f6e5d8d6a9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.14_Ensure_samba_file_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure samba file server services are not in use","description":"Run the following commands to stop `smbd.service` and remove `samba` package:\n\n```bash\n# systemctl stop smbd.service\n# apt purge samba\n```\n\n**- OR -**\n\n**- IF -** the `samba` package is required as a dependency:\n\nRun the following commands to stop and mask the `smbd.service`:\n\n```bash\n# systemctl stop smbd.service\n# systemctl mask smbd.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `samba` package. If the `samba` package is removed, these dependent packages will be removed as well. Before removing the `samba` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `smbd.service` leaving the `samba` package installed."}],"title":"2.1.14 Ensure samba file server services are not in use","description":"The Samba daemon allows system administrators to configure their Linux systems to share file systems and directories with Windows desktops. Samba will advertise the file systems and directories via the Server Message Block (SMB) protocol. Windows desktop users will be able to mount these directories and file systems as letter drives on their systems."},{"uuid":"8ee5e381-a7b8-56a4-a707-0100c25c232f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.15_Ensure_snmp_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.15"}],"steps":[{"uuid":"768fc98a-bd1a-55f8-8787-350cc3d6acce","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.15_Ensure_snmp_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure snmp services are not in use","remarks":"The SNMP server can communicate using `SNMPv1`, which transmits data in the clear and does not require authentication to execute commands. `SNMPv3` replaces the simple/clear text password sharing used in `SNMPv2` with more securely encoded parameters. If the the SNMP service is not required, the `snmpd` package should be removed to reduce the attack surface of the system.\n\n**Note:** If SNMP is required:\n\n- The server should be configured for `SNMP v3` only. `User Authentication` and `Message Encryption` should be configured.\n- If `SNMP v2` is **absolutely** necessary, modify the community strings' values.","description":"## Description\n\nSimple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment, computer equipment and devices like UPSs.\n\nNet-SNMP is a suite of applications used to implement SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901-1908), and SNMPv3 (RFCs 3411-3418) using both IPv4 and IPv6.\n\nSupport for SNMPv2 classic (a.k.a. \"SNMPv2 historic\" - RFCs 1441-1452) was dropped with the 4.0 release of the UCD-snmp package.\n\nThe Simple Network Management Protocol (SNMP) server is used to listen for SNMP commands from an SNMP management system, execute the commands or collect the information and then send results back to the requesting system.\n\n## Audit\n\nRun the following command to verify `snmpd` is not installed:\n\n```bash\n# dpkg-query -s snmpd &>/dev/null && echo \"snmpd is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify the `snmpd.service` is not enabled:\n\n```bash\n# systemctl is-enabled snmpd.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `snmpd.service` is not active:\n\n```bash\n# systemctl is-active snmpd.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"ff1ab09d-5646-537e-8420-92ace832ce60","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.15_Ensure_snmp_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure snmp services are not in use","description":"Run the following commands to stop `snmpd.service` and remove the `snmpd` package:\n\n```bash\n# systemctl stop snmpd.service\n# apt purge snmpd\n```\n\n**- OR -** If the package is required for dependencies:\n\nRun the following commands to stop and mask the `snmpd.service`:\n\n```bash\n# systemctl stop snmpd.service\n# systemctl mask snmpd.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `snmpd` package. If the `snmpd` package is removed, these packages will be removed as well.\n\nBefore removing the `snmpd` package, review any dependent packages to determine if they are required on the system. If a dependent package is required, stop and mask the `snmpd.service` leaving the `snmpd` package installed."}],"title":"2.1.15 Ensure snmp services are not in use","description":"Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment, computer equipment and devices like UPSs.\n\nNet-SNMP is a suite of applications used to implement SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901-1908), and SNMPv3 (RFCs 3411-3418) using both IPv4 and IPv6.\n\nSupport for SNMPv2 classic (a.k.a. \"SNMPv2 historic\" - RFCs 1441-1452) was dropped with the 4.0 release of the UCD-snmp package.\n\nThe Simple Network Management Protocol (SNMP) server is used to listen for SNMP commands from an SNMP management system, execute the commands or collect the information and then send results back to the requesting system."},{"uuid":"80f2392d-5867-5dad-8cc8-906644270f5d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.16_Ensure_tftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.16"}],"steps":[{"uuid":"091e5d0e-a6ea-580b-a091-533b97f8adcd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.16_Ensure_tftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure tftp server services are not in use","remarks":"Unless there is a need to run the system as a TFTP server, it is recommended that the package be removed to reduce the potential attack surface.\n\nTFTP does not have built-in encryption, access control or authentication. This makes it very easy for an attacker to exploit TFTP to gain access to files","description":"## Description\n\nTrivial File Transfer Protocol (TFTP) is a simple protocol for exchanging files between two TCP/IP machines. TFTP servers allow connections from a TFTP Client for sending and receiving files.\n\n## Audit\n\nRun the following command to verify `tftpd-hpa` is not installed:\n\n```bash\n# dpkg-query -s tftpd-hpa &>/dev/null && echo \"tftpd-hpa is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `tftpd-hpa.service` is not enabled:\n\n```bash\n# systemctl is-enabled tftpd-hpa.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `tftpd-hpa.service` is not active:\n\n```bash\n# systemctl is-active tftpd-hpa.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"01c92f41-aaca-50af-ba33-6295a23a2476","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.16_Ensure_tftp_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure tftp server services are not in use","description":"Run the following commands to stop `tftpd-hpa.service`, and remove the `tftpd-hpa` package:\n\n```bash\n# systemctl stop tftpd-hpa.service\n# apt purge tftpd-hpa\n```\n\n**- OR -**\n\n**- IF -** the `tftpd-hpa` package is required as a dependency:\n\nRun the following commands to stop and mask `tftpd-hpa.service`:\n\n```bash\n# systemctl stop tftpd-hpa.service\n# systemctl mask tftpd-hpa.service\n```\n\nImpact:\n\nTFTP is often used to provide files for network booting such as for PXE based installation of servers.\n\nThere may be packages that are dependent on the `tftpd-hpa` package. If the `tftpd-hpa` package is removed, these dependent packages will be removed as well. Before removing the `tftpd-hpa` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask `tftpd-hpa.service` leaving the `tftpd-hpa` package installed."}],"title":"2.1.16 Ensure tftp server services are not in use","description":"Trivial File Transfer Protocol (TFTP) is a simple protocol for exchanging files between two TCP/IP machines. TFTP servers allow connections from a TFTP Client for sending and receiving files."},{"uuid":"4bb74c9f-8dae-53ec-aad8-a499d5d204a7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.17_Ensure_web_proxy_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.17"}],"steps":[{"uuid":"130d494c-2753-564a-b6af-04c167d68c29","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.17_Ensure_web_proxy_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure web proxy server services are not in use","remarks":"Unless a system is specifically set up to act as a proxy server, it is recommended that the squid package be removed to reduce the potential attack surface.\n\n**Note:** Several HTTP proxy servers exist. These should be checked and removed unless required.","description":"## Description\n\nSquid is a standard proxy server used in many distributions and environments.\n\n## Audit\n\nRun the following command to verify `squid` is not installed:\n\n```bash\n# dpkg-query -s squid &>/dev/null && echo \"squid is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the package is required for dependencies:\n\nRun the following command to verify `squid.service` is not enabled:\n\n```bash\n# systemctl is-enabled squid.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify the `squid.service` is not active:\n\n```bash\n# systemctl is-active squid.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"8ec0d0fc-4f0c-5160-9987-546b42dc076b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.17_Ensure_web_proxy_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure web proxy server services are not in use","description":"Run the following commands to stop `squid.service` and remove the `squid` package:\n\n```bash\n# systemctl stop squid.service\n# apt purge squid\n```\n\n**- OR -** If the `squid` package is required as a dependency:\n\nRun the following commands to stop and mask the `squid.service`:\n\n```bash\n# systemctl stop squid.service\n# systemctl mask squid.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `squid` package. If the `squid` package is removed, these dependent packages will be removed as well. Before removing the `squid` package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `squid.service` leaving the `squid` package installed."}],"title":"2.1.17 Ensure web proxy server services are not in use","description":"Squid is a standard proxy server used in many distributions and environments."},{"uuid":"0f9c8f09-7911-544b-ba13-77e55d1181ae","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.18_Ensure_web_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.18"}],"steps":[{"uuid":"49fc240b-6de7-5db9-9e7d-4c3c361bcf60","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.18_Ensure_web_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure web server services are not in use","remarks":"Unless there is a local site approved requirement to run a web server service on the system, web server packages should be removed to reduce the potential attack surface.","description":"## Description\n\nWeb servers provide the ability to host web site content.\n\n## Audit\n\nRun the following command to verify `apache2` is not installed:\n\n```bash\n# dpkg-query -s apache2 &>/dev/null && echo \"apache2 is installed\"\n```\n\nNothing should be returned.\n\nRun the following command to verify `nginx` is not installed:\n\n```bash\n# dpkg-query -s nginx &>/dev/null && echo \"nginx is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** a package is installed **and** is required for dependencies:\n\nRun the following command to verify `apache2.socket`, `apache2.service`, and `nginx.service` are not enabled:\n\n```bash\n# systemctl is-enabled apache2.socket apache2.service nginx.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `apache2.socket`, `apache2.service`, and `nginx.service` are not active:\n\n```bash\n# systemctl is-active apache2.socket apache2.service nginx.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:**\n\n- Other web server packages may exist. They should also be audited, if not required and authorized by local site policy\n- If the package is required for a dependency:\n\nEnsure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"84c5c8b9-9225-5e29-8dde-686fce0da2bd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.18_Ensure_web_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure web server services are not in use","description":"Run the following commands to stop `httpd.socket`, `httpd.service`, and `nginx.service`, and remove `apache2` and `nginx` packages:\n\n```bash\n# systemctl stop apache2.socket apache2.service nginx.service\n# apt purge apache2 nginx\n```\n\n**- OR -**\n\n**- IF -** a package is installed **and** is required for dependencies:\n\nRun the following commands to stop and mask `apache2.socket`, `apache2.service`, and `nginx.service`:\n\n```bash\n# systemctl stop apache2.socket apache2.service nginx.service\n# systemctl mask apache2.socket apache2.service nginx.service\n```\n\n**Note:** Other web server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service and socket should be stopped and masked.\n\nImpact:\n\nRemoval of web server packages will remove that ability for the server to host web services.\n\n**- IF -** the web server package is required for a dependency, any related service or socket should be stopped and masked.\n\n**Note:** If the remediation steps to mask a service are followed and that package is not installed on the system, the service and/or socket will still be masked. If the package is installed due to an approved requirement to host a web server, the associated service and/or socket would need to be unmasked before it could be enabled and/or started."}],"title":"2.1.18 Ensure web server services are not in use","description":"Web servers provide the ability to host web site content."},{"uuid":"be1703e9-4962-5d26-9d50-173de416c319","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.19_Ensure_xinetd_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.19"}],"steps":[{"uuid":"3a8b0dc3-2bd0-5d00-83e4-7e565b8294b5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.19_Ensure_xinetd_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure xinetd services are not in use","remarks":"If there are no `xinetd` services required, it is recommended that the package be removed to reduce the attack surface are of the system.\n\n**Note:** If an `xinetd` service or services are required, ensure that any `xinetd` service not required is stopped and masked","description":"## Description\n\nThe eXtended InterNET Daemon (`xinetd`) is an open source super daemon that replaced the original `inetd` daemon. The `xinetd` daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests.\n\n## Audit\n\nRun the following command to verify the `xinetd` package is not installed:\n\n```bash\n# dpkg-query -s xinetd &>/dev/null && echo \"xinetd is installed\"\n```\n\nNothing should be returned.\n\n**-OR-**\n\n**-IF-** the `xinetd` package is required as a dependency:\n\nRun the following command to verify `xinetd.service` is not enabled:\n\n```bash\n# systemctl is-enabled xinetd.service 2>/dev/null | grep 'enabled'\n\nNothing should be returned\n```\n\nRun the following command to verify `xinetd.service` is not active:\n\n```bash\n# systemctl is-active xinetd.service 2>/dev/null | grep '^active'\n\nNothing should be returned\n```\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"87306386-07f6-545b-ac26-835ef57551eb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.19_Ensure_xinetd_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure xinetd services are not in use","description":"Run the following commands to stop `xinetd.service`, and remove the `xinetd` package:\n\n```bash\n# systemctl stop xinetd.service\n# apt purge xinetd\n```\n\n**-OR-**\n\n**-IF-** the `xinetd` package is required as a dependency:\n\nRun the following commands to stop and mask the `xinetd.service`:\n\n```bash\n# systemctl stop xinetd.service\n# systemctl mask xinetd.service\n```\n\nImpact:\n\nThere may be packages that are dependent on the `xinetd` package. If the `xinetd` package is removed, these dependent packages will be removed as well. Before removing the `xinetd` package, review any dependent packages to determine if they are required on the system.\n\n**-IF-** a dependent package is required: stop and mask xinetd.service leaving the xinetd package installed."}],"title":"2.1.19 Ensure xinetd services are not in use","description":"The eXtended InterNET Daemon (`xinetd`) is an open source super daemon that replaced the original `inetd` daemon. The `xinetd` daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests."},{"uuid":"0442f8ea-f0ab-5f16-afc3-5211e3421ab3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.20_Ensure_X_window_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.20"}],"steps":[{"uuid":"f69064bb-8222-5c0c-8b8f-c670daf9c344","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.20_Ensure_X_window_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/2/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:2:6"}],"title":"Audit for Ensure X window server services are not in use","remarks":"Unless your organization specifically requires graphical login access via X Windows, remove it to reduce the potential attack surface.","description":"## Description\n\nThe X Window System provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. The X Windows system is typically used on workstations where users login, but not on servers where users typically do not login.\n\n## Audit\n\n**- IF -** a Graphical Desktop Manager or X-Windows server is not required and approved by local site policy:\n\nRun the following command to Verify X Windows Server is not installed.\n\n```bash\ndpkg-query -s xserver-common &>/dev/null && echo \"xserver-common is installed\"\n```\n\nNothing should be returned"},{"uuid":"2268c456-3df5-5baf-a4e5-3e713d85b647","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.20_Ensure_X_window_server_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure X window server services are not in use","description":"**- IF -** a Graphical Desktop Manager or X-Windows server is not required and approved by local site policy:\n\nRun the following command to remove the X Windows Server package:\n\n```bash\n# apt purge xserver-common\n```\n\nImpact:\n\nIf a Graphical Desktop Manager (GDM) is in use on the system, there may be a dependency on the `xorg-x11-server-common` package. If the GDM is required and approved by local site policy, the package should **not** be removed.\n\nMany Linux systems run applications which require a Java runtime. Some Linux Java packages have a dependency on specific X Windows xorg-x11-fonts. One workaround to avoid this dependency is to use the \"headless\" Java packages for your specific Java runtime."}],"title":"2.1.20 Ensure X window server services are not in use","description":"The X Window System provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. The X Windows system is typically used on workstations where users login, but not on servers where users typically do not login."},{"uuid":"fc4d557c-78bd-574d-96a5-4148b59529cc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.21_Ensure_mail_transfer_agent_is_configured_for_local-only_mode"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.21"}],"steps":[{"uuid":"9874ee1c-0b5f-54c5-8bf3-bda35c8086fe","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.21_Ensure_mail_transfer_agent_is_configured_for_local-only_mode"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure mail transfer agent is configured for local-only mode","remarks":"The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems.","description":"## Description\n\nMail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail.\n\n## Audit\n\nRun the following script to verify that the MTA is not listening on any non-loopback address ( `127.0.0.1` or `::1`\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_port_list=(\"25\" \"465\" \"587\")\n for l_port_number in \"${a_port_list[@]}\"; do\n if ss -plntu | grep -P -- ':'\"$l_port_number\"'\\b' | grep -Pvq -- '\\h+(127\\.0\\.0\\.1|\\[?::1\\]?):'\"$l_port_number\"'\\b'; then\n a_output2+=(\" - Port \\\"$l_port_number\\\" is listening on a non-loopback network interface\")\n else\n a_output+=(\" - Port \\\"$l_port_number\\\" is not listening on a non-loopback network interface\")\n fi\n done\n if command -v postconf &> /dev/null; then\n l_interfaces=\"$(postconf -n inet_interfaces)\"\n elif command -v exim &> /dev/null; then\n l_interfaces=\"$(exim -bP local_interfaces)\"\n elif command -v sendmail &> /dev/null; then\n l_interfaces=\"$(grep -i \"0 DaemonPortOptions=\" /etc/mail/sendmail.cr | grep -oP '?<=Addr=)[^,+]+')\"\n fi\n if [ -n \"$l_interfaces\" ]; then\n if grep -Pqi '\\ball\\b' <<< \"$l_interfaces\"; then\n a_output2+=(\" - MTA is bound to all network interfaces\")\n elif ! grep -Pqi '(inet_interfaces\\h*=\\h*)?(0\\.0\\.0\\.0|::1|loopback-only)' <<< \"$l_interfaces\"; then\n a_output2+=(\" - MTA is bound to a network interface\" \" \\\"$l_interfaces\\\"\")\n else\n a_output+=(\" - MTA is not bound to a non loopback network interface\" \" \\\"$l_interfaces\\\"\")\n fi\n else\n a_output+=(\" - MTA not detected or in use\")\n fi\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" * Reasons for audit failure *\" \"${a_output2[@]}\" \"\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"0272b330-9c97-541c-a96a-ef586e2067d0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.21_Ensure_mail_transfer_agent_is_configured_for_local-only_mode"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure mail transfer agent is configured for local-only mode","description":"Edit `/etc/postfix/main.cf` and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below:\n\n```bash\ninet_interfaces = loopback-only\n```\n\nRun the following command to restart `postfix`:\n\n```bash\n# systemctl restart postfix\n```\n\n**Note:**\n\n- This recommendation is designed around the postfix mail server.\n- Depending on your environment you may have an alternative MTA installed such as exim4. If this is the case consult the documentation for your installed MTA to configure the recommended state."}],"title":"2.1.21 Ensure mail transfer agent is configured for local-only mode","description":"Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail."},{"uuid":"a07d3652-82fa-543b-bd7d-08a24e1cf3f5","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.1 Configure Server Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.22_Ensure_only_approved_services_are_listening_on_a_network_interface"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.1.22"}],"steps":[{"uuid":"28834d0c-6778-5e9d-9046-8d3f3312b367","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.22_Ensure_only_approved_services_are_listening_on_a_network_interface"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure only approved services are listening on a network interface","remarks":"Services listening on the system pose a potential risk as an attack vector. These services should be reviewed, and if not required, the service should be stopped, and the package containing the service should be removed. If required packages have a dependency, the service should be stopped and masked to reduce the attack surface of the system.","description":"## Description\n\nA network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP.\n\nA listening port is a network port on which an application or process listens on, acting as a communication endpoint.\n\nEach listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations.\n\n## Audit\n\nRun the following command:\n\n```bash\n# ss -plntu\n```\n\nReview the output to ensure:\n\n- All services listed are required on the system and approved by local site policy.\n- Both the port and interface the service is listening on are approved by local site policy.\n- If a listed service is not required:\n\nRemove the package containing the service\n- **- IF -** the service's package is required for a dependency, stop and mask the service and/or socket"},{"uuid":"9e504523-17d5-582f-a793-c1f4f0f46869","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.1.22_Ensure_only_approved_services_are_listening_on_a_network_interface"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure only approved services are listening on a network interface","description":"Run the following commands to stop the service and remove the package containing the service:\n\n```bash\n# systemctl stop .socket .service\n# apt purge\n```\n\n**- OR -** If required packages have a dependency:\n\nRun the following commands to stop and mask the service and socket:\n\n```bash\n# systemctl stop .socket .service\n# systemctl mask .socket .service\n```\n\n**Note:** replace `` with the appropriate service name.\n\nImpact:\n\nThere may be packages that are dependent on the service's package. If the service's package is removed, these dependent packages will be removed as well. Before removing the service's package, review any dependent packages to determine if they are required on the system.\n\n**- IF -** a dependent package is required: stop and mask the `.socket` and `.service` leaving the service's package installed."}],"title":"2.1.22 Ensure only approved services are listening on a network interface","description":"A network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP.\n\nA listening port is a network port on which an application or process listens on, acting as a communication endpoint.\n\nEach listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations."},{"uuid":"5a8379de-96c0-5c58-9dd7-f1b41ee9eed0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.1_Ensure_NIS_Client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.1"}],"steps":[{"uuid":"3775adf7-e148-5122-8715-ce270a4ee5c0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.1_Ensure_NIS_Client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/2/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:2:6"}],"title":"Audit for Ensure NIS Client is not installed","remarks":"The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed.","description":"## Description\n\nThe Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client was used to bind a machine to an NIS server and receive the distributed configuration files.\n\n## Audit\n\nVerify `nis` is not installed. Use the following command to provide the needed information:\n\n```bash\n# dpkg-query -s nis &>/dev/null && echo \"nis is installed\"\n```\n\nNothing should be returned."},{"uuid":"572d8bf3-7eea-5492-afdc-77378ef6ed5b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.1_Ensure_NIS_Client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure NIS Client is not installed","description":"Uninstall `nis`:\n\n```bash\n# apt purge nis\n```\n\nImpact:\n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."}],"title":"2.2.1 Ensure NIS Client is not installed","description":"The Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client was used to bind a machine to an NIS server and receive the distributed configuration files."},{"uuid":"83476335-c971-5c17-8c2d-1f585d0ba138","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.2_Ensure_rsh_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.2"}],"steps":[{"uuid":"c0d088ee-ed61-527a-b10b-cdd04980d655","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.2_Ensure_rsh_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure rsh client is not installed","remarks":"These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the `rsh-client` package removes the clients for `rsh` , `rcp` and `rlogin` .","description":"## Description\n\nThe `rsh-client` package contains the client commands for the rsh services.\n\n## Audit\n\nVerify `rsh-client` is not installed. Use the following command to provide the needed information:\n\n```bash\n# dpkg-query -s rsh-client &>/dev/null && echo \"rsh-client is installed\"\n```\n\nNothing should be returned."},{"uuid":"172638e4-8c6e-5465-a22a-f4b7f4e49a5f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.2_Ensure_rsh_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsh client is not installed","description":"Uninstall `rsh`:\n\n```bash\n# apt purge rsh-client\n```\n\nImpact:\n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."}],"title":"2.2.2 Ensure rsh client is not installed","description":"The `rsh-client` package contains the client commands for the rsh services."},{"uuid":"66b992e3-f4a8-5dfc-87a1-e9f49738a4b1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.3_Ensure_talk_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.3"}],"steps":[{"uuid":"6463c872-723c-5439-a02c-a37b0fd2020d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.3_Ensure_talk_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure talk client is not installed","remarks":"The software presents a security risk as it uses unencrypted protocols for communication.","description":"## Description\n\nThe `talk` software makes it possible for users to send and receive messages across systems through a terminal session. The `talk` client, which allows initialization of talk sessions, is installed by default.\n\n## Audit\n\nVerify `talk` is not installed. The following command may provide the needed information:\n\n```bash\n# dpkg-query -s talk &>/dev/null && echo \"talk is installed\"\n```\n\nNothing should be returned."},{"uuid":"6ea05707-adf1-5082-ad1e-e88193a42b8b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.3_Ensure_talk_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure talk client is not installed","description":"Uninstall `talk`:\n\n```bash\n# apt purge talk\n```\n\nImpact:\n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."}],"title":"2.2.3 Ensure talk client is not installed","description":"The `talk` software makes it possible for users to send and receive messages across systems through a terminal session. The `talk` client, which allows initialization of talk sessions, is installed by default."},{"uuid":"ba3ae9ad-0fc7-5153-91ff-7e6a06cfe875","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.4_Ensure_telnet_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.4"}],"steps":[{"uuid":"3a3cf08d-6513-560c-a005-9aa9e963e819","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.4_Ensure_telnet_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure telnet client is not installed","remarks":"The `telnet` protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The `ssh` package provides an encrypted session and stronger security and is included in most Linux distributions.","description":"## Description\n\nThe `inetutils-telnet` package contains the `telnet` client, which allows users to start connections to other systems via the telnet protocol.\n\n## Audit\n\nVerify `inetutils-telnet` & `telnet` are not installed. Use the following command to provide the needed information:\n\n```bash\n# dpkg-query -l | grep -E 'telnet|inetutils-telnet' &>/dev/null && echo \"telnet is installed\"\n```\n\nNothing should be returned."},{"uuid":"5c4f605e-bbe5-50b0-890d-dedd153f1b2a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.4_Ensure_telnet_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure telnet client is not installed","description":"Run the following commands to uninstall `telnet` & `inetutils-telnet`:\n\n```bash\n# apt purge telnet\n# apt purge inetutils-telnet\n```\n\nImpact:\n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse."}],"title":"2.2.4 Ensure telnet client is not installed","description":"The `inetutils-telnet` package contains the `telnet` client, which allows users to start connections to other systems via the telnet protocol."},{"uuid":"5f0039e6-7b51-540f-a9a5-87c2b7368100","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.5_Ensure_ldap_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.5"}],"steps":[{"uuid":"f29f5771-f84a-5641-bb68-1ec6dd57d3d0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.5_Ensure_ldap_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ldap client is not installed","remarks":"If the system will not need to act as an LDAP client, it is recommended that the software be removed to reduce the potential attack surface.","description":"## Description\n\nThe Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database.\n\n## Audit\n\nVerify that `ldap-utils` is not installed. Use the following command to provide the needed information:\n\n```bash\n# dpkg-query -s ldap-utils &>/dev/null && echo \"ldap-utils is installed\"\n```\n\nNothing should be returned."},{"uuid":"dd367e4b-9024-5efd-84c3-95ec1568af1b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.5_Ensure_ldap_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ldap client is not installed","description":"Uninstall `ldap-utils`:\n\n```bash\n# apt purge ldap-utils\n```\n\nImpact:\n\nRemoving the LDAP client will prevent or inhibit using LDAP for authentication in your environment."}],"title":"2.2.5 Ensure ldap client is not installed","description":"The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."},{"uuid":"769ee2f6-02db-557c-9c1a-b9ed6f4238da","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.2 Configure Client Services"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.6_Ensure_ftp_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.2.6"}],"steps":[{"uuid":"03ace872-3947-5d74-8188-c8f610af42c3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.6_Ensure_ftp_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ftp client is not installed","remarks":"Unless there is a need to run the system using Internet standard File Transfer Protocol (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface.","description":"## Description\n\n`tnftp` an enhanced FTP client, is the user interface to the Internet standard File Transfer Protocol. The program allows a user to transfer files to and from a remote network site.\n\n## Audit\n\nVerify `tnftp` & `ftp` is not installed. Use the following command to provide the needed information:\n\n```bash\n# dpkg-query -l | grep -E 'ftp|tnftp' &>/dev/null && echo \"ftp is installed\"\n```\n\nNothing should be returned."},{"uuid":"ec6f7c67-689a-5385-a59c-dbda77f79f00","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.2.6_Ensure_ftp_client_is_not_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ftp client is not installed","description":"Run the following commands to uninstall `tnftp` & `ftp`:\n\n```bash\n# apt purge ftp\n# apt purge tnftp\n```"}],"title":"2.2.6 Ensure ftp client is not installed","description":"`tnftp` an enhanced FTP client, is the user interface to the Internet standard File Transfer Protocol. The program allows a user to transfer files to and from a remote network site."},{"uuid":"665a4c1b-33b6-50c8-8e81-3cf43dfc839a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.1 Ensure time synchronization is in use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.1.1_Ensure_a_single_time_synchronization_daemon_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.1.1"}],"steps":[{"uuid":"492e6814-7218-59df-bb27-f2f370adba87","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.1.1_Ensure_a_single_time_synchronization_daemon_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure a single time synchronization daemon is in use","remarks":"Time synchronization is important to support time sensitive security mechanisms and ensures log files have consistent time records across the enterprise, which aids in forensic investigations.","description":"## Description\n\nSystem time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them.\n\n**Note:**\n\n- **On virtual systems where host based time synchronization is available consult your virtualization software documentation and verify that host based synchronization is in use and follows local site policy. In this scenario, this section should be skipped**\n- Only **one** time synchronization method should be in use on the system. Configuring multiple time synchronization methods could lead to unexpected or unreliable results\n\n## Audit\n\nOn physical systems, and virtual systems where host based time synchronization is not available.\n\n**One** of the two time synchronization daemons should be available; **`chrony`** or **`systemd-timesyncd`**\n\nRun the following script to verify that a single time synchronization daemon is available on the system:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n service_not_enabled_chk()\n {\n l_out2=\"\"\n if systemctl is-enabled \"$l_service_name\" 2>/dev/null | grep -q 'enabled'; then\n l_out2=\"$l_out2\\n - Daemon: \\\"$l_service_name\\\" is enabled on the system\"\n fi\n if systemctl is-active \"$l_service_name\" 2>/dev/null | grep -q '^active'; then\n l_out2=\"$l_out2\\n - Daemon: \\\"$l_service_name\\\" is active on the system\"\n fi\n } \n l_service_name=\"systemd-timesyncd.service\" # Check systemd-timesyncd daemon\n service_not_enabled_chk\n if [ -n \"$l_out2\" ]; then\n l_timesyncd=\"y\"\n l_out_tsd=\"$l_out2\"\n else\n l_timesyncd=\"n\"\n l_out_tsd=\"\\n - Daemon: \\\"$l_service_name\\\" is not enabled and not active on the system\"\n fi\n l_service_name=\"chrony.service\" # Check chrony\n service_not_enabled_chk\n if [ -n \"$l_out2\" ]; then\n l_chrony=\"y\"\n l_out_chrony=\"$l_out2\"\n else\n l_chrony=\"n\"\n l_out_chrony=\"\\n - Daemon: \\\"$l_service_name\\\" is not enabled and not active on the system\"\n fi\n l_status=\"$l_timesyncd$l_chrony\"\n case \"$l_status\" in\n yy)\n l_output2=\" - More than one time sync daemon is in use on the system$l_out_tsd$l_out_chrony\"\n ;;\n nn)\n l_output2=\" - No time sync daemon is in use on the system$l_out_tsd$l_out_chrony\"\n ;;\n yn|ny)\n l_output=\" - Only one time sync daemon is in use on the system$l_out_tsd$l_out_chrony\"\n ;;\n *)\n l_output2=\" - Unable to determine time sync daemon(s) status\"\n ;;\n esac\n\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\\n\"\n fi\n}\n```\n\n**Note:** Follow the guidance in the subsection for the time synchronization daemon available on the system and skip the other time synchronization daemon subsection."},{"uuid":"ed81e66c-8e56-5a49-94ee-fbac450c9fb0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.1.1_Ensure_a_single_time_synchronization_daemon_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure a single time synchronization daemon is in use","description":"On physical systems, and virtual systems where host based time synchronization is not available.\n\nSelect **one** of the two time synchronization daemons; **`chrony (1)`** or **`systemd-timesyncd (2)`** and following the remediation procedure for the selected daemon.\n\n**Note:** enabling more than one synchronization daemon could lead to unexpected or unreliable results:\n\n- **`chrony`**\n\nRun the following command to install `chrony`:\n\n```bash\n# apt install chrony\n```\n\nRun the following commands to stop and mask the `systemd-timesyncd` daemon:\n\n```bash\n# systemctl stop systemd-timesyncd.service\n\n# systemctl mask systemd-timesyncd.service\n```\n\n**Note:**\n\n- Subsection: **Configure chrony** should be followed\n- Subsection: **Configure systemd-timesyncd** should be skipped\n\n- **`systemd-timesyncd`**\n\nRun the following command to remove the chrony package:\n\n```bash\n# apt purge chrony\n# apt autoremove chrony\n```\n\n**Note:**\n\n- Subsection: **Configure systemd-timesyncd** should be followed\n- Subsection: **Configure chrony** should be skipped"}],"title":"2.3.1.1 Ensure a single time synchronization daemon is in use","description":"System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them.\n\n**Note:**\n\n- **On virtual systems where host based time synchronization is available consult your virtualization software documentation and verify that host based synchronization is in use and follows local site policy. In this scenario, this section should be skipped**\n- Only **one** time synchronization method should be in use on the system. Configuring multiple time synchronization methods could lead to unexpected or unreliable results"},{"uuid":"5687ff19-53d9-5cf5-b186-dd74f2c9c80b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.2 Configure systemd-timesyncd"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.1_Ensure_systemd-timesyncd_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.2.1"}],"steps":[{"uuid":"1d4c1097-b03f-59bc-8d76-d59fc7a7fe67","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.1_Ensure_systemd-timesyncd_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure systemd-timesyncd configured with authorized timeserver","remarks":"Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations","description":"## Description\n\n`NTP=`\n\n- A space-separated list of NTP server host names or IP addresses. During runtime this list is combined with any per-interface NTP servers acquired from systemd-networkd.service(8). systemd-timesyncd will contact all configured system or per-interface servers in turn, until one responds. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. This setting defaults to an empty list.\n\n`FallbackNTP=`\n\n- A space-separated list of NTP server host names or IP addresses to be used as the fallback NTP servers. Any per-interface NTP servers obtained from systemd-networkd.service(8) take precedence over this setting, as do any servers set via NTP= above. This setting is hence only relevant if no other NTP server information is known. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. If this option is not given, a compiled-in list of NTP servers is used.\n\n## Audit\n\nRun the following command to verify the `NTP` **and/or** `FallbackNTP` option is set to local site approved authoritative time server(s):\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); a_parlist=(\"NTP=[^#\\n\\r]+\" \"FallbackNTP=[^#\\n\\r]+\")\n l_systemd_config_file=\"/etc/systemd/timesyncd.conf\" # Main systemd configuration file\n f_config_file_parameter_chk()\n {\n unset A_out; declare -A A_out # Check config file(s) setting\n while read -r l_out; do\n if [ -n \"$l_out\" ]; then\n if [[ $l_out =~ ^\\s*# ]]; then\n l_file=\"${l_out//# /}\"\n else\n l_systemd_parameter=\"$(awk -F= '{print $1}' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_systemd_file_parameter_name l_systemd_file_parameter_value; do\n l_systemd_file_parameter_name=\"${l_systemd_file_parameter_name// /}\"\n l_systemd_file_parameter_value=\"${l_systemd_file_parameter_value// /}\"\n if grep -Piq \"\\b$l_systemd_parameter_value\\b\" <<< \"$l_systemd_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_systemd_parameter_name\\\" is correctly set to \\\"$l_systemd_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_systemd_parameter_name\\\" is incorrectly set to \\\"$l_systemd_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\" and should have a value matching: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Pio -- \"^\\h*$l_systemd_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_systemd_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: \\\"$l_systemd_parameter_name\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n }\n l_systemdanalyze=\"$(readlink -f /bin/systemd-analyze)\"\n while IFS=\"=\" read -r l_systemd_parameter_name l_systemd_parameter_value; do # Assess and check parameters\n l_systemd_parameter_name=\"${l_systemd_parameter_name// /}\"; l_systemd_parameter_value=\"${l_systemd_parameter_value// /}\"\n l_value_out=\"${l_systemd_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\nExample output:\n\n```bash\n- Audit Result:\n ** PASS **\n - \"NTP\" is correctly set to \"time.nist.gov\"\n in \"/etc/systemd/timesyncd.conf.d/60-timesyncd.conf\"\n - \"FallbackNTP\" is correctly set to \"time-a-g.nist.gov\"\n in \"/etc/systemd/timesyncd.conf.d/60-timesyncd.conf\"\n```\n\n**Note:** Please ensure the output for `NTP` and/or `FallbackNTP` is in accordance with local site policy. The timeservers in the example output are provided as an example of possible timeservers and they may not follow local site policy."},{"uuid":"4c30610a-8433-51d3-98b5-808ba12ff9a1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.1_Ensure_systemd-timesyncd_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-timesyncd configured with authorized timeserver","description":"Set `NTP` and/or `FallbackNPT` parameters to local site approved authoritative time server(s) in `/etc/systemd/timesyncd.conf` or a file in `/etc/systemd/timesyncd.conf.d/` ending in `.conf` in the `[Time]` section:\n\nExample file:\n\n```bash\n[Time]\nNTP=time.nist.gov # Uses the generic name for NIST's time servers \nFallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov # Space separated list of NIST time servers\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"NTP=time.nist.gov\" \"FallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov\")\n [ ! -d /etc/systemd/timesyncd.conf.d/ ] && mkdir /etc/systemd/timesyncd.conf.d/\n if grep -Psq -- '^\\h*\\[Time\\]' /etc/systemd/timesyncd.conf.d/60-timesyncd.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n else\n printf '%s\\n' \"\" \"[Time]\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n fi\n}\n```\n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\nRun to following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journald\n```"}],"title":"2.3.2.1 Ensure systemd-timesyncd configured with authorized timeserver","description":"`NTP=`\n\n- A space-separated list of NTP server host names or IP addresses. During runtime this list is combined with any per-interface NTP servers acquired from systemd-networkd.service(8). systemd-timesyncd will contact all configured system or per-interface servers in turn, until one responds. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. This setting defaults to an empty list.\n\n`FallbackNTP=`\n\n- A space-separated list of NTP server host names or IP addresses to be used as the fallback NTP servers. Any per-interface NTP servers obtained from systemd-networkd.service(8) take precedence over this setting, as do any servers set via NTP= above. This setting is hence only relevant if no other NTP server information is known. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. If this option is not given, a compiled-in list of NTP servers is used."},{"uuid":"b06e09f1-1b93-59c5-b992-2bbd28e4f08e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.2 Configure systemd-timesyncd"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.2_Ensure_systemd-timesyncd_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.2.2"}],"steps":[{"uuid":"e10d849a-5fa5-534d-aeee-21b2ac6a1751","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.2_Ensure_systemd-timesyncd_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure systemd-timesyncd is enabled and running","remarks":"systemd-timesyncd needs to be enabled and running in order to synchronize the system to a timeserver.\n\nTime synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations","description":"## Description\n\nsystemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network\n\n## Audit\n\n**- IF -** systemd-timesyncd is in use on the system, run the following commands:\n\nRun the following command to verify that the `systemd-timesyncd` service is enabled:\n\n```bash\n# systemctl is-enabled systemd-timesyncd.service\n\nenabled\n```\n\nRun the following command to verify that the `systemd-timesyncd` service is active:\n\n```bash\n# systemctl is-active systemd-timesyncd.service\n\nactive\n```"},{"uuid":"5c9abcbb-9ec1-51d8-845e-d5e8094afec1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.2.2_Ensure_systemd-timesyncd_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-timesyncd is enabled and running","description":"**- IF -** `systemd-timesyncd` is in use on the system, run the following commands:\n\nRun the following command to unmask `systemd-timesyncd.service`:\n\n```bash\n# systemctl unmask systemd-timesyncd.service\n```\n\nRun the following command to enable and start `systemd-timesyncd.service`:\n\n```bash\n# systemctl --now enable systemd-timesyncd.service\n```\n\n**- OR -**\n\nIf another time synchronization service is in use on the system, run the following command to stop and mask `systemd-timesyncd`:\n\n```bash\n# systemctl --now mask systemd-timesyncd.service\n```"}],"title":"2.3.2.2 Ensure systemd-timesyncd is enabled and running","description":"systemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network"},{"uuid":"228d0415-1391-524c-aa3a-815eb79c2fc6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.3 Configure chrony"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.1_Ensure_chrony_is_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.3.1"}],"steps":[{"uuid":"48d1960a-c578-53f9-8d61-96177f55d0e1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.1_Ensure_chrony_is_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure chrony is configured with authorized timeserver","remarks":"Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations","description":"## Description\n\n- \nserver\n\nThe server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client.\n- This directive can be used multiple times to specify multiple servers.\n- The directive is immediately followed by either the name of the server, or its IP address.\n\n- \npool\n\nThe syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.\n- This directive can be used multiple times to specify multiple pools.\n- All options valid in the server directive can be used in this directive too.\n\n## Audit\n\n**- IF -** `chrony` is in use on the system, run the following script to ensure `chrony` is configured with an authorized timeserver:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_config_files=(\"/etc/chrony/chrony.conf\") \n l_include='(confdir|sourcedir)' l_parameter_name='(server|pool)' l_parameter_value='.+'\n while IFS= read -r l_conf_loc; do\n l_dir=\"\" l_ext=\"\"\n if [ -d \"$l_conf_loc\" ]; then\n l_dir=\"$l_conf_loc\" l_ext=\"*\"\n elif grep -Psq '\\/\\*\\.([^#/\\n\\r]+)?\\h*$' /dev/null)\n fi\n done /dev/null)\n for l_file in \"${a_config_files[@]}\"; do\n l_parameter_line=\"$(grep -Psi '^\\h*'\"$l_parameter_name\"'(\\h+|\\h*:\\h*)'\"$l_parameter_value\"'\\b' \"$l_file\")\"\n [ -n \"$l_parameter_line\" ] && a_output+=(\" - Parameter: \\\"$(tr -d '()' <<< ${l_parameter_name//|/ or })\\\"\" \\\n \" Exists in the file: \\\"$l_file\\\" as:\" \"$l_parameter_line\")\n done\n [ \"${#a_output[@]}\" -le \"0\" ] && a_output2+=(\" - Parameter: \\\"$(tr -d '()' <<< ${l_parameter_name//|/ or })\\\"\" \\\n \" Does not exist in the chrony configuration\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n fi\n}\n```"},{"uuid":"6bcac246-a2f6-5b0e-ba44-cfa962564998","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.1_Ensure_chrony_is_configured_with_authorized_timeserver"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure chrony is configured with authorized timeserver","description":"Edit `/etc/chrony/chrony.conf` or a file ending in `.sources` in `/etc/chrony/sources.d/` and add or edit server or pool lines as appropriate according to local site policy:\n\nEdit the `Chrony` configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy\n\n```bash\n\n```\n\nExample script to add a drop-in configuration for the `pool` directive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"#The maxsources option is unique to the pool directive\" \\\n \"pool time.nist.gov iburst maxsources 4\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\nExample script to add a drop-in configuration for the `server` directive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"server time-a-g.nist.gov iburst\" \"server 132.163.97.3 iburst\" \\\n \"server time-d-b.nist.gov iburst\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\nRun the following command to reload the `chronyd` config:\n\n```bash\n# systemctl reload-or-restart chronyd\n```"}],"title":"2.3.3.1 Ensure chrony is configured with authorized timeserver","description":"- \nserver\n\nThe server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client.\n- This directive can be used multiple times to specify multiple servers.\n- The directive is immediately followed by either the name of the server, or its IP address.\n\n- \npool\n\nThe syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.\n- This directive can be used multiple times to specify multiple pools.\n- All options valid in the server directive can be used in this directive too."},{"uuid":"93e2d6b7-f8ef-5b43-85fb-5f0c0fa072fd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.3 Configure chrony"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.2_Ensure_chrony_is_running_as_user__chrony"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.3.2"}],"steps":[{"uuid":"92c34276-bc3e-5e7b-b351-429bd00fb4cb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.2_Ensure_chrony_is_running_as_user__chrony"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure chrony is running as user _chrony","remarks":"The `chronyd` service should run with only the required privlidges","description":"## Description\n\nThe `chrony` package is installed with a dedicated user account `_chrony`. This account is granted the access required by the `chronyd` service\n\n## Audit\n\n**- IF -** `chrony` is in use on the system, run the following command to verify the `chronyd` service is being run as the `_chrony` user:\n\n```bash\n# ps -ef | awk '(/[c]hronyd/ && $1!=\"_chrony\") { print $1 }'\n```\n\nNothing should be returned"},{"uuid":"c8722469-9530-5bd8-81c7-8d29bb708e53","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.2_Ensure_chrony_is_running_as_user__chrony"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure chrony is running as user _chrony","description":"Add or edit the `user` line to `/etc/chrony/chrony.conf` or a file ending in `.conf` in `/etc/chrony/conf.d/`:\n\n```bash\nuser _chrony\n```\n\n**- OR -**\n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony` from the system:\n\n```bash\n# apt purge chrony\n# apt autoremove chrony\n```"}],"title":"2.3.3.2 Ensure chrony is running as user _chrony","description":"The `chrony` package is installed with a dedicated user account `_chrony`. This account is granted the access required by the `chronyd` service"},{"uuid":"4507cd76-7a71-5873-a045-7abe11d03297","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.3 Configure Time Synchronization > 2.3.3 Configure chrony"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.3_Ensure_chrony_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.3.3.3"}],"steps":[{"uuid":"b793f672-45bf-5481-a5ad-cdf56e56485f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.3_Ensure_chrony_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:1"}],"title":"Audit for Ensure chrony is enabled and running","remarks":"chrony needs to be enabled and running in order to synchronize the system to a timeserver.\n\nTime synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations","description":"## Description\n\nchrony is a daemon for synchronizing the system clock across the network\n\n## Audit\n\n**- IF -** chrony is in use on the system, run the following commands:\n\nRun the following command to verify that the `chrony` service is enabled:\n\n```bash\n# systemctl is-enabled chrony.service\n\nenabled\n```\n\nRun the following command to verify that the `chrony` service is active:\n\n```bash\n# systemctl is-active chrony.service\n\nactive\n```"},{"uuid":"245d6d0f-3df5-5498-bdc4-28c047314f98","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.3.3.3_Ensure_chrony_is_enabled_and_running"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure chrony is enabled and running","description":"**- IF -** `chrony` is in use on the system, run the following commands:\n\nRun the following command to unmask `chrony.service`:\n\n```bash\n# systemctl unmask chrony.service\n```\n\nRun the following command to enable and start `chrony.service`:\n\n```bash\n# systemctl --now enable chrony.service\n```\n\n**- OR -**\n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony`:\n\n```bash\n# apt purge chrony\n# apt autoremove chrony\n```"}],"title":"2.3.3.3 Ensure chrony is enabled and running","description":"chrony is a daemon for synchronizing the system clock across the network"},{"uuid":"24e35835-53db-529f-8dad-f21fa8c3f4b2","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.1_Ensure_cron_daemon_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.1"}],"steps":[{"uuid":"26694edf-94f6-587e-bf60-6e627e12fdc5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.1_Ensure_cron_daemon_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure cron daemon is enabled and active","remarks":"While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run, and `cron` is used to execute them.","description":"## Description\n\nThe `cron` daemon is used to execute batch jobs on the system.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command to verify `cron` is enabled:\n\n```bash\n# systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $2}'\n\nenabled\n```\n\nRun the following command to verify that `cron` is active:\n\n```bash\n# systemctl list-units | awk '$1~/^crond?\\.service/{print $3}'\n\nactive\n```"},{"uuid":"0b78350f-3199-5340-8efa-0d9f746b74c4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.1_Ensure_cron_daemon_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure cron daemon is enabled and active","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to unmask, enable, and start `cron`:\n\n```bash\n# systemctl unmask \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n# systemctl --now enable \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n```"}],"title":"2.4.1.1 Ensure cron daemon is enabled and active","description":"The `cron` daemon is used to execute batch jobs on the system."},{"uuid":"b4ec7446-07c6-5284-8021-ff718e2524e6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.2_Ensure_permissions_on_etccrontab_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.2"}],"steps":[{"uuid":"6bb370a2-9981-545a-9e4f-f31a246f2c16","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.2_Ensure_permissions_on_etccrontab_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/crontab are configured","remarks":"This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access.","description":"## Description\n\nThe `/etc/crontab` file is used by `cron` to control its own jobs. The commands in this item make sure that root is the user and group owner of the file and that only the owner can access the file.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other` :\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/crontab\n\nAccess: (600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"f7a1ab37-19a7-5038-b44c-e1e85c2d1122","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.2_Ensure_permissions_on_etccrontab_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/crontab are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on `/etc/crontab`:\n\n```bash\n# chown root:root /etc/crontab\n# chmod og-rwx /etc/crontab\n```"}],"title":"2.4.1.2 Ensure permissions on /etc/crontab are configured","description":"The `/etc/crontab` file is used by `cron` to control its own jobs. The commands in this item make sure that root is the user and group owner of the file and that only the owner can access the file."},{"uuid":"c61ff831-d579-5af7-b70d-aae19635e203","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.3_Ensure_permissions_on_etccron.hourly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.3"}],"steps":[{"uuid":"ffd54385-61fa-5f37-9d7e-6939c4430580","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.3_Ensure_permissions_on_etccron.hourly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/cron.hourly are configured","remarks":"Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.","description":"## Description\n\nThis directory contains system `cron` jobs that need to run on an hourly basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other`:\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/cron.hourly/\n\nAccess: (700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"744293c7-444f-57dc-bdfd-9f26cc85d9c7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.3_Ensure_permissions_on_etccron.hourly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/cron.hourly are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on the `/etc/cron.hourly` directory:\n\n```bash\n# chown root:root /etc/cron.hourly/\n# chmod og-rwx /etc/cron.hourly/\n```"}],"title":"2.4.1.3 Ensure permissions on /etc/cron.hourly are configured","description":"This directory contains system `cron` jobs that need to run on an hourly basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"uuid":"f05a0bce-af8d-5ca9-a7c0-57716babbced","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.4_Ensure_permissions_on_etccron.daily_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.4"}],"steps":[{"uuid":"8c1f5d68-dc29-50a0-b4e2-ce9d2df542e7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.4_Ensure_permissions_on_etccron.daily_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/cron.daily are configured","remarks":"Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.","description":"## Description\n\nThe `/etc/cron.daily` directory contains system cron jobs that need to run on a daily basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other`:\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/cron.daily/\n\nAccess: (700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"4e03161b-801f-5cd8-b03a-b6f56845c025","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.4_Ensure_permissions_on_etccron.daily_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/cron.daily are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on the `/etc/cron.daily` directory:\n\n```bash\n# chown root:root /etc/cron.daily/\n# chmod og-rwx /etc/cron.daily/\n```"}],"title":"2.4.1.4 Ensure permissions on /etc/cron.daily are configured","description":"The `/etc/cron.daily` directory contains system cron jobs that need to run on a daily basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"uuid":"d47496e4-3e32-541e-9d1e-4b86e0f4baed","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.5_Ensure_permissions_on_etccron.weekly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.5"}],"steps":[{"uuid":"c9d70223-3374-5c04-b4a4-5df9263ac267","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.5_Ensure_permissions_on_etccron.weekly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/cron.weekly are configured","remarks":"Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.","description":"## Description\n\nThe `/etc/cron.weekly` directory contains system cron jobs that need to run on a weekly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other`:\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/cron.weekly/\n\nAccess: (700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"25c8eb23-2876-5334-b6e3-891d72be39c7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.5_Ensure_permissions_on_etccron.weekly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/cron.weekly are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on the `/etc/cron.weekly` directory:\n\n```bash\n# chown root:root /etc/cron.weekly/\n# chmod og-rwx /etc/cron.weekly/\n```"}],"title":"2.4.1.5 Ensure permissions on /etc/cron.weekly are configured","description":"The `/etc/cron.weekly` directory contains system cron jobs that need to run on a weekly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"uuid":"f048b00f-7697-5686-b26c-47baa3fb2963","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.6_Ensure_permissions_on_etccron.monthly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.6"}],"steps":[{"uuid":"2892b0f7-b96b-5244-b6ec-5baaa5fa93a4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.6_Ensure_permissions_on_etccron.monthly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/cron.monthly are configured","remarks":"Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.","description":"## Description\n\nThe `/etc/cron.monthly` directory contains system cron jobs that need to run on a monthly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other`:\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/cron.monthly/\n\nAccess: (700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"9b09dc3d-1cda-574f-bbd4-ea0770b38468","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.6_Ensure_permissions_on_etccron.monthly_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/cron.monthly are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on the `/etc/cron.monthly` directory:\n\n```bash\n# chown root:root /etc/cron.monthly/\n# chmod og-rwx /etc/cron.monthly/\n```"}],"title":"2.4.1.6 Ensure permissions on /etc/cron.monthly are configured","description":"The `/etc/cron.monthly` directory contains system cron jobs that need to run on a monthly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"uuid":"2b97e19f-9bd6-59c6-8f05-81972f4574e0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.7_Ensure_permissions_on_etccron.d_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.7"}],"steps":[{"uuid":"5d31b33e-280e-5806-b3da-3e7ae3e420f4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.7_Ensure_permissions_on_etccron.d_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/cron.d are configured","remarks":"Granting write access to this directory for non-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls.","description":"## Description\n\nThe `/etc/cron.d` directory contains system `cron` jobs that need to run in a similar manner to the hourly, daily weekly and monthly jobs from `/etc/crontab`, but require more granular control as to when they run. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory.\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command and verify `Uid` and `Gid` are both `0/root` and `Access` does not grant permissions to `group` or `other`:\n\n```bash\n# stat -Lc 'Access: (%a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/cron.d/\n\nAccess: (700/drwx------) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"8f38f381-8877-5972-979e-c37c993c1694","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.7_Ensure_permissions_on_etccron.d_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/cron.d are configured","description":"**- IF -** cron is installed on the system:\n\nRun the following commands to set ownership and permissions on the `/etc/cron.d` directory:\n\n```bash\n# chown root:root /etc/cron.d/\n# chmod og-rwx /etc/cron.d/\n```"}],"title":"2.4.1.7 Ensure permissions on /etc/cron.d are configured","description":"The `/etc/cron.d` directory contains system `cron` jobs that need to run in a similar manner to the hourly, daily weekly and monthly jobs from `/etc/crontab`, but require more granular control as to when they run. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"uuid":"5104e873-2458-511d-87f3-c9429d8fd6d0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.1 Configure cron"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.8_Ensure_crontab_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.1.8"}],"steps":[{"uuid":"b564d621-b7d6-5dfb-b537-b23428b403ee","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.8_Ensure_crontab_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure crontab is restricted to authorized users","remarks":"On many systems, only the system administrator is authorized to schedule `cron` jobs. Using the `cron.allow` file to control who can run `cron` jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.","description":"## Description\n\n`crontab` is the program used to install, deinstall, or list the tables used to drive the cron daemon. Each user can have their own crontab, and though these are files in `/var/spool/cron/crontabs`, they are not intended to be edited directly.\n\nIf the `/etc/cron.allow` file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the `/etc/cron.allow` file does not exist but the `/etc/cron.deny` file does exist, then you must not be listed in the `/etc/cron.deny` file in order to use this command.\n\nIf neither of these files exists, then depending on site-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command.\n\nIf both files exist then `/etc/cron.allow` takes precedence. Which means that `/etc/cron.deny` is not considered and your user must be listed in `/etc/cron.allow` in order to be able to use the crontab.\n\nRegardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.\n\nThe files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, must be either world-readable, or readable by group `crontab`. If they are not, then cron will deny access to all users until the permissions are fixed.\n\nThere is one file for each user's crontab under the `/var/spool/cron/crontabs` directory. Users are not allowed to edit the files under that directory directly to ensure that only users allowed by the system to run periodic tasks can add them, and only syntactically correct crontabs will be written there. This is enforced by having the directory writable only by the `crontab` group and configuring crontab command with the setgid bid set for that specific group.\n\n**Note:**\n\n- Even though a given user is not listed in `cron.allow`, cron jobs can still be run as that user\n- The files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, only controls administrative access to the crontab command for scheduling and modifying cron jobs\n\n## Audit\n\n**- IF -** cron is installed on the system:\n\nRun the following command to verify `/etc/cron.allow`:\n\n- Exists\n- Is mode `0640` or more restrictive\n- Is owned by the user `root`\n- Is group owned by the group `root` **- OR -** the group `crontab`\n\n```bash\n# stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/cron.allow\n```\n\nVerify the returned value is:\n\n```bash\nAccess: (640/-rw-r-----) Owner: (root) Group: (root)\n- OR -\nAccess: (640/-rw-r-----) Owner: (root) Group: (crontab)\n```\n\nRun the following command to verify either `cron.deny` doesn't exist or is:\n\n- Mode `0640` or more restrictive\n- Owned by the user `root`\n- Is group owned by the group `root` **- OR -** the group `crontab`\n\n```bash\n# [ -e \"/etc/cron.deny\" ] && stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/cron.deny\n```\n\nVerify either nothing is returned **- OR -** returned value is one of the following:\n\n```bash\nAccess: (640/-rw-r-----) Owner: (root) Group: (root)\n- OR -\nAccess: (640/-rw-r-----) Owner: (root) Group: (crontab)\n```\n\n**Note:** On systems where cron is configured to use the group `crontab`, if the group `crontab` is not set as the owner of `cron.allow`, then cron will deny access to all users and you will see an error similar to:\n\n```bash\nYou () are not allowed to use this program (crontab)\nSee crontab(1) for more information\n```"},{"uuid":"f50e4b6d-7d9b-5403-bc57-143174d511af","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.1.8_Ensure_crontab_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure crontab is restricted to authorized users","description":"**- IF -** cron is installed on the system:\n\nRun the following script to:\n\n- Create `/etc/cron.allow` if it doesn't exist\n- Change owner to user `root`\n- Change group owner to group `root` **- OR -** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n [ ! -e \"/etc/cron.deny\" ] && touch /etc/cron.allow\n chmod u-x,g-wx,o-rwx /etc/cron.allow\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.allow\n else\n chown root:root /etc/cron.allow\n fi\n}\n```\n\n**- IF -** `/etc/cron.deny` exists, run the following script to:\n\n- Change owner to user `root`\n- Change group owner to group `root` **- OR -** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n if [ -e \"/etc/cron.deny\" ]; then\n chmod u-x,g-wx,o-rwx /etc/cron.deny\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.deny\n else\n chown root:root /etc/cron.deny\n fi\n fi\n}\n```\n\n**Note:** On systems where cron is configured to use the group `crontab`, if the group `crontab` is not set as the owner of `cron.allow`, then cron will deny access to all users and you will see an error similar to:\n\n```bash\nYou () are not allowed to use this program (crontab)\nSee crontab(1) for more information\n```"}],"title":"2.4.1.8 Ensure crontab is restricted to authorized users","description":"`crontab` is the program used to install, deinstall, or list the tables used to drive the cron daemon. Each user can have their own crontab, and though these are files in `/var/spool/cron/crontabs`, they are not intended to be edited directly.\n\nIf the `/etc/cron.allow` file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the `/etc/cron.allow` file does not exist but the `/etc/cron.deny` file does exist, then you must not be listed in the `/etc/cron.deny` file in order to use this command.\n\nIf neither of these files exists, then depending on site-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command.\n\nIf both files exist then `/etc/cron.allow` takes precedence. Which means that `/etc/cron.deny` is not considered and your user must be listed in `/etc/cron.allow` in order to be able to use the crontab.\n\nRegardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.\n\nThe files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, must be either world-readable, or readable by group `crontab`. If they are not, then cron will deny access to all users until the permissions are fixed.\n\nThere is one file for each user's crontab under the `/var/spool/cron/crontabs` directory. Users are not allowed to edit the files under that directory directly to ensure that only users allowed by the system to run periodic tasks can add them, and only syntactically correct crontabs will be written there. This is enforced by having the directory writable only by the `crontab` group and configuring crontab command with the setgid bid set for that specific group.\n\n**Note:**\n\n- Even though a given user is not listed in `cron.allow`, cron jobs can still be run as that user\n- The files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, only controls administrative access to the crontab command for scheduling and modifying cron jobs"},{"uuid":"cf141e8b-f62d-5e7a-a4b7-c7962b668fb7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Services"},{"ns":"https://cisecurity.org/ns","name":"group","value":"2 Services > 2.4 Job Schedulers > 2.4.2 Configure at"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.2.1_Ensure_at_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"2.4.2.1"}],"steps":[{"uuid":"5993fc63-d010-5fc9-b7a0-5c52aa6eefec","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.2.1_Ensure_at_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure at is restricted to authorized users","remarks":"On many systems, only the system administrator is authorized to schedule `at` jobs. Using the `at.allow` file to control who can run `at` jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files.","description":"## Description\n\n`at` allows fairly complex time specifications, extending the POSIX.2 standard. It accepts times of the form HH:MM to run a job at a specific time of day. (If that time is already past, the next day is assumed.) You may also specify midnight, noon, or teatime (4pm) and you can have a time-of-day suffixed with AM or PM for running in the morning or the evening. You can also say what day the job will be run, by giving a date in the form month-name day with an optional year, or giving a date of the form MMDD[CC]YY, MM/DD/[CC]YY, DD.MM.[CC]YY or [CC]YY-MM-DD. The specification of a date must follow the specification of the time of day. You can also give times like now + count time-units, where the time-units can be minutes, hours, days, or weeks and you can tell at to run the job today by suffixing the time with today and to run the job tomorrow by suffixing the time with tomorrow.\n\nThe `/etc/at.allow` and `/etc/at.deny` files determine which user can submit commands for later execution via at or batch. The format of the files is a list of usernames, one on each line. Whitespace is not permitted. If the file `/etc/at.allow` exists, only usernames mentioned in it are allowed to use at. If `/etc/at.allow` does not exist, `/etc/at.deny` is checked, every username not mentioned in it is then allowed to use at. An empty `/etc/at.deny` means that every user may use at. If neither file exists, only the superuser is allowed to use at.\n\n## Audit\n\n**- IF -** at is installed on the system:\n\nRun the following command to verify `/etc/at.allow`:\n\n- Exists\n- Is mode `0640` or more restrictive\n- Is owned by the user `root`\n- Is group owned by the group `daemon` or group `root`\n\n```bash\n# stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.allow\n\nAccess: (640/-rw-r-----) Owner: (root) Group: (daemon)\n-OR-\nAccess: (640/-rw-r-----) Owner: (root) Group: (root)\n```\n\nVerify mode is `640` or more restrictive, owner is `root`, and group is `daemon` or `root`\n\nRun the following command to verify `at.deny` doesn't exist, **-OR-** is:\n\n- Mode `0640` or more restrictive\n- Owned by the user `root`\n- Group owned by the group `daemon` or group `root`\n\n```bash\n# [ -e \"/etc/at.deny\" ] && stat -Lc 'Access: (%a/%A) Owner: (%U) Group: (%G)' /etc/at.deny\n\nAccess: (640/-rw-r-----) Owner: (root) Group: (daemon)\n-OR-\nAccess: (640/-rw-r-----) Owner: (root) Group: (root)\n-OR-\nNothing is returned\n```\n\nIf a value is returned, verify mode is 640 or more restrictive, owner is `root`, and group is `daemon` or `root`"},{"uuid":"9519feb0-56fc-5416-a4b2-2dd7a1db6650","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_2.4.2.1_Ensure_at_is_restricted_to_authorized_users"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure at is restricted to authorized users","description":"**- IF -** at is installed on the system:\n\nRun the following script to:\n\n- `/etc/at.allow`:\n\nCreate the file if it doesn't exist\n- Change owner or user `root`\n- If group `daemon` exists, change to group `daemon`, else change group to `root`\n- Change mode to `640` or more restrictive\n\n- **- IF -** `/etc/at.deny` exists:\n\nChange owner or user `root`\n- If group `daemon` exists, change to group `daemon`, else change group to `root`\n- Change mode to `640` or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n grep -Pq -- '^daemon\\b' /etc/group && l_group=\"daemon\" || l_group=\"root\"\n [ ! -e \"/etc/at.allow\" ] && touch /etc/at.allow\n chown root:\"$l_group\" /etc/at.allow\n chmod u-x,g-wx,o-rwx /etc/at.allow\n [ -e \"/etc/at.deny\" ] && chown root:\"$l_group\" /etc/at.deny\n [ -e \"/etc/at.deny\" ] && chmod u-x,g-wx,o-rwx /etc/at.deny\n}\n```"}],"title":"2.4.2.1 Ensure at is restricted to authorized users","description":"`at` allows fairly complex time specifications, extending the POSIX.2 standard. It accepts times of the form HH:MM to run a job at a specific time of day. (If that time is already past, the next day is assumed.) You may also specify midnight, noon, or teatime (4pm) and you can have a time-of-day suffixed with AM or PM for running in the morning or the evening. You can also say what day the job will be run, by giving a date in the form month-name day with an optional year, or giving a date of the form MMDD[CC]YY, MM/DD/[CC]YY, DD.MM.[CC]YY or [CC]YY-MM-DD. The specification of a date must follow the specification of the time of day. You can also give times like now + count time-units, where the time-units can be minutes, hours, days, or weeks and you can tell at to run the job today by suffixing the time with today and to run the job tomorrow by suffixing the time with tomorrow.\n\nThe `/etc/at.allow` and `/etc/at.deny` files determine which user can submit commands for later execution via at or batch. The format of the files is a list of usernames, one on each line. Whitespace is not permitted. If the file `/etc/at.allow` exists, only usernames mentioned in it are allowed to use at. If `/etc/at.allow` does not exist, `/etc/at.deny` is checked, every username not mentioned in it is then allowed to use at. An empty `/etc/at.deny` means that every user may use at. If neither file exists, only the superuser is allowed to use at."},{"uuid":"418cd513-06c2-5768-a218-4cdb5464834c","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.1 Configure Network Devices"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.1_Ensure_IPv6_status_is_identified"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.1.1"}],"steps":[{"uuid":"e44a2f1d-523a-5ad2-b819-89a5ec016664","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.1_Ensure_IPv6_status_is_identified"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure IPv6 status is identified","remarks":"IETF RFC 4038 recommends that applications are built with an assumption of dual stack. It is recommended that IPv6 be enabled and configured in accordance with Benchmark recommendations.\n\n**- IF -** dual stack and IPv6 are not used in your environment, IPv6 may be disabled to reduce the attack surface of the system, and recommendations pertaining to IPv6 can be skipped.\n\n**Note:** It is recommended that IPv6 be enabled and configured unless this is against local site policy","description":"## Description\n\nInternet Protocol Version 6 (IPv6) is the most recent version of Internet Protocol (IP). It's designed to supply IP addressing and additional security to support the predicted growth of connected devices. IPv6 is based on 128-bit addressing and can support 340 undecillion, which is 340,282,366,920,938,463,463,374,607,431,768,211,456 unique addresses.\n\nFeatures of IPv6\n\n- Hierarchical addressing and routing infrastructure\n- Statefull and Stateless configuration\n- Support for quality of service (QoS)\n- An ideal protocol for neighboring node interaction\n\n## Audit\n\nRun the following script to identify if IPv6 is enabled on the system:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_output=\"- IPv6 is not enabled\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_output=\"- IPv6 is not enabled\"\n fi\n [ -z \"$l_output\" ] && l_output=\"- IPv6 is enabled\"\n echo -e \"\\n$l_output\\n\"\n}\n```"},{"uuid":"310f3641-649b-5ccb-b74f-468bbeecf959","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.1_Ensure_IPv6_status_is_identified"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure IPv6 status is identified","description":"Enable or disable IPv6 in accordance with system requirements and local site policy\n\nImpact:\n\nIETF RFC 4038 recommends that applications are built with an assumption of dual stack.\n\nWhen enabled, IPv6 will require additional configuration to reduce risk to the system."}],"title":"3.1.1 Ensure IPv6 status is identified","description":"Internet Protocol Version 6 (IPv6) is the most recent version of Internet Protocol (IP). It's designed to supply IP addressing and additional security to support the predicted growth of connected devices. IPv6 is based on 128-bit addressing and can support 340 undecillion, which is 340,282,366,920,938,463,463,374,607,431,768,211,456 unique addresses.\n\nFeatures of IPv6\n\n- Hierarchical addressing and routing infrastructure\n- Statefull and Stateless configuration\n- Support for quality of service (QoS)\n- An ideal protocol for neighboring node interaction"},{"uuid":"3ef3bf18-df30-5dda-8694-9f7eff61945c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.1 Configure Network Devices"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.2_Ensure_wireless_interfaces_are_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.1.2"}],"steps":[{"uuid":"2bf588d2-be27-5f25-ae0c-3ddfcb99f224","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.2_Ensure_wireless_interfaces_are_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/15/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/15/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:15:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:15:5"}],"title":"Audit for Ensure wireless interfaces are disabled","remarks":"**-IF-** wireless is not to be used, wireless devices can be disabled to reduce the potential attack surface.","description":"## Description\n\nWireless networking is used when wired networks are unavailable.\n\n## Audit\n\nRun the following script to verify no wireless interfaces are active on the system:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n module_chk()\n {\n # Check how module will be loaded\n l_loadable=\"$(modprobe -n -v \"$l_mname\")\"\n if grep -Pq -- '^\\h*install \\/bin\\/(true|false)' /dev/null 2>&1; then\n l_output=\"$l_output\\n - module: \\\"$l_mname\\\" is not loaded\"\n else\n l_output2=\"$l_output2\\n - module: \\\"$l_mname\\\" is loaded\"\n fi\n # Check if the module is deny listed\n if modprobe --showconfig | grep -Pq -- \"^\\h*blacklist\\h+$l_mname\\b\"; then\n l_output=\"$l_output\\n - module: \\\"$l_mname\\\" is deny listed in: \\\"$(grep -Pl -- \"^\\h*blacklist\\h+$l_mname\\b\" /etc/modprobe.d/*)\\\"\"\n else\n l_output2=\"$l_output2\\n - module: \\\"$l_mname\\\" is not deny listed\"\n fi\n }\n if [ -n \"$(find /sys/class/net/*/ -type d -name wireless)\" ]; then\n l_dname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename \"$(readlink -f \"$driverdir\"/device/driver/module)\";done | sort -u)\n for l_mname in $l_dname; do\n module_chk\n done\n fi\n # Report results. If no failures output in l_output2, we pass\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\"\n if [ -z \"$l_output\" ]; then\n echo -e \"\\n - System has no wireless NICs installed\"\n else\n echo -e \"\\n$l_output\\n\"\n fi\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - Reason(s) for audit failure:\\n$l_output2\\n\"\n [ -n \"$l_output\" ] && echo -e \"\\n- Correctly set:\\n$l_output\\n\"\n fi\n}\n```"},{"uuid":"5ff9db4e-fa5e-563f-a267-4ed22407a699","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.2_Ensure_wireless_interfaces_are_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure wireless interfaces are disabled","description":"Run the following script to disable any wireless interfaces:\n\n```bash\n#!/usr/bin/env bash\n\n{\n module_fix()\n {\n if ! modprobe -n -v \"$l_mname\" | grep -P -- '^\\h*install \\/bin\\/(true|false)'; then\n echo -e \" - setting module: \\\"$l_mname\\\" to be un-loadable\"\n echo -e \"install $l_mname /bin/false\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n if lsmod | grep \"$l_mname\" > /dev/null 2>&1; then\n echo -e \" - unloading module \\\"$l_mname\\\"\"\n modprobe -r \"$l_mname\"\n fi\n if ! grep -Pq -- \"^\\h*blacklist\\h+$l_mname\\b\" /etc/modprobe.d/*; then\n echo -e \" - deny listing \\\"$l_mname\\\"\"\n echo -e \"blacklist $l_mname\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n }\n if [ -n \"$(find /sys/class/net/*/ -type d -name wireless)\" ]; then\n l_dname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename \"$(readlink -f \"$driverdir\"/device/driver/module)\";done | sort -u)\n for l_mname in $l_dname; do\n module_fix\n done\n fi\n}\n```\n\nImpact:\n\nMany if not all laptop workstations and some desktop workstations will connect via wireless requiring these interfaces be enabled."}],"title":"3.1.2 Ensure wireless interfaces are disabled","description":"Wireless networking is used when wired networks are unavailable."},{"uuid":"b502b3ae-6adf-591b-86d8-6129c664c064","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.1 Configure Network Devices"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.3_Ensure_bluetooth_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.1.3"}],"steps":[{"uuid":"a664fbd3-c084-56c2-8b79-2d3723b0a572","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.3_Ensure_bluetooth_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure bluetooth services are not in use","remarks":"An attacker may be able to find a way to access or corrupt your data. One example of this type of activity is `bluesnarfing`, which refers to attackers using a Bluetooth connection to steal information off of your Bluetooth device. Also, viruses or other malicious code can take advantage of Bluetooth technology to infect other devices. If you are infected, your data may be corrupted, compromised, stolen, or lost.","description":"## Description\n\nBluetooth is a short-range wireless technology standard that is used for exchanging data between devices over short distances. It employs UHF radio waves in the ISM bands, from 2.402 GHz to 2.48 GHz. It is mainly used as an alternative to wire connections.\n\n## Audit\n\nRun the following command to verify the `bluez` package is not installed:\n\n```bash\n# dpkg-query -s bluez &>/dev/null && echo \"bluez is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\n**- IF -** the `bluez` package is required as a dependency:\n\nRun the following command to verify `bluetooth.service` is not enabled:\n\n```bash\n# systemctl is-enabled bluetooth.service 2>/dev/null | grep 'enabled'\n```\n\nNothing should be returned.\n\nRun the following command to verify `bluetooth.service` is not active:\n\n```bash\n# systemctl is-active bluetooth.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned.\n\n**Note:** If the package is required for a dependency\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy"},{"uuid":"cfaedfab-1b5e-5982-8e73-45351221b546","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.1.3_Ensure_bluetooth_services_are_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure bluetooth services are not in use","description":"Run the following commands to stop `bluetooth.service`, and remove the `bluez` package:\n\n```bash\n# systemctl stop bluetooth.service\n# apt purge bluez\n```\n\n**- OR -**\n\n**- IF -** the `bluez` package is required as a dependency:\n\nRun the following commands to stop and mask `bluetooth.service`:\n\n```bash\n# systemctl stop bluetooth.service\n# systemctl mask bluetooth.service\n```\n\n**Note:** A reboot may be required\n\nImpact:\n\nMany personal electronic devices (PEDs) use Bluetooth technology. For example, you may be able to operate your computer with a wireless keyboard. Disabling Bluetooth will prevent these devices from connecting to the system.\n\nThere may be packages that are dependent on the `bluez` package. If the `bluez` package is removed, these dependent packages will be removed as well. Before removing the `bluez` package, review any dependent packages to determine if they are required on the system.\n\n**-IF-** a dependent package is required: stop and mask `bluetooth.service` leaving the `bluez` package installed."}],"title":"3.1.3 Ensure bluetooth services are not in use","description":"Bluetooth is a short-range wireless technology standard that is used for exchanging data between devices over short distances. It employs UHF radio waves in the ISM bands, from 2.402 GHz to 2.48 GHz. It is mainly used as an alternative to wire connections."},{"uuid":"ace6dbc8-4bc9-5eb0-b4d6-295efcb0d8c0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.2 Configure Network Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.1_Ensure_dccp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.2.1"}],"steps":[{"uuid":"efba9e73-0eed-58c2-9e15-5c0edd850356","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.1_Ensure_dccp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure dccp kernel module is not available","remarks":"**- IF -** the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.","description":"## Description\n\nThe Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `dccp` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `dccp` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"dccp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"fed22af3-0338-5aa0-81cc-d9fe6bc53dc6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.1_Ensure_dccp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure dccp kernel module is not available","description":"Run the following script to unload and disable the `dccp` module:\n\n**- IF -** the `dccp` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install dccp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist dccp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r dccp 2>/dev/null; rmmod dccp 2>/dev/null` to remove `dccp` from the kernel\n\n**- IF -** the `dccp` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"dccp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"3.2.1 Ensure dccp kernel module is not available","description":"The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery."},{"uuid":"88f03ccc-83f6-5fed-a98a-aaa6410c9db7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.2 Configure Network Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.2_Ensure_tipc_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.2.2"}],"steps":[{"uuid":"94befab5-3a17-5699-8acc-fa826d5ed942","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.2_Ensure_tipc_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure tipc kernel module is not available","remarks":"**- IF -** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.","description":"## Description\n\nThe Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `tipc` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `tipc` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"tipc\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"7e4cd06c-e757-589d-a54e-d4d9fff7a359","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.2_Ensure_tipc_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure tipc kernel module is not available","description":"Run the following script to unload and disable the `tipc` module:\n\n**- IF -** the `tipc` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install tipc /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist tipc` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r tipc 2>/dev/null; rmmod tipc 2>/dev/null` to remove `tipc` from the kernel\n\n**- IF -** the `tipc` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"tipc\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"3.2.2 Ensure tipc kernel module is not available","description":"The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes."},{"uuid":"be369f0c-f8f2-5bda-a927-e7f106c30274","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.2 Configure Network Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.3_Ensure_rds_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.2.3"}],"steps":[{"uuid":"2ff6dcf3-3b51-5bca-b91a-79adf638bfe3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.3_Ensure_rds_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure rds kernel module is not available","remarks":"**- IF -** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.","description":"## Description\n\nThe Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `rds` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `rds` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"rds\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"a084d4f6-4588-5300-9cf3-84a0753cfdee","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.3_Ensure_rds_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rds kernel module is not available","description":"Run the following script to unload and disable the `rds` module:\n\n**- IF -** the `rds` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install rds /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist rds` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r rds 2>/dev/null; rmmod rds 2>/dev/null` to remove `rds` from the kernel\n\n**- IF -** the `rds` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"rds\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"3.2.3 Ensure rds kernel module is not available","description":"The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation."},{"uuid":"887e7757-ca76-59e7-9759-7bafaa982504","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.2 Configure Network Kernel Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.4_Ensure_sctp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.2.4"}],"steps":[{"uuid":"142bf5d0-8b8c-5064-9cd4-4eb26549b898","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.4_Ensure_sctp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure sctp kernel module is not available","remarks":"**- IF -** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface.","description":"## Description\n\nThe Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP.\n\n## Audit\n\nRun the following script to verify:\n\n**- IF -** the `sctp` kernel module is available in ANY installed kernel, verify:\n\n- An entry including `/bin/true` or `/bin/false` exists in a file within the `/etc/modprobe.d/` directory\n- The module is deny listed in a file within the `/etc/modprobe.d/` directory\n- The module is not loaded in the running kernel\n\n**- IF -** the `sctp` kernel module is not available on the system, or pre-compiled into the kernel, no additional configuration is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"sctp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_chk()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loaded\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loaded\")\n fi\n if grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is not loadable\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is loadable\")\n fi\n if grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" is deny listed\")\n else\n a_output2+=(\" - kernel module: \\\"$l_mod_name\\\" is not deny listed\")\n fi\n }\n for l_mod_base_directory in $l_mod_path; do\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_chk\n else\n a_output+=(\" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\")\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"- Correctly set:\" \"${a_output[@]}\"\n fi\n}\n```"},{"uuid":"9bdd0b63-1791-546e-9fc5-528fe07ac59e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.2.4_Ensure_sctp_kernel_module_is_not_available"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sctp kernel module is not available","description":"Run the following script to unload and disable the `sctp` module:\n\n**- IF -** the `sctp` kernel module is available in ANY installed kernel:\n\n- Create a file ending in `.conf` with `install sctp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist sctp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r sctp 2>/dev/null; rmmod sctp 2>/dev/null` to remove `sctp` from the kernel\n\n**- IF -** the `sctp` kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"sctp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' > /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\" \n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"}],"title":"3.2.4 Ensure sctp kernel module is not available","description":"The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message-oriented like UDP, and ensures reliable in-sequence transport of messages with congestion control like TCP."},{"uuid":"4fb55874-2389-5feb-a6c7-0cc02eef31b0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.1_Ensure_ip_forwarding_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.1"}],"steps":[{"uuid":"da0614e7-e689-5fed-91f7-eeca94b5082c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.1_Ensure_ip_forwarding_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ip forwarding is disabled","remarks":"Setting `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` to `0` ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router.","description":"## Description\n\nThe `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` flags are used to tell the system whether it can forward packets or not.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.ip_forward` is set to `0`\n- `net.ipv6.conf.all.forwarding` is set to `0`\n\n**Note:**\n\n- kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n- IPv6 kernel parameters only apply to systems where IPv6 is enabled\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.ip_forward=0\" \"net.ipv6.conf.all.forwarding=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"15021484-8139-51c2-92f3-e399c5e26467","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.1_Ensure_ip_forwarding_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ip forwarding is disabled","description":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.ip_forward = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.ip_forward = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.ip_forward=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**- IF -** IPv6 is enabled on the system:\n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv6.conf.all.forwarding = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv6.conf.all.forwarding = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash \n\n{\n sysctl -w net.ipv6.conf.all.forwarding=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\nImpact:\n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.\n\nMany Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding."}],"title":"3.3.1 Ensure ip forwarding is disabled","description":"The `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` flags are used to tell the system whether it can forward packets or not."},{"uuid":"2c0a40b7-14d7-55d3-b015-df0ded2c5097","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.2_Ensure_packet_redirect_sending_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.2"}],"steps":[{"uuid":"112dc207-13f2-52a0-8efb-3b584adaf04a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.2_Ensure_packet_redirect_sending_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure packet redirect sending is disabled","remarks":"An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system.","description":"## Description\n\nICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.send_redirects` is set to `0`\n- `net.ipv4.conf.default.send_redirects` is set to `0`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.send_redirects=0\" \"net.ipv4.conf.default.send_redirects=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"e137f436-68f4-5167-a701-52c607d12867","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.2_Ensure_packet_redirect_sending_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure packet redirect sending is disabled","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.send_redirects = 0`\n- `net.ipv4.conf.default.send_redirects = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.send_redirects = 0\" \"net.ipv4.conf.default.send_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.send_redirects=0\n sysctl -w net.ipv4.conf.default.send_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\nImpact:\n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router."}],"title":"3.3.2 Ensure packet redirect sending is disabled","description":"ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects."},{"uuid":"9262f405-08e2-553b-8135-7a2342f5cabe","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.3_Ensure_bogus_icmp_responses_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.3"}],"steps":[{"uuid":"4db93ee2-9cf1-5417-a463-12faf6937631","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.3_Ensure_bogus_icmp_responses_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure bogus icmp responses are ignored","remarks":"Some routers (and some attackers) will send responses that violate RFC-1122 and attempt to fill up a log file system with many useless error messages.","description":"## Description\n\nSetting `net.ipv4.icmp_ignore_bogus_error_responses` to `1` prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages.\n\n## Audit\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.icmp_ignore_bogus_error_responses` is set to `1`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.icmp_ignore_bogus_error_responses=1\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"f6699dec-41b2-5fd2-9ff2-6794c797cb98","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.3_Ensure_bogus_icmp_responses_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure bogus icmp responses are ignored","description":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.icmp_ignore_bogus_error_responses = 1`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.icmp_ignore_bogus_error_responses = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.3 Ensure bogus icmp responses are ignored","description":"Setting `net.ipv4.icmp_ignore_bogus_error_responses` to `1` prevents the kernel from logging bogus responses (RFC-1122 non-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages."},{"uuid":"252d357e-3d36-5db5-a0f5-738b29de5d3b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.4_Ensure_broadcast_icmp_requests_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.4"}],"steps":[{"uuid":"0966ec7c-c481-5ea3-b4ed-84b2ce4315f0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.4_Ensure_broadcast_icmp_requests_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure broadcast icmp requests are ignored","remarks":"Accepting ICMP echo and timestamp requests with broadcast or multicast destinations for your network could be used to trick your host into starting (or participating) in a Smurf attack. A Smurf attack relies on an attacker sending large amounts of ICMP broadcast messages with a spoofed source address. All hosts receiving this message and responding would send echo-reply messages back to the spoofed address, which is probably not routable. If many hosts respond to the packets, the amount of traffic on the network could be significantly multiplied.","description":"## Description\n\nSetting `net.ipv4.icmp_echo_ignore_broadcasts` to `1` will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses.\n\n## Audit\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.icmp_echo_ignore_broadcasts` is set to `1`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.icmp_echo_ignore_broadcasts=1\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"d231ff84-d1eb-54d6-b9a1-8a870dee84a0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.4_Ensure_broadcast_icmp_requests_are_ignored"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure broadcast icmp requests are ignored","description":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.icmp_echo_ignore_broadcasts = 1`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.icmp_echo_ignore_broadcasts = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.4 Ensure broadcast icmp requests are ignored","description":"Setting `net.ipv4.icmp_echo_ignore_broadcasts` to `1` will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses."},{"uuid":"691e54a5-f997-5584-927b-e2c34b02faf7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.5_Ensure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.5"}],"steps":[{"uuid":"9cc93635-d489-5d1f-9e29-6b692b9f9d5e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.5_Ensure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure icmp redirects are not accepted","remarks":"ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting `net.ipv4.conf.all.accept_redirects`, `net.ipv4.conf.default.accept_redirects`, `net.ipv6.conf.all.accept_redirects`, and `net.ipv6.conf.default.accept_redirects` to `0`, the system will not accept any ICMP redirect messages, and therefore, won't allow outsiders to update the system's routing tables.","description":"## Description\n\nICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.accept_redirects` is set to `0`\n- `net.ipv4.conf.default.accept_redirects` is set to `0`\n- `net.ipv6.conf.all.accept_redirects` is set to `0`\n- `net.ipv6.conf.default.accept_redirects` is set to `0`\n\n**Note:**\n\n- kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n- IPv6 kernel parameters only apply to systems where IPv6 is enabled\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.accept_redirects=0\" \"net.ipv4.conf.default.accept_redirects=0\" \"net.ipv6.conf.all.accept_redirects=0\" \"net.ipv6.conf.default.accept_redirects=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"98792396-2f79-5b32-aec3-232989ca3688","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.5_Ensure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure icmp redirects are not accepted","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.accept_redirects = 0`\n- `net.ipv4.conf.default.accept_redirects = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.accept_redirects = 0\" \"net.ipv4.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_redirects=0\n sysctl -w net.ipv4.conf.default.accept_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**- IF -** IPv6 is enabled on the system:\n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv6.conf.all.accept_redirects = 0`\n- `net.ipv6.conf.default.accept_redirects = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv6.conf.all.accept_redirects = 0\" \"net.ipv6.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_redirects=0\n sysctl -w net.ipv6.conf.default.accept_redirects=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.5 Ensure icmp redirects are not accepted","description":"ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables."},{"uuid":"d0b2e49c-0f8a-5f09-8426-9fc60c2e3225","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.6_Ensure_secure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.6"}],"steps":[{"uuid":"d67953b9-1df9-50fc-835b-557faeae297c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.6_Ensure_secure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure secure icmp redirects are not accepted","remarks":"It is still possible for even known gateways to be compromised. Setting `net.ipv4.conf.all.secure_redirects` and `net.ipv4.conf.default.secure_redirects` to `0` protects the system from routing table updates by possibly compromised known gateways.","description":"## Description\n\nSecure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.secure_redirects` is set to `0`\n- `net.ipv4.conf.default.secure_redirects` is set to `0`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.secure_redirects=0\" \"net.ipv4.conf.default.secure_redirects=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"09d181c3-e204-5fbc-9bf7-838286852ac9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.6_Ensure_secure_icmp_redirects_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure secure icmp redirects are not accepted","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.secure_redirects = 0`\n- `net.ipv4.conf.default.secure_redirects = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.secure_redirects = 0\" \"net.ipv4.conf.default.secure_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.secure_redirects=0\n sysctl -w net.ipv4.conf.default.secure_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.6 Ensure secure icmp redirects are not accepted","description":"Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure."},{"uuid":"eecce373-1ddf-5a3b-98f7-a32c665d39cd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.7_Ensure_reverse_path_filtering_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.7"}],"steps":[{"uuid":"0576c6dd-f6b6-5b77-9e2b-d698ca1eda25","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.7_Ensure_reverse_path_filtering_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure reverse path filtering is enabled","remarks":"Setting `net.ipv4.conf.all.rp_filter` and `net.ipv4.conf.default.rp_filter` to `1` is a good way to deter attackers from sending your system bogus packets that cannot be responded to. One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.","description":"## Description\n\nSetting `net.ipv4.conf.all.rp_filter` and `net.ipv4.conf.default.rp_filter` to `1` forces the Linux kernel to utilize reverse path filtering on a received packet to determine if the packet was valid. Essentially, with reverse path filtering, if the return packet does not go out the same interface that the corresponding source packet came from, the packet is dropped (and logged if `log_martians` is set).\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.rp_filter` is set to `1`\n- `net.ipv4.conf.default.rp_filter` is set to `1`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.rp_filter=1\" \"net.ipv4.conf.default.rp_filter=1\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"092eb922-411b-5110-9cfd-740872556d68","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.7_Ensure_reverse_path_filtering_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure reverse path filtering is enabled","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.rp_filter = 1`\n- `net.ipv4.conf.default.rp_filter = 1`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.rp_filter = 1\" \"net.ipv4.conf.default.rp_filter = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.rp_filter=1\n sysctl -w net.ipv4.conf.default.rp_filter=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\nImpact:\n\nIf you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing."}],"title":"3.3.7 Ensure reverse path filtering is enabled","description":"Setting `net.ipv4.conf.all.rp_filter` and `net.ipv4.conf.default.rp_filter` to `1` forces the Linux kernel to utilize reverse path filtering on a received packet to determine if the packet was valid. Essentially, with reverse path filtering, if the return packet does not go out the same interface that the corresponding source packet came from, the packet is dropped (and logged if `log_martians` is set)."},{"uuid":"c40e4ca6-9f83-5916-bb6a-c0ef6400daf3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.8_Ensure_source_routed_packets_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.8"}],"steps":[{"uuid":"87f32ba1-2849-53d4-83ae-2866a7236b2b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.8_Ensure_source_routed_packets_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure source routed packets are not accepted","remarks":"Setting `net.ipv4.conf.all.accept_source_route`, `net.ipv4.conf.default.accept_source_route`, `net.ipv6.conf.all.accept_source_route` and `net.ipv6.conf.default.accept_source_route` to `0` disables the system from accepting source routed packets. Assume this system was capable of routing packets to Internet routable addresses on one interface and private addresses on another interface. Assume that the private addresses were not routable to the Internet routable addresses and vice versa. Under normal routing circumstances, an attacker from the Internet routable addresses could not use the system as a way to reach the private address systems. If, however, source routed packets were allowed, they could be used to gain access to the private address systems as the route could be specified, rather than rely on routing protocols that did not allow this routing.","description":"## Description\n\nIn networking, source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non-source routed packets travel a path determined by routers in the network. In some cases, systems may not be routable or reachable from some locations (e.g. private addresses vs. Internet routable), and so source routed packets would need to be used.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.accept_source_route` is set to `0`\n- `net.ipv4.conf.default.accept_source_route` is set to `0`\n- `net.ipv6.conf.all.accept_source_route` is set to `0`\n- `net.ipv6.conf.default.accept_source_route` is set to `0`\n\n**Note:**\n\n- kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n- IPv6 kernel parameters only apply to systems where IPv6 is enabled\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.accept_source_route=0\" \"net.ipv4.conf.default.accept_source_route=0\" \"net.ipv6.conf.all.accept_source_route=0\" \"net.ipv6.conf.default.accept_source_route=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"7567a067-2541-5682-b5f0-723838c8e17d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.8_Ensure_source_routed_packets_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure source routed packets are not accepted","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.accept_source_route = 0`\n- `net.ipv4.conf.default.accept_source_route = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.accept_source_route = 0\" \"net.ipv4.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_source_route=0\n sysctl -w net.ipv4.conf.default.accept_source_route=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**- IF -** IPv6 is enabled on the system:\n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv6.conf.all.accept_source_route = 0`\n- `net.ipv6.conf.default.accept_source_route = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv6.conf.all.accept_source_route = 0\" \"net.ipv6.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\nRun the following command to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_source_route=0\n sysctl -w net.ipv6.conf.default.accept_source_route=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.8 Ensure source routed packets are not accepted","description":"In networking, source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non-source routed packets travel a path determined by routers in the network. In some cases, systems may not be routable or reachable from some locations (e.g. private addresses vs. Internet routable), and so source routed packets would need to be used."},{"uuid":"89b1db5f-c6ef-5bb1-805b-abc11f66a6a7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.9_Ensure_suspicious_packets_are_logged"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.9"}],"steps":[{"uuid":"659ec9be-500f-5cee-8b8a-e213d811b5c6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.9_Ensure_suspicious_packets_are_logged"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure suspicious packets are logged","remarks":"Setting `net.ipv4.conf.all.log_martians` and `net.ipv4.conf.default.log_martians` to `1` enables this feature. Logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system.","description":"## Description\n\nWhen enabled, this feature logs packets with un-routable source addresses to the kernel log.\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.conf.all.log_martians` is set to `1`\n- `net.ipv4.conf.default.log_martians` is set to `1`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.conf.all.log_martians=1\" \"net.ipv4.conf.default.log_martians=1\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"afa9076c-4e44-5624-a016-95ca89e6a58f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.9_Ensure_suspicious_packets_are_logged"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure suspicious packets are logged","description":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.conf.all.log_martians = 1`\n- `net.ipv4.conf.default.log_martians = 1`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.conf.all.log_martians = 1\" \"net.ipv4.conf.default.log_martians = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.log_martians=1\n sysctl -w net.ipv4.conf.default.log_martians=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.9 Ensure suspicious packets are logged","description":"When enabled, this feature logs packets with un-routable source addresses to the kernel log."},{"uuid":"d659b2cd-315e-598e-8af9-54bd31da7616","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.10_Ensure_tcp_syn_cookies_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.10"}],"steps":[{"uuid":"2df3fcbb-363e-5c2b-96b7-72840b19a48e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.10_Ensure_tcp_syn_cookies_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure tcp syn cookies is enabled","remarks":"Attackers use SYN flood attacks to perform a denial of service attacked on a system by sending many SYN packets without completing the three way handshake. This will quickly use up slots in the kernel's half-open connection queue and prevent legitimate connections from succeeding. Setting `net.ipv4.tcp_syncookies` to `1` enables SYN cookies, allowing the system to keep accepting valid connections, even if under a denial of service attack.","description":"## Description\n\nWhen `tcp_syncookies` is set, the kernel will handle TCP SYN packets normally until the half-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. Instead, the kernel simply replies to the SYN with a SYN/ACK, but will include a specially crafted TCP sequence number that encodes the source and destination IP address and port number and the time the packet was sent. A legitimate connection would send the ACK packet of the three way handshake with the specially crafted sequence number. This allows the system to verify that it has received a valid response to a SYN cookie and allow the connection, even though there is no corresponding SYN in the queue.\n\n## Audit\n\nRun the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv4.tcp_syncookies` is set to `1`\n\n**Note:** kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv4.tcp_syncookies=1\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"b6fc5826-a5d0-5d0f-b438-029a8ea71e6e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.10_Ensure_tcp_syn_cookies_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure tcp syn cookies is enabled","description":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv4.tcp_syncookies = 1`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv4.tcp_syncookies = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.tcp_syncookies=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.10 Ensure tcp syn cookies is enabled","description":"When `tcp_syncookies` is set, the kernel will handle TCP SYN packets normally until the half-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. Instead, the kernel simply replies to the SYN with a SYN/ACK, but will include a specially crafted TCP sequence number that encodes the source and destination IP address and port number and the time the packet was sent. A legitimate connection would send the ACK packet of the three way handshake with the specially crafted sequence number. This allows the system to verify that it has received a valid response to a SYN cookie and allow the connection, even though there is no corresponding SYN in the queue."},{"uuid":"c409b512-f029-5757-a273-e9d5e2c92b6b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Network"},{"ns":"https://cisecurity.org/ns","name":"group","value":"3 Network > 3.3 Configure Network Kernel Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.11_Ensure_ipv6_router_advertisements_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"3.3.11"}],"steps":[{"uuid":"40cd0b59-c775-5b89-9dbe-c22acf8412bd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.11_Ensure_ipv6_router_advertisements_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure ipv6 router advertisements are not accepted","remarks":"It is recommended that systems do not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes. Setting `net.ipv6.conf.all.accept_ra` and `net.ipv6.conf.default.accept_ra` to `0` disables the system's ability to accept IPv6 router advertisements.","description":"## Description\n\nRouters periodically multicast Router Advertisement messages to announce their availability and convey information to neighboring nodes that enable them to be automatically configured on the network.\n\n`net.ipv6.conf.all.accept_ra` and `net.ipv6.conf.default.accept_ra` determine the systems ability to accept these advertisements\n\n## Audit\n\nRun the following script to verify the following kernel parameters are set in the running configuration and correctly loaded from a kernel parameter configuration file:\n\n- `net.ipv6.conf.all.accept_ra` is set to `0`\n- `net.ipv6.conf.default.accept_ra` is set to `0`\n\n**Note:**\n\n- kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that \"correct\" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.\n- IPv6 kernel parameters only apply to systems where IPv6 is enabled\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ipv6_disabled=\"\"\n a_parlist=(\"net.ipv6.conf.all.accept_ra=0\" \"net.ipv6.conf.default.accept_ra=0\")\n l_ufwscf=\"$([ -f /etc/default/ufw ] && awk -F= '/^\\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"\n f_ipv6_chk()\n {\n l_ipv6_disabled=\"no\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_disabled=\"yes\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_disabled=\"yes\"\n fi\n }\n f_kernel_parameter_chk()\n { \n l_running_parameter_value=\"$(sysctl \"$l_parameter_name\" | awk -F= '{print $2}' | xargs)\" # Check running configuration\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' 0 )); then # Assess output from files and generate output\n while IFS=\"=\" read -r l_fkpname l_file_parameter_value; do\n l_fkpname=\"${l_fkpname// /}\"; l_file_parameter_value=\"${l_file_parameter_value// /}\"\n if grep -Pq -- '\\b'\"$l_parameter_value\"'\\b' <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - \\\"$l_parameter_name\\\" is correctly set to \\\"$l_file_parameter_value\\\"\" \\\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is incorrectly set to \\\"$l_file_parameter_value\\\"\"\n \" in \\\"$(printf '%s' \"${A_out[@]}\")\\\"\" \\\n \" and should have a value of: \\\"$l_value_out\\\"\")\n fi\n done < <(grep -Po -- \"^\\h*$l_parameter_name\\h*=\\h*\\H+\" \"${A_out[@]}\")\n else\n a_output2+=(\" - \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" ** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure **\")\n fi\n }\n l_systemdsysctl=\"$(readlink -f /lib/systemd/systemd-sysctl)\"\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n if grep -q '^net.ipv6.' <<< \"$l_parameter_name\"; then\n [ -z \"$l_ipv6_disabled\" ] && f_ipv6_chk\n if [ \"$l_ipv6_disabled\" = \"yes\" ]; then\n a_output+=(\" - IPv6 is disabled on the system, \\\"$l_parameter_name\\\" is not applicable\")\n else\n f_kernel_parameter_chk\n fi\n else\n f_kernel_parameter_chk\n fi\n done < <(printf '%s\\n' \"${a_parlist[@]}\")\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"5a9d2367-2b0d-598a-ba55-af5b82a503ec","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_3.3.11_Ensure_ipv6_router_advertisements_are_not_accepted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ipv6 router advertisements are not accepted","description":"**- IF -** IPv6 is enabled on the system:\n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`:\n\n- `net.ipv6.conf.all.accept_ra = 0`\n- `net.ipv6.conf.default.accept_ra = 0`\n\nExample:\n\n```bash\n# printf '%s\\n' \"net.ipv6.conf.all.accept_ra = 0\" \"net.ipv6.conf.default.accept_ra = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\nRun the following script to set the active kernel parameters:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_ra=0\n sysctl -w net.ipv6.conf.default.accept_ra=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten"}],"title":"3.3.11 Ensure ipv6 router advertisements are not accepted","description":"Routers periodically multicast Router Advertisement messages to announce their availability and convey information to neighboring nodes that enable them to be automatically configured on the network.\n\n`net.ipv6.conf.all.accept_ra` and `net.ipv6.conf.default.accept_ra` determine the systems ability to accept these advertisements"},{"uuid":"0a987f1f-f84b-5d04-b196-8b75bcd7f907","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.1 Configure a single firewall utility"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.1.1_Ensure_a_single_firewall_configuration_utility_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.1.1"}],"steps":[{"uuid":"01a50735-a368-58a9-baf4-e63cfa30ab37","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.1.1_Ensure_a_single_firewall_configuration_utility_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure a single firewall configuration utility is in use","remarks":"Proper configuration of a single firewall utility minimizes cyber threats and protects services and data, while avoiding vulnerabilities like open ports or exposed services. Standardizing on a single tool simplifies management, reduces errors, and fortifies security across Linux systems.","description":"## Description\n\nIn Linux security, employing a single, effective firewall configuration utility ensures that only legitimate traffic gets processed, reducing the system’s exposure to potential threats. The choice between `ufw`, `nftables`, and `iptables` depends on organizational needs.\n\n**Note:** `iptables` is being phased out, and support for `iptables` will be reduced over time. It is recommended to transition towards either `nftables` or `ufw` as the default firewall management tool.\n\n## Audit\n\nRun the following script to verify that a single firewall utility is in use on the system:\n\n```bash\n#!/usr/bin/env bash\n\n{\n active_firewall=() firewalls=(\"ufw\" \"nftables\" \"iptables\")\n # Determine which firewall is in use\n for firewall in \"${firewalls[@]}\"; do\n case $firewall in\n nftables)\n cmd=\"nft\" ;;\n *)\n cmd=$firewall ;;\n esac \n if command -v $cmd &> /dev/null && systemctl is-enabled --quiet $firewall && systemctl is-active --quiet $firewall; then\n active_firewall+=(\"$firewall\")\n fi\n done\n # Display audit results\n if [ ${#active_firewall[@]} -eq 1 ]; then\n printf '%s\\n' \"\" \"Audit Results:\" \" ** PASS **\" \" - A single firewall is in use follow the recommendation in ${active_firewall[0]} subsection ONLY\"\n elif [ ${#active_firewall[@]} -eq 0 ]; then\n printf '%s\\n' \"\" \" Audit Results:\" \" ** FAIL **\" \"- No firewall in use or unable to determine firewall status\"\n else\n printf '%s\\n' \"\" \" Audit Results:\" \" ** FAIL **\" \" - Multiple firewalls are in use: ${active_firewall[*]}\"\n fi \n}\n```"},{"uuid":"a43f8cb2-a475-5c4a-a977-a92cbc85e1b2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.1.1_Ensure_a_single_firewall_configuration_utility_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure a single firewall configuration utility is in use","description":"Remediating to a single firewall configuration is a complex process and involves several steps. The following provides the basic steps to follow for a single firewall configuration:\n\n- \nDetermine which firewall utility best fits organizational needs\n\n- \nFollow the recommendations in the subsequent subsection for the single firewall to be used\n\n**Note:** Review the firewall subsection overview for the selected firewall to be used, it contains a script to\nsimplify this process.\n\n- \nReturn to this recommendation to ensure a single firewall configuration utility is in use\n\nImpact:\n\nThe use of more than one firewall utility may produce unexpected results."}],"title":"4.1.1 Ensure a single firewall configuration utility is in use","description":"In Linux security, employing a single, effective firewall configuration utility ensures that only legitimate traffic gets processed, reducing the system’s exposure to potential threats. The choice between `ufw`, `nftables`, and `iptables` depends on organizational needs.\n\n**Note:** `iptables` is being phased out, and support for `iptables` will be reduced over time. It is recommended to transition towards either `nftables` or `ufw` as the default firewall management tool."},{"uuid":"536df640-944f-55e5-9e19-5afa140db799","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.1_Ensure_ufw_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.1"}],"steps":[{"uuid":"d71508fd-f44b-5c12-9ac2-f7b36f319c0c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.1_Ensure_ufw_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw is installed","remarks":"A firewall utility is required to configure the Linux kernel's netfilter framework via the iptables or nftables back-end.\n\nThe Linux kernel's netfilter framework host-based firewall can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.\n\n**Note:** Only one firewall utility should be installed and configured. `UFW` is dependent on the iptables package","description":"## Description\n\nThe Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall\n\n## Audit\n\nRun the following command to verify that Uncomplicated Firewall (UFW) is installed:\n\n```bash\n# dpkg-query -s ufw &>/dev/null && echo \"ufw is installed\"\n\nufw is installed\n```"},{"uuid":"276bd0ef-bbca-564a-bf05-8a916a0b5400","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.1_Ensure_ufw_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw is installed","description":"Run the following command to install Uncomplicated Firewall (UFW):\n\n```bash\n# apt install ufw\n```"}],"title":"4.2.1 Ensure ufw is installed","description":"The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well-suited for host-based firewalls. ufw provides a framework for managing netfilter, as well as a command-line interface for manipulating the firewall"},{"uuid":"76db6eaf-1768-5c9f-a59e-5595ff2c57f2","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.2_Ensure_iptables-persistent_is_not_installed_with_ufw"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.2"}],"steps":[{"uuid":"33c6cadb-d9c9-54f4-9d92-784991644b0f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.2_Ensure_iptables-persistent_is_not_installed_with_ufw"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables-persistent is not installed with ufw","remarks":"Running both `ufw` and the services included in the iptables-persistent package may lead to conflict","description":"## Description\n\nThe `iptables-persistent` is a boot-time loader for netfilter rules, iptables plugin\n\n## Audit\n\nRun the following command to verify that the `iptables-persistent` package is not installed:\n\n```bash\n# dpkg-query -s iptables-persistent &>/dev/null && echo \"iptables-persistent is installed\"\n```\n\nNothing should be returned"},{"uuid":"2fa49a1e-8fcd-5f76-b95c-f7e5fe561419","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.2_Ensure_iptables-persistent_is_not_installed_with_ufw"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables-persistent is not installed with ufw","description":"Run the following command to remove the `iptables-persistent` package:\n\n```bash\n# apt purge iptables-persistent\n```"}],"title":"4.2.2 Ensure iptables-persistent is not installed with ufw","description":"The `iptables-persistent` is a boot-time loader for netfilter rules, iptables plugin"},{"uuid":"543a6490-d5c2-5f2f-979f-817ac8c0bd38","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.3_Ensure_ufw_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.3"}],"steps":[{"uuid":"48247dfb-f9ec-54e1-b4ed-2dcf5d76b57f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.3_Ensure_ufw_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw service is enabled","remarks":"The ufw service must be enabled and running in order for ufw to protect the system","description":"## Description\n\nUncomplicatedFirewall (ufw) is a frontend for iptables. ufw provides a framework for managing netfilter, as well as a command-line and available graphical user interface for manipulating the firewall.\n\n**Note:**\n\n- When running ufw enable or starting ufw via its initscript, ufw will flush its chains. This is required so ufw can maintain a consistent state, but it may drop existing connections (eg ssh). ufw does support adding rules before enabling the firewall.\n- Run the following command before running `ufw enable`.\n\n```bash\n# ufw allow proto tcp from any to any port 22\n```\n\n- The rules will still be flushed, but the ssh port will be open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not flush the chains when adding or removing rules (but will when modifying a rule or changing the default policy)\n- By default, ufw will prompt when enabling the firewall while running under ssh. This can be disabled by using `ufw --force enable`\n\n## Audit\n\nRun the following command to verify that the `ufw` daemon is enabled:\n\n```bash\n# systemctl is-enabled ufw.service\n\nenabled\n```\n\nRun the following command to verify that the `ufw` daemon is active:\n\n```bash\n# systemctl is-active ufw\n\nactive\n```\n\nRun the following command to verify ufw is active\n\n```bash\n# ufw status\n\nStatus: active\n```"},{"uuid":"7e0defc9-eaa3-513a-8f5a-0903c32797a1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.3_Ensure_ufw_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw service is enabled","description":"Run the following command to unmask the `ufw` daemon:\n\n```bash\n# systemctl unmask ufw.service\n```\n\nRun the following command to enable and start the `ufw` daemon:\n\n```bash\n# systemctl --now enable ufw.service\n\nactive\n```\n\nRun the following command to enable ufw:\n\n```bash\n# ufw enable\n```\n\nImpact:\n\nChanging firewall settings while connected over network can result in being locked out of the system."}],"title":"4.2.3 Ensure ufw service is enabled","description":"UncomplicatedFirewall (ufw) is a frontend for iptables. ufw provides a framework for managing netfilter, as well as a command-line and available graphical user interface for manipulating the firewall.\n\n**Note:**\n\n- When running ufw enable or starting ufw via its initscript, ufw will flush its chains. This is required so ufw can maintain a consistent state, but it may drop existing connections (eg ssh). ufw does support adding rules before enabling the firewall.\n- Run the following command before running `ufw enable`.\n\n```bash\n# ufw allow proto tcp from any to any port 22\n```\n\n- The rules will still be flushed, but the ssh port will be open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not flush the chains when adding or removing rules (but will when modifying a rule or changing the default policy)\n- By default, ufw will prompt when enabling the firewall while running under ssh. This can be disabled by using `ufw --force enable`"},{"uuid":"29ea6962-14c8-59af-ba26-69242a9bbec1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.4_Ensure_ufw_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.4"}],"steps":[{"uuid":"819528f5-afb2-50df-bb25-d2ead23286d2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.4_Ensure_ufw_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw loopback traffic is configured","remarks":"Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.","description":"## Description\n\nConfigure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6).\n\n## Audit\n\nRun the following command and verify loopback interface to accept traffic:\n\n```bash\n# grep -P -- 'lo|127.0.0.0' /etc/ufw/before.rules\n```\n\nOutput includes:\n\n```bash\n# allow all on loopback\n-A ufw-before-input -i lo -j ACCEPT\n-A ufw-before-output -o lo -j ACCEPT\n```\n\nRun the following command and verify all other interfaces deny traffic to the loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6)\n\n```bash\n# ufw status verbose\n\nTo Action From\n-- ------ ---- \nAnywhere DENY IN 127.0.0.0/8 \nAnywhere (v6) DENY IN ::1\n```\n\n**Note:** `ufw status` only shows rules added with `ufw` and not the rules found in the `/etc/ufw` rules files where allow all on loopback is configured by default."},{"uuid":"e50bc514-2e85-53be-b233-e99e62458f97","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.4_Ensure_ufw_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw loopback traffic is configured","description":"Run the following commands to configure the loopback interface to accept traffic:\n\n```bash\n# ufw allow in on lo\n# ufw allow out on lo\n```\n\nRun the following commands to configure all other interfaces to deny traffic to the loopback network:\n\n```bash\n# ufw deny in from 127.0.0.0/8\n# ufw deny in from ::1\n```"}],"title":"4.2.4 Ensure ufw loopback traffic is configured","description":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6)."},{"uuid":"cb773ca1-bbdf-5cd2-a587-8b11cf5b7d50","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.5_Ensure_ufw_outbound_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.5"}],"steps":[{"uuid":"ff7e85cf-2fb2-5e1a-a7d8-b9227e689cc5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.5_Ensure_ufw_outbound_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw outbound connections are configured","remarks":"If rules are not in place for new outbound connections all packets will be dropped by the default policy preventing network usage.","description":"## Description\n\nConfigure the firewall rules for new outbound connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system.\n- Unlike iptables, when a new outbound rule is added, ufw automatically takes care of associated established connections, so no rules for the latter kind are required.\n\n## Audit\n\nRun the following command and verify all rules for new outbound connections match site policy:\n\n```bash\n# ufw status numbered\n```"},{"uuid":"4170c64a-c078-5912-9da6-3ab96ce51d8c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.5_Ensure_ufw_outbound_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw outbound connections are configured","description":"Configure ufw in accordance with site policy. The following commands will implement a policy to allow all outbound connections on all interfaces:\n\n```bash\n# ufw allow out on all\n```"}],"title":"4.2.5 Ensure ufw outbound connections are configured","description":"Configure the firewall rules for new outbound connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system.\n- Unlike iptables, when a new outbound rule is added, ufw automatically takes care of associated established connections, so no rules for the latter kind are required."},{"uuid":"b0692699-fbbd-5307-9fef-6a1c710310b4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.6_Ensure_ufw_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.6"}],"steps":[{"uuid":"fe5b1dfd-5788-5fce-85c1-0abe79f87d42","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.6_Ensure_ufw_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw firewall rules exist for all open ports","remarks":"To reduce the attack surface of a system, all services and ports should be blocked unless required.\n\n- Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.\n- Without a firewall rule configured for open ports, the default firewall policy will drop all packets to these ports.\n- Required ports should have a firewall rule created to allow approved connections in accordance with local site policy.\n- Unapproved ports should have an explicit deny rule created.","description":"## Description\n\nServices and ports can be accepted or explicitly rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- The remediation command opens up the port to traffic from all sources. Consult ufw documentation and set any restrictions in compliance with site policy\n\n## Audit\n\nRun the following script to verify a firewall rule exists for all open ports:\n\n```bash\n#!/usr/bin/env bash\n\n{\n unset a_ufwout;unset a_openports\n while read -r l_ufwport; do\n [ -n \"$l_ufwport\" ] && a_ufwout+=(\"$l_ufwport\")\n done < <(ufw status verbose | grep -Po '^\\h*\\d+\\b' | sort -u)\n while read -r l_openport; do\n [ -n \"$l_openport\" ] && a_openports+=(\"$l_openport\")\n done < <(ss -tuln | awk '($5!~/%lo:/ && $5!~/127.0.0.1:/ && $5!~/\\[?::1\\]?:/) {split($5, a, \":\"); print a[2]}' | sort -u)\n a_diff=(\"$(printf '%s\\n' \"${a_openports[@]}\" \"${a_ufwout[@]}\" \"${a_ufwout[@]}\" | sort | uniq -u)\")\n if [[ -n \"${a_diff[*]}\" ]]; then\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n- The following port(s) don't have a rule in UFW: $(printf '%s\\n' \\\\n\"${a_diff[*]}\")\\n- End List\"\n else\n echo -e \"\\n - Audit Passed -\\n- All open ports have a rule in UFW\\n\"\n fi\n}\n```"},{"uuid":"bbd1147b-0ac0-5a7c-874e-9f2bc6abbcf4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.6_Ensure_ufw_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw firewall rules exist for all open ports","description":"For each port identified in the audit which does not have a firewall rule, evaluate the service listening on the port and add a rule for accepting or denying inbound connections in accordance with local site policy:\n\nExamples:\n\n```bash\n# ufw allow in /\n\n# ufw deny in /\n```\n\n**Note:** Examples create rules for from any, to any. More specific rules should be concentered when allowing inbound traffic e.g only traffic from this network.\n\nExample to allow traffic on port 443 using the tcp protocol from the 192.168.1.0 network:\n\n```bash\nufw allow from 192.168.1.0/24 to any proto tcp port 443\n```"}],"title":"4.2.6 Ensure ufw firewall rules exist for all open ports","description":"Services and ports can be accepted or explicitly rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- The remediation command opens up the port to traffic from all sources. Consult ufw documentation and set any restrictions in compliance with site policy"},{"uuid":"024b4c0e-6f38-51bd-97aa-6e87741e2363","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.2 Configure UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.7_Ensure_ufw_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.2.7"}],"steps":[{"uuid":"2291cfae-15da-5be5-b887-2913a9724d90","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.7_Ensure_ufw_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw default deny firewall policy","remarks":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage.","description":"## Description\n\nA default deny policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:** Any port or protocol without a explicit allow before the default deny will be blocked\n\n## Audit\n\nRun the following command and verify that the default policy for **incoming** , **outgoing** , and **routed** directions is **deny** , **reject** , or **disabled**:\n\n```bash\n# ufw status verbose | grep Default:\n```\n\nExample output:\n\n```bash\nDefault: deny (incoming), deny (outgoing), disabled (routed)\n```"},{"uuid":"7bcbf27c-80d4-522e-a2b9-c8834f09f4db","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.2.7_Ensure_ufw_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw default deny firewall policy","description":"Run the following commands to implement a default deny policy:\n\n```bash\n# ufw default deny incoming\n# ufw default deny outgoing\n# ufw default deny routed\n```\n\nImpact:\n\nAny port and protocol not explicitly allowed will be blocked. The following rules should be considered before applying the default deny.\n\n```bash\nufw allow out http\nufw allow out https\nufw allow out ntp # Network Time Protocol\nufw allow out to any port 53 # DNS\nufw allow out to any port 853 # DNS over TLS\nufw logging on\n```"}],"title":"4.2.7 Ensure ufw default deny firewall policy","description":"A default deny policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:** Any port or protocol without a explicit allow before the default deny will be blocked"},{"uuid":"50f305d4-0f9b-552a-bdd5-abba47d04f84","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.1_Ensure_nftables_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.1"}],"steps":[{"uuid":"e5b92540-1888-525b-a9f6-a586531c45e6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.1_Ensure_nftables_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables is installed","remarks":"nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.","description":"## Description\n\nnftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.\n\n**Notes:**\n\n- nftables is available in Linux kernel 3.13 and newer\n- Only one firewall utility should be installed and configured\n- Changing firewall settings while connected over the network can result in being locked out of the system\n\n## Audit\n\nRun the following command to verify that `nftables` is installed:\n\n```bash\n# dpkg-query -s nftables &>/dev/null && echo \"nftables is installed\"\n\nnftables is installed\n```"},{"uuid":"0f3250ed-80f2-53ad-b288-6adc64ea5526","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.1_Ensure_nftables_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables is installed","description":"Run the following command to install `nftables`:\n\n```bash\n# apt install nftables\n```"}],"title":"4.3.1 Ensure nftables is installed","description":"nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.\n\n**Notes:**\n\n- nftables is available in Linux kernel 3.13 and newer\n- Only one firewall utility should be installed and configured\n- Changing firewall settings while connected over the network can result in being locked out of the system"},{"uuid":"ac0ebbb8-6411-558c-9f6f-7dd574965578","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.2_Ensure_ufw_is_uninstalled_or_disabled_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.2"}],"steps":[{"uuid":"b22646a3-b35c-59b2-afbb-ca75d637ca38","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.2_Ensure_ufw_is_uninstalled_or_disabled_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw is uninstalled or disabled with nftables","remarks":"Running both the `nftables` service and `ufw` may lead to conflict and unexpected results.","description":"## Description\n\nUncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n## Audit\n\nRun the following commands to verify that `ufw` is **either** not installed or inactive. Only one of the following needs to pass.\n\nRun the following command to verify that `ufw` is not installed:\n\n```bash\n# dpkg-query -s ufw &>/dev/null && echo \"ufw is installed\"\n```\n\nNothing should be returned\n\n**-OR-**\n\nRun the following commands to verify `ufw` is disabled and `ufw.service` is not enabled:\n\n```bash\n# ufw status\n\nStatus: inactive\n```\n\n```bash\n# systemctl is-enabled ufw.service\n\nmasked\n```"},{"uuid":"0380e187-6333-5381-8b21-0ae6369303e7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.2_Ensure_ufw_is_uninstalled_or_disabled_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw is uninstalled or disabled with nftables","description":"Run **one** of the following to either remove `ufw` **or** disable `ufw` and mask `ufw.service`:\n\nRun the following command to remove `ufw`:\n\n```bash\n# apt purge ufw\n```\n\n**-OR-**\n\nRun the following commands to disable `ufw` and mask `ufw.service`:\n\n```bash\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`"}],"title":"4.3.2 Ensure ufw is uninstalled or disabled with nftables","description":"Uncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use."},{"uuid":"f84c56f2-b1f7-598e-b483-576f3d999d69","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.3_Ensure_iptables_are_flushed_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.3"}],"steps":[{"uuid":"49a643ee-d9a9-555e-9f9c-9a0a39b7fcb5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.3_Ensure_iptables_are_flushed_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables are flushed with nftables","remarks":"It is possible to mix iptables and nftables. However, this increases complexity and also the chance to introduce errors. For simplicity flush out all iptables rules, and ensure it is not loaded","description":"## Description\n\nnftables is a replacement for iptables, ip6tables, ebtables and arptables\n\n## Audit\n\nRun the following commands to ensure no iptables rules exist\n\nFor iptables:\n\n```bash\n# iptables -L\n```\n\nNo rules should be returned\n\nFor ip6tables:\n\n```bash\n# ip6tables -L\n```\n\nNo rules should be returned"},{"uuid":"9e154619-c504-589a-83e4-9727a076f6f3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.3_Ensure_iptables_are_flushed_with_nftables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables are flushed with nftables","description":"Run the following commands to flush iptables:\n\nFor iptables:\n\n```bash\n# iptables -F\n```\n\nFor ip6tables:\n\n```bash\n# ip6tables -F\n```"}],"title":"4.3.3 Ensure iptables are flushed with nftables","description":"nftables is a replacement for iptables, ip6tables, ebtables and arptables"},{"uuid":"a81efa8f-474b-5fc8-8f92-56b2c7df41d9","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.4_Ensure_a_nftables_table_exists"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.4"}],"steps":[{"uuid":"c5fce5d2-b351-55d6-ad99-20c2fa9151d3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.4_Ensure_a_nftables_table_exists"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure a nftables table exists","remarks":"nftables doesn't have any default tables. Without a table being built, nftables will not filter network traffic.","description":"## Description\n\nTables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families.\n\n## Audit\n\nRun the following command to verify that a nftables table exists:\n\n```bash\n# nft list tables\n```\n\nReturn should include a list of nftables:\n\nExample:\n\n```bash\ntable inet filter\n```"},{"uuid":"e3b175c4-cd02-533e-bd48-98d28fea4cd0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.4_Ensure_a_nftables_table_exists"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure a nftables table exists","description":"Run the following command to create a table in nftables\n\n```bash\n# nft create table inet\n```\n\nExample:\n\n```bash\n# nft create table inet filter\n```\n\nImpact:\n\nAdding rules to a running nftables can cause loss of connectivity to the system"}],"title":"4.3.4 Ensure a nftables table exists","description":"Tables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families."},{"uuid":"d111f4fb-8b7f-5a8a-95dd-4b979a52bf81","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.5_Ensure_nftables_base_chains_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.5"}],"steps":[{"uuid":"bf1c158c-d850-5c0b-bfb0-fcbe2fc6d567","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.5_Ensure_nftables_base_chains_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables base chains exist","remarks":"If a base chain doesn't exist with a hook for input, forward, and delete, packets that would flow through those chains will not be touched by nftables.","description":"## Description\n\nChains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets from the networking stack, a regular chain may be used as jump target and is used for better rule organization.\n\n## Audit\n\nRun the following commands and verify that base chains exist for `INPUT`.\n\n```bash\n# nft list ruleset | grep 'hook input'\n\ntype filter hook input priority 0;\n```\n\nRun the following commands and verify that base chains exist for `FORWARD`.\n\n```bash\n# nft list ruleset | grep 'hook forward'\n\ntype filter hook forward priority 0;\n```\n\nRun the following commands and verify that base chains exist for `OUTPUT`.\n\n```bash\n# nft list ruleset | grep 'hook output'\n\ntype filter hook output priority 0;\n```"},{"uuid":"fe76cda6-b2e8-509f-a207-7b8a7aebae40","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.5_Ensure_nftables_base_chains_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables base chains exist","description":"Run the following command to create the base chains:\n\n```bash\n# nft create chain inet { type filter hook priority 0 \\; }\n```\n\nExample:\n\n```bash\n# nft create chain inet filter input { type filter hook input priority 0 \\; }\n\n# nft create chain inet filter forward { type filter hook forward priority 0 \\; }\n\n# nft create chain inet filter output { type filter hook output priority 0 \\; }\n```\n\nImpact:\n\nIf configuring nftables over ssh, `creating` a `base chain` with a policy of `drop` will cause loss of connectivity.\n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop"}],"title":"4.3.5 Ensure nftables base chains exist","description":"Chains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets from the networking stack, a regular chain may be used as jump target and is used for better rule organization."},{"uuid":"24f7b473-20ea-5358-af1e-3876496a3a47","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.6_Ensure_nftables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.6"}],"steps":[{"uuid":"8dff12ba-c7ca-53bf-b492-3a15edad7052","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.6_Ensure_nftables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables loopback traffic is configured","remarks":"Loopback traffic is generated between processes on machine and is typically critical to the operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.","description":"## Description\n\nConfigure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network\n\n## Audit\n\nRun the following commands to verify that the loopback interface is configured:\n\nRun the following command to verify the loopback interface is configured to accept network traffic:\n\n```bash\n# nft list ruleset | awk '/hook input/,/}/' | grep 'iif \"lo\" accept'\n```\n\nExample output:\n\n```bash\niif \"lo\" accept\n```\n\nRun the following command to verify network traffic from an iPv4 loopback interface is configured to drop:\n\n```bash\n# nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'\n```\n\nExample output:\n\n```bash\nip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop\n```\n\n**- IF -** IPv6 is enabled on the system:\n\nRun the following command to verify network traffic from an iPv6 loopback interface is configured to drop:\n\n```bash\n# nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'\n```\n\nExample output:\n\n```bash\nip6 saddr ::1 counter packets 0 bytes 0 drop\n```"},{"uuid":"37ee4dd0-3db1-5138-9148-6aeebb7e28ef","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.6_Ensure_nftables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables loopback traffic is configured","description":"Run the following commands to implement the loopback rules:\n\n```bash\n# nft add rule inet filter input iif lo accept\n```\n\n```bash\n# nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop\n```\n\n**- IF -** IPv6 is enabled on the system:\n\nRun the following command to implement the IPv6 loopback rule:\n\n```bash\n# nft add rule inet filter input ip6 saddr ::1 counter drop\n```"}],"title":"4.3.6 Ensure nftables loopback traffic is configured","description":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network"},{"uuid":"e7eceaef-6757-5c7f-a150-578b2ea1dec3","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.7_Ensure_nftables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.7"}],"steps":[{"uuid":"9058a449-01d6-5762-86eb-a13264a0bdbd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.7_Ensure_nftables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables outbound and established connections are configured","remarks":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage.","description":"## Description\n\nConfigure the firewall rules for new outbound, and established connections\n\n## Audit\n\nRun the following commands and verify all rules for established incoming connections match site policy: site policy:\n\n```bash\n# nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp) ct state'\n```\n\nOutput should be similar to:\n\n```bash\nip protocol tcp ct state established accept\nip protocol udp ct state established accept\n```\n\nRun the folllowing command and verify all rules for new and established outbound connections match site policy\n\n```bash\n# nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp) ct state'\n```\n\nOutput should be similar to:\n\n```bash\nip protocol tcp ct state established,related,new accept\nip protocol udp ct state established,related,new accept\n```"},{"uuid":"11230e91-1b90-5304-9778-3a8e7591c2d7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.7_Ensure_nftables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables outbound and established connections are configured","description":"Configure nftables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```bash\n# nft add rule inet filter input ip protocol tcp ct state established accept\n\n# nft add rule inet filter input ip protocol udp ct state established accept\n\n# nft add rule inet filter output ip protocol tcp ct state new,related,established accept\n\n# nft add rule inet filter output ip protocol udp ct state new,related,established accept\n```"}],"title":"4.3.7 Ensure nftables outbound and established connections are configured","description":"Configure the firewall rules for new outbound, and established connections"},{"uuid":"4921e94f-fb13-57e2-8285-2b439846bfc5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.8_Ensure_nftables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.8"}],"steps":[{"uuid":"bc8575da-8778-5dfc-92bf-a42331a64099","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.8_Ensure_nftables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables default deny firewall policy","remarks":"There are two policies: accept (Default) and drop. If the policy is set to `accept`, the firewall will accept any packet that is not configured to be denied and the packet will continue transversing the network stack.\n\nIt is easier to allow list acceptable usage than to deny list unacceptable usage.\n\n**Note:**\n\n- Allow port 22(ssh) needs to be updated to only allow systems requiring ssh connectivity to connect, as per site policy.\n- Changing firewall settings while connected over network can result in being locked out of the system.","description":"## Description\n\nBase chain policy is the default verdict that will be applied to packets reaching the end of the chain.\n\n## Audit\n\nRun the following commands and verify that base chains contain a policy of `DROP`.\n\n```bash\n# nft list ruleset | grep 'hook input'\n\ntype filter hook input priority 0; policy drop;\n```\n\n```bash\n# nft list ruleset | grep 'hook forward'\n\ntype filter hook forward priority 0; policy drop;\n```\n\n```bash\n# nft list ruleset | grep 'hook output'\n\ntype filter hook output priority 0; policy drop;\n```"},{"uuid":"92a9ac8a-56c9-52b4-be53-987e5f18ceed","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.8_Ensure_nftables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables default deny firewall policy","description":"Run the following command for the base chains with the input, forward, and output hooks to implement a default DROP policy:\n\n```bash\n# nft chain { policy drop \\; }\n```\n\nExample:\n\n```bash\n# nft chain inet filter input { policy drop \\; }\n\n# nft chain inet filter forward { policy drop \\; }\n\n# nft chain inet filter output { policy drop \\; }\n```\n\nImpact:\n\nIf configuring nftables over ssh, creating a base chain with a policy of drop will cause loss of connectivity.\n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop"}],"title":"4.3.8 Ensure nftables default deny firewall policy","description":"Base chain policy is the default verdict that will be applied to packets reaching the end of the chain."},{"uuid":"75fed75f-6308-5720-bc87-ca6a1b6df110","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.9_Ensure_nftables_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.9"}],"steps":[{"uuid":"004c47f0-7f2c-5fb0-9975-74431cef2f4f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.9_Ensure_nftables_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables service is enabled","remarks":"The nftables service restores the nftables rules from the rules files referenced in the `/etc/nftables.conf` file during boot or the starting of the nftables service","description":"## Description\n\nThe nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service\n\n## Audit\n\nRun the following command and verify that the nftables service is enabled:\n\n```bash\n# systemctl is-enabled nftables\n\nenabled\n```"},{"uuid":"78e77154-1ae1-5f96-ab6d-d5598e205190","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.9_Ensure_nftables_service_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables service is enabled","description":"Run the following command to enable the nftables service:\n\n```bash\n# systemctl enable nftables\n```"}],"title":"4.3.9 Ensure nftables service is enabled","description":"The nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service"},{"uuid":"050ba166-a211-5485-a650-6b82bb6d968e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.3 Configure nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.10_Ensure_nftables_rules_are_permanent"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.3.10"}],"steps":[{"uuid":"5da64e32-94a7-5428-a539-def97f7caf99","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.10_Ensure_nftables_rules_are_permanent"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables rules are permanent","remarks":"Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot","description":"## Description\n\nnftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.\n\nThe nftables service reads the `/etc/nftables.conf` file for a nftables file or files to include in the nftables ruleset.\n\nA nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.\n\n**Note:** Saving the script and following the instruction in the Configure nftables section overview will implement the rules in the configure nftable section, open port 22(ssh) from anywhere, and applies nftables ruleset on boot.\n\n## Audit\n\nRun the following commands to verify that input, forward, and output base chains are configured to be applied to a nftables ruleset on boot:\n\nRun the following command to verify the input base chain:\n\n```bash\n# [ -n \"$(grep -E '^\\s*include' /etc/nftables.conf)\" ] && awk '/hook input/,/}/' $(awk '$1 ~ /^\\s*include/ { gsub(\"\\\"\",\"\",$2);print $2 }' /etc/nftables.conf)\n```\n\nOutput should be similar to:\n\n```bash\ntype filter hook input priority 0; policy drop;\n\n # Ensure loopback traffic is configured\n iif \"lo\" accept\n ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop\n ip6 saddr ::1 counter packets 0 bytes 0 drop\n\n # Ensure established connections are configured\n ip protocol tcp ct state established accept\n ip protocol udp ct state established accept\n \n # Accept port 22(SSH) traffic from anywhere\n tcp dport ssh accept\n```\n\nReview the input base chain to ensure that it follows local site policy\n\nRun the following command to verify the forward base chain:\n\n```bash\n# [ -n \"$(grep -E '^\\s*include' /etc/nftables.conf)\" ] && awk '/hook forward/,/}/' $(awk '$1 ~ /^\\s*include/ { gsub(\"\\\"\",\"\",$2);print $2 }' /etc/nftables.conf)\n```\n\nOutput should be similar to:\n\n```bash\n# Base chain for hook forward named forward (Filters forwarded network packets)\n chain forward {\n type filter hook forward priority 0; policy drop;\n }\n```\n\nReview the forward base chain to ensure that it follows local site policy.\n\nRun the following command to verify the forward base chain:\n\n```bash\n# [ -n \"$(grep -E '^\\s*include' /etc/nftables.conf)\" ] && awk '/hook output/,/}/' $(awk '$1 ~ /^\\s*include/ { gsub(\"\\\"\",\"\",$2);print $2 }' /etc/nftables.conf)\n```\n\nOutput should be similar to:\n\n```bash\n# Base chain for hook output named output (Filters outbound network packets)\n chain output {\n type filter hook output priority 0; policy drop;\n # Ensure outbound and established connections are configured\n ip protocol tcp ct state established,related,new accept\n ip protocol udp ct state established,related,new accept\n \n }\n```\n\nReview the output base chain to ensure that it follows local site policy."},{"uuid":"bfee8661-1551-5bf7-87bb-b0480d6dddcb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.3.10_Ensure_nftables_rules_are_permanent"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables rules are permanent","description":"Edit the `/etc/nftables.conf` file and un-comment or add a line with `include ` for each nftables file you want included in the nftables ruleset on boot\n\nExample:\n\n```bash\n# vi /etc/nftables.conf\n```\n\nAdd the line:\n\n```bash\ninclude \"/etc/nftables.rules\"\n```"}],"title":"4.3.10 Ensure nftables rules are permanent","description":"nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.\n\nThe nftables service reads the `/etc/nftables.conf` file for a nftables file or files to include in the nftables ruleset.\n\nA nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.\n\n**Note:** Saving the script and following the instruction in the Configure nftables section overview will implement the rules in the configure nftable section, open port 22(ssh) from anywhere, and applies nftables ruleset on boot."},{"uuid":"580365be-2769-541d-af35-9fa614d5a16d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.1 Configure iptables software"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.1_Ensure_iptables_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.1.1"}],"steps":[{"uuid":"4d0a1a27-661a-5973-a83f-d270edb37e68","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.1_Ensure_iptables_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables packages are installed","remarks":"A method of configuring and maintaining firewall rules is necessary to configure a Host Based Firewall.","description":"## Description\n\n`iptables` is a utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall, implemented as different Netfilter modules, and the chains and rules it stores. Different kernel modules and programs are used for different protocols; `iptables` applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames.\n\n## Audit\n\nRun the following command to verify that `iptables` is installed:\n\n```bash\n# dpkg-query -s iptables &>/dev/null && echo \"iptables is installed\"\n\niptables is installed\n```\n\nRun the following command to verify that `iptables-persistent` is installed:\n\n```bash\n# dpkg-query -s iptables-persistent &>/dev/null && echo \"iptables-persistent is installed\"\n\niptables-persistent is installed\n```"},{"uuid":"00de0edf-07a0-5101-a196-c2b759ad9228","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.1_Ensure_iptables_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables packages are installed","description":"Run the following command to install `iptables` and `iptables-persistent`\n\n```bash\n# apt install iptables iptables-persistent\n```"}],"title":"4.4.1.1 Ensure iptables packages are installed","description":"`iptables` is a utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall, implemented as different Netfilter modules, and the chains and rules it stores. Different kernel modules and programs are used for different protocols; `iptables` applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames."},{"uuid":"f98019cb-0009-517a-81f6-5c15cebc5ba3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.1 Configure iptables software"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.2_Ensure_nftables_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.1.2"}],"steps":[{"uuid":"9bb1b337-1403-5f41-92a8-c1ed87720483","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.2_Ensure_nftables_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure nftables is not in use with iptables","remarks":"Running both `iptables` and `nftables` may lead to conflict.","description":"## Description\n\n`nftables` is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables.\n\n## Audit\n\nRun the following commend to verify that `nftables` is not installed:\n\n```bash\n# dpkg-query -s nftables &>/dev/null && echo \"nftables is installed\"\n```\n\nNothing should be returned\n\n**- OR -**\n\nRun the following command to verify `nftables.service` is not enabled:\n\n```bash\n# systemctl is-enabled nftables.service 2>/dev/null | grep '^enabled'\n```\n\nNothing should be returned\n\nRun the following command to verify `nftables.service` is not active:\n\n```bash\n# systemctl is-active nftables.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned"},{"uuid":"f4ec36eb-1cc4-5550-af50-c6415726698c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.2_Ensure_nftables_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nftables is not in use with iptables","description":"Run the following command to remove `nftables`:\n\n```bash\n# apt purge nftables\n```\n\n**- OR -**\n\nRun the following commands to stop and mask `nftables.service`:\n\n```bash\n# systemctl stop nftables.service\n# systemctl mask nftables.service\n```"}],"title":"4.4.1.2 Ensure nftables is not in use with iptables","description":"`nftables` is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables."},{"uuid":"643c075c-d845-5668-a87e-7b68cb2f72b5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.1 Configure iptables software"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.3_Ensure_ufw_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.1.3"}],"steps":[{"uuid":"d8863a66-8827-5259-ac01-288dd900a21f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.3_Ensure_ufw_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ufw is not in use with iptables","remarks":"Running `iptables.persistent` with `ufw` enabled may lead to conflict and unexpected results.","description":"## Description\n\nUncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n- Uses a command-line interface consisting of a small number of simple commands\n- Uses iptables for configuration\n\n## Audit\n\nRun the following commands to verify that `ufw` is **either** not installed or disabled. **Only one of the following needs to pass**.\n\nRun the following command to verify that `ufw` is not installed:\n\n```bash\n# dpkg-query -s ufw &>/dev/null && echo \"ufw is installed\"\n```\n\nNothing should be returned.\n\n**- OR -**\n\nRun the following command to verify ufw is disabled:\n\n```bash\n# ufw status\n\nStatus: inactive\n```\n\nRun the following commands to verify that the `ufw.service` is not enabled:\n\n```bash\n# systemctl is-enabled ufw 2>dev/null | grep '^enabled'\n```\n\nNothing should be returned\n\nRun the following command to verify `ufw.service` is not active:\n\n```bash\n# systemctl is-active ufw.service 2>/dev/null | grep '^active'\n```\n\nNothing should be returned"},{"uuid":"08d58631-8964-51ef-8e86-a039d2ce41d0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.1.3_Ensure_ufw_is_not_in_use_with_iptables"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ufw is not in use with iptables","description":"Run the following command to remove `ufw`:\n\n```bash\n# apt purge ufw\n```\n\n**- OR -**\n\nRun the following commands to disable ufw, and stop and mask `ufw.service`:\n\n```bash\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`"}],"title":"4.4.1.3 Ensure ufw is not in use with iptables","description":"Uncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n- Uses a command-line interface consisting of a small number of simple commands\n- Uses iptables for configuration"},{"uuid":"dcddc300-7105-511c-a60f-ca05482af265","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.2 Configure IPv4 iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.1_Ensure_iptables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.2.1"}],"steps":[{"uuid":"752f9131-0260-59f2-a887-850f0e97838f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.1_Ensure_iptables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables default deny firewall policy","remarks":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage.","description":"## Description\n\nA default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following command and verify that the policy for the `INPUT` , `OUTPUT` , and `FORWARD` chains is `DROP` or `REJECT` :\n\n```bash\n# iptables -L\nChain INPUT (policy DROP)\nChain FORWARD (policy DROP)\nChain OUTPUT (policy DROP)\n```"},{"uuid":"63cfff75-d408-5697-8bc4-bec2c7a90f54","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.1_Ensure_iptables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables default deny firewall policy","description":"Run the following commands to implement a default DROP policy:\n\n```bash\n# iptables -P INPUT DROP\n# iptables -P OUTPUT DROP\n# iptables -P FORWARD DROP\n```"}],"title":"4.4.2.1 Ensure iptables default deny firewall policy","description":"A default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"c179417b-7838-5298-a698-9778b9fb1980","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.2 Configure IPv4 iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.2_Ensure_iptables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.2.2"}],"steps":[{"uuid":"01586600-48c9-5db5-80b8-eaba07d5ea5b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.2_Ensure_iptables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables loopback traffic is configured","remarks":"Loopback traffic is generated between processes on machine and is typically critical to the operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.","description":"## Description\n\nConfigure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following commands and verify output includes the listed rules in order (`pkts` and `bytes` counts may differ, `prot` may be `all` or `0`):\n\n```bash\n# iptables -L INPUT -v -n\nChain INPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination\n 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0\n 0 0 DROP all -- * * 127.0.0.0/8 0.0.0.0/0\n\n # iptables -L OUTPUT -v -n\nChain OUTPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination\n 0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0\n```"},{"uuid":"97305e17-d13f-5e3b-bfcd-1ef5016c05d3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.2_Ensure_iptables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables loopback traffic is configured","description":"Run the following commands to implement the loopback rules:\n\n```bash\n# iptables -A INPUT -i lo -j ACCEPT\n# iptables -A OUTPUT -o lo -j ACCEPT\n# iptables -A INPUT -s 127.0.0.0/8 -j DROP\n```"}],"title":"4.4.2.2 Ensure iptables loopback traffic is configured","description":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"fe9a702e-9645-5256-add9-1b667be8934c","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.2 Configure IPv4 iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.3_Ensure_iptables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.2.3"}],"steps":[{"uuid":"6638f787-fb67-5c37-b424-7311e8390043","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.3_Ensure_iptables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables outbound and established connections are configured","remarks":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage.","description":"## Description\n\nConfigure the firewall rules for new outbound, and established connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following command and verify all rules for new outbound, and established connections match site policy:\n\n```bash\n# iptables -L -v -n\n```"},{"uuid":"44bb6ff0-b32f-5c44-a59e-e2491bce94c8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.3_Ensure_iptables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables outbound and established connections are configured","description":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```bash\n# iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"}],"title":"4.4.2.3 Ensure iptables outbound and established connections are configured","description":"Configure the firewall rules for new outbound, and established connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"5a3a89e3-2a45-502f-bcfb-6840a2de6241","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.2 Configure IPv4 iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.4_Ensure_iptables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.2.4"}],"steps":[{"uuid":"9e4a059c-5cdd-54fe-8c6a-1333295a1f29","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.4_Ensure_iptables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure iptables firewall rules exist for all open ports","remarks":"Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports.","description":"## Description\n\nAny ports that have been opened on non-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy\n\n## Audit\n\nRun the following command to determine open ports:\n\n```bash\n# ss -4tuln\n\nNetid State Recv-Q Send-Q Local Address:Port Peer Address:Port\nudp UNCONN 0 0 *:68 *:*\nudp UNCONN 0 0 *:123 *:*\ntcp LISTEN 0 128 *:22 *:*\n```\n\nRun the following command to determine firewall rules:\n\n```bash\n# iptables -L INPUT -v -n\nChain INPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination\n 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0\n 0 0 DROP all -- * * 127.0.0.0/8 0.0.0.0/0\n 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW\n```\n\nVerify all open ports listening on non-localhost addresses have at least one firewall rule.\n\nThe last line identified by the `tcp dpt:22 state NEW` identifies it as a firewall rule for new connections on tcp port 22."},{"uuid":"35a9303b-b314-5fcd-847b-9d865e2a5dd7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.2.4_Ensure_iptables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure iptables firewall rules exist for all open ports","description":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```bash\n# iptables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"}],"title":"4.4.2.4 Ensure iptables firewall rules exist for all open ports","description":"Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy"},{"uuid":"10914118-f25b-51e8-9b07-63cd72e13570","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.3 Configure IPv6 ip6tables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.1_Ensure_ip6tables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.3.1"}],"steps":[{"uuid":"32f33469-d687-50c8-ad73-0dd3b340102e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.1_Ensure_ip6tables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ip6tables default deny firewall policy","remarks":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage.","description":"## Description\n\nA default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following command and verify that the policy for the INPUT, OUTPUT, and FORWARD chains is DROP or REJECT:\n\n```bash\n# ip6tables -L\nChain INPUT (policy DROP)\nChain FORWARD (policy DROP)\nChain OUTPUT (policy DROP)\n```\n\n**- OR -**\n\nVerify IPv6 is disabled:\n\nRun the following script. Output will confirm if IPv6 is enabled on the system.\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_ipv6_enabled=\"is\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_enabled=\"is not\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_enabled=\"is not\"\n fi\n echo -e \" - IPv6 $l_ipv6_enabled enabled on the system\"\n}\n```"},{"uuid":"0c6a2d42-b96b-5cc0-928b-d124f9efd5fc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.1_Ensure_ip6tables_default_deny_firewall_policy"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ip6tables default deny firewall policy","description":"**- IF -** IPv6 is enabled on your system:\n\nRun the following commands to implement a default DROP policy:\n\n```bash\n# ip6tables -P INPUT DROP\n# ip6tables -P OUTPUT DROP\n# ip6tables -P FORWARD DROP\n```"}],"title":"4.4.3.1 Ensure ip6tables default deny firewall policy","description":"A default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"f05e3dc3-dd7a-5801-b19a-6c3048a8f20b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.3 Configure IPv6 ip6tables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.2_Ensure_ip6tables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.3.2"}],"steps":[{"uuid":"b4365d6a-2f57-5c32-a695-096b3986a092","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.2_Ensure_ip6tables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ip6tables loopback traffic is configured","remarks":"Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (::1) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.","description":"## Description\n\nConfigure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (::1).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following commands and verify output includes the listed rules in order (packet and byte counts may differ):\n\n```bash\n# ip6tables -L INPUT -v -n\nChain INPUT (policy DROP 0 packets, 0 bytes)\npkts bytes target prot opt in out source destination\n 0 0 ACCEPT all lo * ::/0 ::/0 \n 0 0 DROP all * * ::1 ::/0 \n\n# ip6tables -L OUTPUT -v -n\nChain OUTPUT (policy DROP 0 packets, 0 bytes)\npkts bytes target prot opt in out source destination\n 0 0 ACCEPT all * lo ::/0 ::/0\n```\n\n**- OR -**\n\nVerify IPv6 is disabled:\n\nRun the following script. Output will confirm if IPv6 is enabled on the system.\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_ipv6_enabled=\"is\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_enabled=\"is not\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_enabled=\"is not\"\n fi\n echo -e \" - IPv6 $l_ipv6_enabled enabled on the system\"\n}\n```"},{"uuid":"99e11265-633f-5724-9cf0-ef2159b5afae","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.2_Ensure_ip6tables_loopback_traffic_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ip6tables loopback traffic is configured","description":"Run the following commands to implement the loopback rules:\n\n```bash\n# ip6tables -A INPUT -i lo -j ACCEPT\n# ip6tables -A OUTPUT -o lo -j ACCEPT\n# ip6tables -A INPUT -s ::1 -j DROP\n```"}],"title":"4.4.3.2 Ensure ip6tables loopback traffic is configured","description":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (::1).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"7fab1843-10f5-512d-8013-5354c1f3a4df","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.3 Configure IPv6 ip6tables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.3_Ensure_ip6tables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.3.3"}],"steps":[{"uuid":"9127b50a-77b7-5946-b583-4c138aa8eb7a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.3_Ensure_ip6tables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ip6tables outbound and established connections are configured","remarks":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage.","description":"## Description\n\nConfigure the firewall rules for new outbound, and established IPv6 connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n\n## Audit\n\nRun the following command and verify all rules for new outbound, and established connections match site policy:\n\n```bash\n# ip6tables -L -v -n\n```\n\n**- OR -**\n\nVerify IPv6 is disabled:\n\nRun the following script. Output will confirm if IPv6 is enabled on the system.\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_ipv6_enabled=\"is\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_enabled=\"is not\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_enabled=\"is not\"\n fi\n echo -e \" - IPv6 $l_ipv6_enabled enabled on the system\"\n}\n```"},{"uuid":"48b51006-b4db-590e-a9a1-03138f02b8b1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.3_Ensure_ip6tables_outbound_and_established_connections_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ip6tables outbound and established connections are configured","description":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```bash\n# ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"}],"title":"4.4.3.3 Ensure ip6tables outbound and established connections are configured","description":"Configure the firewall rules for new outbound, and established IPv6 connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"uuid":"36265d47-6aca-529b-a0eb-9abacb8008c4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Host Based Firewall"},{"ns":"https://cisecurity.org/ns","name":"group","value":"4 Host Based Firewall > 4.4 Configure iptables > 4.4.3 Configure IPv6 ip6tables"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.4_Ensure_ip6tables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"4.4.3.4"}],"steps":[{"uuid":"160b2c84-4f90-5bbd-b207-c6e8de35d5a5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.4_Ensure_ip6tables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CA-9"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:4"}],"title":"Audit for Ensure ip6tables firewall rules exist for all open ports","remarks":"Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports.","description":"## Description\n\nAny ports that have been opened on non-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy\n\n## Audit\n\nRun the following command to determine open ports:\n\n```bash\n# ss -6tuln\n\nNetid State Recv-Q Send-Q Local Address:Port Peer Address:Port \nudp UNCONN 0 0 ::1:123 :::*\nudp UNCONN 0 0 :::123 :::*\ntcp LISTEN 0 128 :::22 :::*\ntcp LISTEN 0 20 ::1:25 :::*\n```\n\nRun the following command to determine firewall rules:\n\n```bash\n# ip6tables -L INPUT -v -n\n\nChain INPUT (policy DROP 0 packets, 0 bytes)\n pkts bytes target prot opt in out source destination \n 0 0 ACCEPT all lo * ::/0 ::/0 \n 0 0 DROP all * * ::1 ::/0 \n 0 0 ACCEPT tcp * * ::/0 ::/0 tcp dpt:22 state NEW\n```\n\nVerify all open ports listening on non-localhost addresses have at least one firewall rule.\n\nThe last line identified by the \"tcp dpt:22 state NEW\" identifies it as a firewall rule for new connections on tcp port 22.\n\n**- OR -** verify IPv6 is not enabled:\n\nRun the following script. Output will confirm if IPv6 is enabled on the system:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_ipv6_enabled=\"is\"\n ! grep -Pqs -- '^\\h*0\\b' /sys/module/ipv6/parameters/disable && l_ipv6_enabled=\"is not\"\n if sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.all\\.disable_ipv6\\h*=\\h*1\\b\" && \\\n sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- \"^\\h*net\\.ipv6\\.conf\\.default\\.disable_ipv6\\h*=\\h*1\\b\"; then\n l_ipv6_enabled=\"is not\"\n fi\n echo -e \" - IPv6 $l_ipv6_enabled enabled on the system\"\n}\n```"},{"uuid":"a2c6e413-90c0-596a-9376-7a88c5d23cf6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_4.4.3.4_Ensure_ip6tables_firewall_rules_exist_for_all_open_ports"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure ip6tables firewall rules exist for all open ports","description":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```bash\n# ip6tables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"}],"title":"4.4.3.4 Ensure ip6tables firewall rules exist for all open ports","description":"Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy"},{"uuid":"c95b9b9c-2204-5a1c-8c80-3dd21025f28a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.1_Ensure_permissions_on_etcsshsshd_config_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.1"}],"steps":[{"uuid":"6536e942-8bfe-596b-8112-30c8936444a8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.1_Ensure_permissions_on_etcsshsshd_config_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/ssh/sshd_config are configured","remarks":"configuration specifications for `sshd` need to be protected from unauthorized changes by non-privileged users.","description":"## Description\n\nThe file `/etc/ssh/sshd_config`, and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory, contain configuration specifications for `sshd`.\n\n## Audit\n\nRun the following script and verify `/etc/ssh/sshd_config` and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory are:\n\n- Mode `0600` or more restrictive\n- Owned by the `root` user\n- Group owned by the group `root`.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n perm_mask='0177' && maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\"\n f_sshd_files_chk()\n {\n while IFS=: read -r l_mode l_user l_group; do\n a_out2=()\n [ $(( $l_mode & $perm_mask )) -gt 0 ] && a_out2+=(\" Is mode: \\\"$l_mode\\\"\" \\\n \" should be mode: \\\"$maxperm\\\" or more restrictive\")\n [ \"$l_user\" != \"root\" ] && a_out2+=(\" Is owned by \\\"$l_user\\\" should be owned by \\\"root\\\"\")\n [ \"$l_group\" != \"root\" ] && a_out2+=(\" Is group owned by \\\"$l_user\\\" should be group owned by \\\"root\\\"\")\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\":\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\":\" \" Correct: mode ($l_mode), owner ($l_user)\" \\\n \" and group owner ($l_group) configured\")\n fi\n done /dev/null)\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\n**- IF -** other locations are listed in an `Include` statement, `*.conf` files in these locations should also be checked."},{"uuid":"f6c9d408-93e2-5b2b-a819-1d208729adaf","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.1_Ensure_permissions_on_etcsshsshd_config_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/ssh/sshd_config are configured","description":"Run the following script to set ownership and permissions on `/etc/ssh/sshd_config` and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory:\n\n```bash\n#!/usr/bin/env bash\n\n{\n chmod u-x,og-rwx /etc/ssh/sshd_config\n chown root:root /etc/ssh/sshd_config\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n chmod u-x,og-rwx \"$l_file\"\n chown root:root \"$l_file\"\n fi\n done /dev/null)\n}\n```\n\n**- IF -** other locations are listed in an `Include` statement, `*.conf` files in these locations access should also be modified."}],"title":"5.1.1 Ensure permissions on /etc/ssh/sshd_config are configured","description":"The file `/etc/ssh/sshd_config`, and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory, contain configuration specifications for `sshd`."},{"uuid":"9a8ace36-0081-5740-9072-bb42841e9d2c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.2_Ensure_permissions_on_SSH_private_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.2"}],"steps":[{"uuid":"6c814cf9-3f8e-554b-bc0b-97ae30c0cd2c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.2_Ensure_permissions_on_SSH_private_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on SSH private host key files are configured","remarks":"If an unauthorized user obtains the private SSH host key file, the host could be impersonated","description":"## Description\n\nAn SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed.\n\n## Audit\n\nRun the following script to verify SSH private host key files are owned by the root user and either:\n\n- owned by the group root and mode `0600` or more restrictive\n\n**- OR -**\n\n- owned by the group designated to own openSSH private keys and mode `0640` or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n l_ssh_group_name=\"$(awk -F: '($1 ~ /^(ssh_keys|_?ssh)$/) {print $1}' /etc/group)\"\n f_file_chk()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ \"$l_file_group\" = \"$l_ssh_group_name\" ] && l_pmask=\"0137\" || l_pmask=\"0177\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\")\n fi\n if [ \"$l_file_owner\" != \"root\" ]; then\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\")\n fi\n if [[ ! \"$l_file_group\" =~ ($l_ssh_group_name|root) ]]; then\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"$l_ssh_group_name\\\" or \\\"root\\\"\")\n fi\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\" and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done /dev/null \"$l_file\"; then \n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?private\\h+key\\b' && f_file_chk\n fi\n done /dev/null)\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"8e5815e6-285e-52c2-89e8-84094df2a898","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.2_Ensure_permissions_on_SSH_private_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on SSH private host key files are configured","description":"Run the following script to set mode, ownership, and group on the private SSH host key files:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ssh_group_name=\"$(awk -F: '($1 ~ /^(ssh_keys|_?ssh)$/) {print $1}' /etc/group)\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ \"$l_file_group\" = \"$l_ssh_group_name\" ] && l_pmask=\"0137\" || l_pmask=\"0177\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\:$l_maxperm\\\"\")\n if [ \"l_file_group\" = \"$l_ssh_group_name\" ]; then\n chmod u-x,g-wx,o-rwx \"$l_file\"\n else\n chmod u-x,go-rwx \"$l_file\"\n fi\n fi\n if [ \"$l_file_owner\" != \"root\" ]; then\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\")\n chown root \"$l_file\"\n fi\n if [[ ! \"$l_file_group\" =~ ($l_ssh_group_name|root) ]]; then\n [ -n \"$l_ssh_group_name\" ] && l_new_group=\"$l_ssh_group_name\" || l_new_group=\"root\"\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"$l_ssh_group_name\\\" or \\\"root\\\"\" \\\n \" Changing group ownership to \\\"$l_new_group\\\"\")\n chgrp \"$l_new_group\" \"$l_file\"\n fi\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \"Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done /dev/null \"$l_file\"; then \n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?private\\h+key\\b' && f_file_access_fix\n fi\n done /dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \"\" \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"}],"title":"5.1.2 Ensure permissions on SSH private host key files are configured","description":"An SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed."},{"uuid":"2cd6148c-97e1-5c12-8519-9fc2ad73dd0f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.3_Ensure_permissions_on_SSH_public_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.3"}],"steps":[{"uuid":"fcd99a1f-35ff-5940-afed-532d5e6c6642","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.3_Ensure_permissions_on_SSH_public_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on SSH public host key files are configured","remarks":"If a public host key file is modified by an unauthorized user, the SSH service may be compromised.","description":"## Description\n\nAn SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully.\n\n## Audit\n\nRun the following command and verify Access does not grant write or execute permissions to group or other for all returned files:\n\nRun the following script to verify SSH public host key files are mode `0644` or more restrictive, owned by the `root` user, and owned by the `root` group:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n l_pmask=\"0133\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n f_file_chk()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\")\n fi\n if [ \"$l_file_owner\" != \"root\" ]; then\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by: \\\"root\\\"\")\n fi\n if [ \"$l_file_group\" != \"root\" ]; then\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by group: \\\"root\\\"\")\n fi\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\" and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done /dev/null \"$l_file\"; then \n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?public\\h+key\\b' && f_file_chk\n fi\n done /dev/null)\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n [ \"${#a_output[@]}\" -le 0 ] && a_output+=(\" - No openSSH public keys found\")\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"7e79700d-7b84-5104-a5c2-e8cc282d93a3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.3_Ensure_permissions_on_SSH_public_host_key_files_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on SSH public host key files are configured","description":"Run the following script to set mode, ownership, and group on the public SSH host key files:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n l_pmask=\"0133\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ $(( $l_file_mode & $l_pmask )) -gt 0 ] && \\\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\\"$l_maxperm\\\"\") && chmod u-x,go-wx \"$l_file\"\n [ \"$l_file_owner\" != \"root\" ] && \\\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\") && chown root \"$l_file\"\n [ \"$l_file_group\" != \"root\" ] && \\\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"root\\\"\" \\\n \" Changing group ownership to \\\"root\\\"\") && chgrp root \"$l_file\"\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done /dev/null \"$l_file\"; then \n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?public\\h+key\\b' && f_file_access_fix\n fi\n done /dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"}],"title":"5.1.3 Ensure permissions on SSH public host key files are configured","description":"An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully."},{"uuid":"be22d935-86b1-53f5-8149-2bb9ebd2a02d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.4_Ensure_sshd_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.4"}],"steps":[{"uuid":"0924af91-faa8-58a2-a0d0-7c86a5657ac7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.4_Ensure_sshd_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure sshd access is configured","remarks":"Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system.","description":"## Description\n\nThere are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged:\n\n- `AllowUsers`:\n\nThe `AllowUsers` variable gives the system administrator the option of allowing specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host.\n\n- `AllowGroups`:\n\nThe `AllowGroups` variable gives the system administrator the option of allowing specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n\n- `DenyUsers`:\n\nThe `DenyUsers` variable gives the system administrator the option of denying specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host.\n\n- `DenyGroups`:\n\nThe `DenyGroups` variable gives the system administrator the option of denying specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n\n## Audit\n\nRun the following command and verify the output:\n\n```bash\n# sshd -T | grep -Pi -- '^\\h*(allow|deny)(users|groups)\\h+\\H+'\n```\n\nVerify that the output matches at least one of the following lines:\n\n```bash\nallowusers \n-OR-\nallowgroups \n-OR-\ndenyusers \n-OR-\ndenygroups\n```\n\nReview the list(s) to ensure included users and/or groups follow local site policy\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep -Pi -- '^\\h*(allow|deny)(users|groups)\\h+\\H+'\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)."},{"uuid":"9061f92f-89a3-525a-b1ef-6c4b0873201e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.4_Ensure_sshd_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd access is configured","description":"Edit the `/etc/ssh/sshd_config` file to set one or more of the parameters above any `Include` and `Match` set statements as follows:\n\n```bash\nAllowUsers \n - AND/OR -\nAllowGroups\n```\n\n**Note:**\n\n- First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a `.conf` file in a `Include` directory.\n- **Be advised** that these options are \"ANDed\" together. If both `AllowUsers` and `AllowGroups` are set, connections will be limited to the list of users that are also a member of an allowed group. It is recommended that only one be set for clarity and ease of administration.\n- It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user or group and forget to add it to the deny list."}],"title":"5.1.4 Ensure sshd access is configured","description":"There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged:\n\n- `AllowUsers`:\n\nThe `AllowUsers` variable gives the system administrator the option of allowing specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host.\n\n- `AllowGroups`:\n\nThe `AllowGroups` variable gives the system administrator the option of allowing specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n\n- `DenyUsers`:\n\nThe `DenyUsers` variable gives the system administrator the option of denying specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host.\n\n- `DenyGroups`:\n\nThe `DenyGroups` variable gives the system administrator the option of denying specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable."},{"uuid":"3695776a-b3ec-51ee-800d-edde1e448bad","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.5_Ensure_sshd_Banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.5"}],"steps":[{"uuid":"f1aa8608-d16e-598f-a74f-064a611512ba","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.5_Ensure_sshd_Banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd Banner is configured","remarks":"Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user login may assist the prosecution of trespassers on the computer system.","description":"## Description\n\nThe `Banner` parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed.\n\n## Audit\n\nRun the following command to verify `Banner` is set:\n\n```bash\n# sshd -T | grep -Pi -- '^banner\\h+\\/\\H+'\n```\n\nExample:\n\n```bash\nbanner /etc/issue.net\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep -Pi -- '^banner\\h+\\/\\H+'\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain).\n\nRun the following command and verify that the contents or the file being called by the `Banner` argument match site policy:\n\n```bash\n# [ -e \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\" ] && cat \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"\n```\n\nRun the following command and verify no results are returned:\n\n```bash\n# grep -Psi -- \"(\\\\\\v|\\\\\\r|\\\\\\m|\\\\\\s|\\b$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/\"//g')\\b)\" \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"\n```"},{"uuid":"77ab45e5-ded6-5e57-9fb4-8706f956faac","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.5_Ensure_sshd_Banner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd Banner is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `Banner` parameter above any `Include` and `Match` entries as follows:\n\n```bash\nBanner /etc/issue.net\n```\n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\nEdit the file being called by the `Banner` argument with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform`\n\nExample:\n\n```bash\n# printf '%s\\n' \"Authorized users only. All activity may be monitored and reported.\" > \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"\n```"}],"title":"5.1.5 Ensure sshd Banner is configured","description":"The `Banner` parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed."},{"uuid":"35382b86-0e98-5ab0-887e-c159b0661800","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.6_Ensure_sshd_Ciphers_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.6"}],"steps":[{"uuid":"8ee8d8b9-3a88-5a32-b618-539b2de730e0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.6_Ensure_sshd_Ciphers_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/10"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:10"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:4"}],"title":"Audit for Ensure sshd Ciphers are configured","remarks":"Weak ciphers that are used for authentication to the cryptographic module cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.\n\n- The Triple DES ciphers, as used in SSH, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain clear text data via a birthday attack against a long-duration encrypted session, aka a \"Sweet32\" attack.\n- Error handling in the SSH protocol; Client and Server, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plain text data from an arbitrary block of cipher text in an SSH session via unknown vectors.","description":"## Description\n\nThis variable limits the ciphers that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved ciphers.\n- Ensure that ciphers used are in compliance with site policy.\n- The only \"strong\" ciphers currently FIPS 140 compliant are:\n\naes256-gcm@openssh.com\n- aes128-gcm@openssh.com\n- aes256-ctr\n- aes192-ctr\n- aes128-ctr\n\n## Audit\n\nRun the following command to verify none of the \"weak\" ciphers are being used:\n\n```bash\n# sshd -T | grep -Pi -- '^ciphers\\h+\\\"?([^#\\n\\r]+,)?((3des|blowfish|cast128|aes(128|192|256))-cbc|arcfour(128|256)?|rijndael-cbc@lysator\\.liu\\.se|chacha20-poly1305@openssh\\.com)\\b'\n```\n\n**- IF -** a line is returned, review the list of ciphers. If the line includes `chacha20-poly1305@openssh.com`, review `CVE-2023-48795` and verify the system has been patched. No ciphers in the list below should be returned as they're considered \"weak\":\n\n```bash\n3des-cbc\naes128-cbc\naes192-cbc\naes256-cbc\n```"},{"uuid":"a6bb4872-049e-55d2-a692-c490140acd8b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.6_Ensure_sshd_Ciphers_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd Ciphers are configured","description":"Edit the /etc/ssh/sshd_config file and add/modify the `Ciphers` line to contain a comma separated list of the site unapproved (weak) Ciphers preceded with a `-` above any `Include` entries:\n\nExample:\n\n```bash\nCiphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,chacha20-poly1305@openssh.com\n```\n\n**- IF -** `CVE-2023-48795` has been addressed, and it meets local site policy, `chacha20-poly1305@openssh.com` may be removed from the list of excluded ciphers.\n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.6 Ensure sshd Ciphers are configured","description":"This variable limits the ciphers that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved ciphers.\n- Ensure that ciphers used are in compliance with site policy.\n- The only \"strong\" ciphers currently FIPS 140 compliant are:\n\naes256-gcm@openssh.com\n- aes128-gcm@openssh.com\n- aes256-ctr\n- aes192-ctr\n- aes128-ctr"},{"uuid":"8603629f-da14-567c-92bf-37b9b27f20ba","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.7_Ensure_sshd_ClientAliveInterval_and_ClientAliveCountMax_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.7"}],"steps":[{"uuid":"11db4bb5-d99b-5adc-b330-5d0cbe5845e7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.7_Ensure_sshd_ClientAliveInterval_and_ClientAliveCountMax_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured","remarks":"In order to prevent resource exhaustion, appropriate values should be set for both `ClientAliveInterval` and `ClientAliveCountMax`. Specifically, looking at the source code, `ClientAliveCountMax` must be greater than zero in order to utilize the ability of SSH to drop idle connections. If connections are allowed to stay open indefinitely, this can potentially be used as a DDOS attack or simple resource exhaustion could occur over unreliable networks.\n\nThe example set here is a 45 second timeout. Consult your site policy for network timeouts and apply as appropriate.","description":"## Description\n\n**Note:** To clarify, the two settings described below are only meant for idle connections from a protocol perspective and are not meant to check if the user is active or not. An idle user does not mean an idle connection. SSH does not and never had, intentionally, the capability to drop idle users. In SSH versions before `8.2p1` there was a bug that caused these values to behave in such a manner that they were abused to disconnect idle users. This bug has been resolved in `8.2p1` and thus it can no longer be abused disconnect idle users.\n\nThe two options `ClientAliveInterval` and `ClientAliveCountMax` control the timeout of SSH sessions. Taken directly from `man 5 sshd_config`:\n\n- \n`ClientAliveInterval` Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client.\n\n- \n`ClientAliveCountMax` Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option en‐abled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become unresponsive.\nThe default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds. Setting a zero ClientAliveCountMax disables connection termination.\n\n## Audit\n\nRun the following command and verify `ClientAliveInterval` and `ClientAliveCountMax` are greater than zero:\n\n```bash\n# sshd -T | grep -Pi -- '(clientaliveinterval|clientalivecountmax)'\n```\n\nExample Output:\n\n```bash\nclientaliveinterval 15\nclientalivecountmax 3\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep -Pi -- '(clientaliveinterval|clientalivecountmax)'\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)."},{"uuid":"cc0758d2-39e9-58b2-8cfa-f6833baa291b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.7_Ensure_sshd_ClientAliveInterval_and_ClientAliveCountMax_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `ClientAliveInterval` and `ClientAliveCountMax` parameters above any `Include` and `Match` entries according to site policy.\n\nExample:\n\n```bash\nClientAliveInterval 15\nClientAliveCountMax 3\n```\n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.7 Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured","description":"**Note:** To clarify, the two settings described below are only meant for idle connections from a protocol perspective and are not meant to check if the user is active or not. An idle user does not mean an idle connection. SSH does not and never had, intentionally, the capability to drop idle users. In SSH versions before `8.2p1` there was a bug that caused these values to behave in such a manner that they were abused to disconnect idle users. This bug has been resolved in `8.2p1` and thus it can no longer be abused disconnect idle users.\n\nThe two options `ClientAliveInterval` and `ClientAliveCountMax` control the timeout of SSH sessions. Taken directly from `man 5 sshd_config`:\n\n- \n`ClientAliveInterval` Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client.\n\n- \n`ClientAliveCountMax` Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option en‐abled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become unresponsive.\nThe default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds. Setting a zero ClientAliveCountMax disables connection termination."},{"uuid":"e876879a-cd91-52a1-a1da-35ee9ed90475","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.8_Ensure_sshd_DisableForwarding_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.8"}],"steps":[{"uuid":"1cc7e6b1-0d97-569c-9e25-1c6d297d3354","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.8_Ensure_sshd_DisableForwarding_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure sshd DisableForwarding is enabled","remarks":"Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.\n\nanyone with root privilege on the the intermediate server can make free use of ssh-agent to authenticate them to other servers\n\nLeaving port forwarding enabled can expose the organization to security risks and backdoors. SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications, or to exfiltrate stolen data from the target network.","description":"## Description\n\nThe `DisableForwarding` parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations.\n\n- X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections.\n- ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh.\n- SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines.\n\n## Audit\n\nRun the following command to verify `DisableForwarding` is set to `yes`:\n\n```bash\n# sshd -T | grep -i disableforwarding\n\ndisableforwarding yes\n```"},{"uuid":"77deb1a8-f35f-5296-8377-6a60b24dd10b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.8_Ensure_sshd_DisableForwarding_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd DisableForwarding is enabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `DisableForwarding` parameter to `yes` above any `Include` entry as follows:\n\n```bash\nDisableForwarding yes\n```\n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\nImpact:\n\nSSH tunnels are widely used in many corporate environments. In some environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI-DSS, and other standards can be achieved without having to modify the applications."}],"title":"5.1.8 Ensure sshd DisableForwarding is enabled","description":"The `DisableForwarding` parameter disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations.\n\n- X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections.\n- ssh-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh.\n- SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines."},{"uuid":"acecf283-289d-5e82-a88b-9e6038019d43","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.9_Ensure_sshd_GSSAPIAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.9"}],"steps":[{"uuid":"3b479f0e-7dc8-5b81-9997-8c2b3786c5a1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.9_Ensure_sshd_GSSAPIAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure sshd GSSAPIAuthentication is disabled","remarks":"Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, and should be disabled to reduce the attack surface of the system","description":"## Description\n\nThe `GSSAPIAuthentication` parameter specifies whether user authentication based on GSSAPI is allowed\n\n## Audit\n\nRun the following command to verify `GSSAPIAuthentication` is set to `no`:\n\n```bash\n# sshd -T | grep gssapiauthentication\n\ngssapiauthentication no\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep gssapiauthentication\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"81c27014-8d0d-512e-8a10-5fae665feaf0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.9_Ensure_sshd_GSSAPIAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd GSSAPIAuthentication is disabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `GSSAPIAuthentication` parameter to `no` above any `Include` and `Match` entries as follows:\n\n```bash\nGSSAPIAuthentication no\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.9 Ensure sshd GSSAPIAuthentication is disabled","description":"The `GSSAPIAuthentication` parameter specifies whether user authentication based on GSSAPI is allowed"},{"uuid":"cede5810-2983-55cf-9714-65f6e28887bc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.10_Ensure_sshd_HostbasedAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.10"}],"steps":[{"uuid":"fa7f81b8-5d8a-50aa-ba2c-68fafecc6d15","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.10_Ensure_sshd_HostbasedAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd HostbasedAuthentication is disabled","remarks":"Even though the `.rhosts` files are ineffective if support is disabled in `/etc/pam.conf`, disabling the ability to use `.rhosts` files in SSH provides an additional layer of protection.","description":"## Description\n\nThe `HostbasedAuthentication` parameter specifies if authentication is allowed through trusted hosts via the user of `.rhosts`, or `/etc/hosts.equiv`, along with successful public key client host authentication.\n\n## Audit\n\nRun the following command to verify `HostbasedAuthentication` is set to `no`:\n\n```bash\n# sshd -T | grep hostbasedauthentication\n\nhostbasedauthentication no\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep hostbasedauthentication\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"424f6cf4-d643-558b-98bc-3b9a028d110a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.10_Ensure_sshd_HostbasedAuthentication_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd HostbasedAuthentication is disabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `HostbasedAuthentication` parameter to `no` above any `Include` and `Match` entries as follows:\n\n```bash\nHostbasedAuthentication no\n```\n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.10 Ensure sshd HostbasedAuthentication is disabled","description":"The `HostbasedAuthentication` parameter specifies if authentication is allowed through trusted hosts via the user of `.rhosts`, or `/etc/hosts.equiv`, along with successful public key client host authentication."},{"uuid":"a863b2b9-7adf-5a35-83a4-b5e9c9a985cc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.11_Ensure_sshd_IgnoreRhosts_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.11"}],"steps":[{"uuid":"5bad0403-4a22-55d5-af88-b9bc16c2411a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.11_Ensure_sshd_IgnoreRhosts_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure sshd IgnoreRhosts is enabled","remarks":"Setting this parameter forces users to enter a password when authenticating with SSH.","description":"## Description\n\nThe `IgnoreRhosts` parameter specifies that `.rhosts` and `.shosts` files will not be used in `RhostsRSAAuthentication` or `HostbasedAuthentication`.\n\n## Audit\n\nRun the following command to verify `IgnoreRhosts` is set to `yes`:\n\n```bash\n# sshd -T | grep ignorerhosts\n\nignorerhosts yes\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep ignorerhosts\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"8fd86ad3-419b-54a6-b6e8-e4ea6d634bd1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.11_Ensure_sshd_IgnoreRhosts_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd IgnoreRhosts is enabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `IgnoreRhosts` parameter to `yes` above any `Include` and `Match` entries as follows:\n\n```bash\nIgnoreRhosts yes\n```\n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.11 Ensure sshd IgnoreRhosts is enabled","description":"The `IgnoreRhosts` parameter specifies that `.rhosts` and `.shosts` files will not be used in `RhostsRSAAuthentication` or `HostbasedAuthentication`."},{"uuid":"f328e566-af01-5e3d-9198-542666c40a61","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.12_Ensure_sshd_KexAlgorithms_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.12"}],"steps":[{"uuid":"42e1fa0d-596e-5272-8c37-13710be0537f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.12_Ensure_sshd_KexAlgorithms_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/10"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:10"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:4"}],"title":"Audit for Ensure sshd KexAlgorithms is configured","remarks":"Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used, or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man-in-the-middle attacks","description":"## Description\n\nKey exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received\n\n**Notes:**\n\n- Kex algorithms have a higher preference the earlier they appear in the list\n- Some organizations may have stricter requirements for approved Key exchange algorithms\n- Ensure that Key exchange algorithms used are in compliance with site policy\n- The only Key Exchange Algorithms currently FIPS 140 approved are:\n\necdh-sha2-nistp256\n- ecdh-sha2-nistp384\n- ecdh-sha2-nistp521\n- diffie-hellman-group-exchange-sha256\n- diffie-hellman-group16-sha512\n- diffie-hellman-group18-sha512\n- diffie-hellman-group14-sha256\n\n## Audit\n\nRun the following command to verify none of the \"weak\" Key Exchange algorithms are being used:\n\n```bash\n# sshd -T | grep -Pi -- 'kexalgorithms\\h+([^#\\n\\r]+,)?(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)\\b'\n\nNothing should be returned\n```\n\nThe following are considered \"weak\" Key Exchange Algorithms, and should not be used:\n\n```bash\ndiffie-hellman-group1-sha1\ndiffie-hellman-group14-sha1\ndiffie-hellman-group-exchange-sha1\n```"},{"uuid":"c6941574-7913-5c19-b0d5-1bae0c427da6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.12_Ensure_sshd_KexAlgorithms_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd KexAlgorithms is configured","description":"Edit the `/etc/ssh/sshd_config` file and add/modify the `KexAlgorithms` line to contain a comma separated list of the site unapproved (weak) KexAlgorithms preceded with a `-` above any `Include` entries:\n\nExample:\n\n```bash\nKexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n```\n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.12 Ensure sshd KexAlgorithms is configured","description":"Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received\n\n**Notes:**\n\n- Kex algorithms have a higher preference the earlier they appear in the list\n- Some organizations may have stricter requirements for approved Key exchange algorithms\n- Ensure that Key exchange algorithms used are in compliance with site policy\n- The only Key Exchange Algorithms currently FIPS 140 approved are:\n\necdh-sha2-nistp256\n- ecdh-sha2-nistp384\n- ecdh-sha2-nistp521\n- diffie-hellman-group-exchange-sha256\n- diffie-hellman-group16-sha512\n- diffie-hellman-group18-sha512\n- diffie-hellman-group14-sha256"},{"uuid":"7ac712c5-9358-53c6-bebc-606a1bbba90e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.13_Ensure_sshd_LoginGraceTime_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.13"}],"steps":[{"uuid":"8675cebf-e749-5f06-9787-e56558d5acf8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.13_Ensure_sshd_LoginGraceTime_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"}],"title":"Audit for Ensure sshd LoginGraceTime is configured","remarks":"Setting the `LoginGraceTime` parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set the number based on site policy.","description":"## Description\n\nThe `LoginGraceTime` parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access.\n\n## Audit\n\nRun the following command and verify that output `LoginGraceTime` is between `1` and `60` seconds:\n\n```bash\n# sshd -T | grep logingracetime\n\nlogingracetime 60\n```"},{"uuid":"e5843184-64d2-5e42-90d1-5806eee8a2eb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.13_Ensure_sshd_LoginGraceTime_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd LoginGraceTime is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `LoginGraceTime` parameter to `60` seconds or less above any `Include` entry as follows:\n\n```bash\nLoginGraceTime 60\n```\n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.13 Ensure sshd LoginGraceTime is configured","description":"The `LoginGraceTime` parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access."},{"uuid":"ec3ba7ee-9cbd-500c-b877-85672a529f91","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.14_Ensure_sshd_LogLevel_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.14"}],"steps":[{"uuid":"86a065be-6694-5fc6-9b74-923475a889c1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.14_Ensure_sshd_LogLevel_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure sshd LogLevel is configured","remarks":"The `INFO` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.\n\nThe `VERBOSE` level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments.","description":"## Description\n\nSSH provides several logging levels with varying amounts of verbosity. The `DEBUG` options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users.\n\n## Audit\n\nRun the following command and verify that output matches `loglevel VERBOSE` or `loglevel INFO`:\n\n```bash\n# sshd -T | grep loglevel\n\nloglevel VERBOSE\n - OR -\nloglevel INFO\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep loglevel\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"e32fb47b-1328-508a-ab84-d44b8be72290","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.14_Ensure_sshd_LogLevel_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd LogLevel is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `LogLevel` parameter to `VERBOSE` or `INFO` above any `Include` and `Match` entries as follows:\n\n```bash\nLogLevel VERBOSE\n - OR -\nLogLevel INFO\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.14 Ensure sshd LogLevel is configured","description":"SSH provides several logging levels with varying amounts of verbosity. The `DEBUG` options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users."},{"uuid":"84884773-6dda-5871-aad1-5a66c248b1f3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.15_Ensure_sshd_MACs_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.15"}],"steps":[{"uuid":"8482b886-5cd2-5f22-913c-7e019dd4f1fc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.15_Ensure_sshd_MACs_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/10"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:10"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:5"}],"title":"Audit for Ensure sshd MACs are configured","remarks":"MD5 and 96-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information.","description":"## Description\n\nThis variable limits the types of MAC algorithms that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved MACs.\n- Ensure that MACs used are in compliance with site policy.\n- The only \"strong\" MACs currently FIPS 140 approved are:\n\nHMAC-SHA1\n- HMAC-SHA2-256\n- HMAC-SHA2-384\n- HMAC-SHA2-512\n\n## Audit\n\nRun the following command to verify none of the \"weak\" MACs are being used:\n\n```bash\n# sshd -T | grep -Pi -- 'macs\\h+([^#\\n\\r]+,)?(hmac-md5|hmac-md5-96|hmac-ripemd160|hmac-sha1-96|umac-64@openssh\\.com|hmac-md5-etm@openssh\\.com|hmac-md5-96-etm@openssh\\.com|hmac-ripemd160-etm@openssh\\.com|hmac-sha1-96-etm@openssh\\.com|umac-64-etm@openssh\\.com|umac-128-etm@openssh\\.com)\\b'\n\nNothing should be returned\n```\n\n**Note:** Review `CVE-2023-48795` and verify the system has been patched. If the system has not been patched, review the use of the Encrypt Then Mac (etm) MACs.\n\nThe following are considered \"weak\" MACs, and should not be used:\n\n```bash\nhmac-md5\nhmac-md5-96\nhmac-ripemd160\nhmac-sha1-96\numac-64@openssh.com\nhmac-md5-etm@openssh.com\nhmac-md5-96-etm@openssh.com\nhmac-ripemd160-etm@openssh.com\nhmac-sha1-96-etm@openssh.com\numac-64-etm@openssh.com\numac-128-etm@openssh.com\n```"},{"uuid":"07a95ebd-552b-5dd2-93fc-498f093e147f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.15_Ensure_sshd_MACs_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd MACs are configured","description":"Edit the `/etc/ssh/sshd_config` file and add/modify the `MACs` line to contain a comma separated list of the site unapproved (weak) MACs preceded with a `-` above any `Include` entries:\n\nExample:\n\n```bash\nMACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com\n```\n\n**- IF -** `CVE-2023-48795` has not been reviewed and addressed, the following `etm` MACs should be added to the exclude list: hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com\n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.15 Ensure sshd MACs are configured","description":"This variable limits the types of MAC algorithms that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved MACs.\n- Ensure that MACs used are in compliance with site policy.\n- The only \"strong\" MACs currently FIPS 140 approved are:\n\nHMAC-SHA1\n- HMAC-SHA2-256\n- HMAC-SHA2-384\n- HMAC-SHA2-512"},{"uuid":"6c716ede-1980-55af-b709-383c37d65dc5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.16_Ensure_sshd_MaxAuthTries_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.16"}],"steps":[{"uuid":"0f01c5b0-5efc-5b31-9ba4-e05ad6066662","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.16_Ensure_sshd_MaxAuthTries_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/13"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:13"}],"title":"Audit for Ensure sshd MaxAuthTries is configured","remarks":"Setting the `MaxAuthTries` parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. While the recommended setting is 4, set the number based on site policy.","description":"## Description\n\nThe `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the `syslog` file detailing the login failure.\n\n## Audit\n\nRun the following command and verify that `MaxAuthTries` is `4` or less:\n\n```bash\n# sshd -T | grep maxauthtries\n\nmaxauthtries 4\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep maxauthtries\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"015f1057-8ed3-5582-b06a-00b58f2f270c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.16_Ensure_sshd_MaxAuthTries_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd MaxAuthTries is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `MaxAuthTries` parameter to `4` or less above any `Include` and `Match` entries as follows:\n\n```bash\nMaxAuthTries 4\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.16 Ensure sshd MaxAuthTries is configured","description":"The `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the `syslog` file detailing the login failure."},{"uuid":"58374661-7410-51a1-9bc7-d9eae050aeb1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.17_Ensure_sshd_MaxSessions_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.17"}],"steps":[{"uuid":"b1437ba1-7075-5bfc-a64e-fa4a4be0ea73","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.17_Ensure_sshd_MaxSessions_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd MaxSessions is configured","remarks":"To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon.","description":"## Description\n\nThe `MaxSessions` parameter specifies the maximum number of open sessions permitted from a given connection.\n\n## Audit\n\nRun the following command and verify that `MaxSessions` is `10` or less:\n\n```bash\n# sshd -T | grep -i maxsessions\n\nmaxsessions 10\n```\n\nRun the following command and verify the output:\n\n```bash\ngrep -Psi -- '^\\h*MaxSessions\\h+\\\"?(1[1-9]|[2-9][0-9]|[1-9][0-9][0-9]+)\\b' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf\n\nNothing should be returned\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep maxsessions\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"c6a1e6e8-7de3-5b51-bfa5-4ae2549bcb17","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.17_Ensure_sshd_MaxSessions_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd MaxSessions is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `MaxSessions` parameter to `10` or less above any `Include` and `Match` entries as follows:\n\n```bash\nMaxSessions 10\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.17 Ensure sshd MaxSessions is configured","description":"The `MaxSessions` parameter specifies the maximum number of open sessions permitted from a given connection."},{"uuid":"105e4055-ae94-52e9-abba-f4a889c45798","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.18_Ensure_sshd_MaxStartups_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.18"}],"steps":[{"uuid":"8b8f71ae-89f2-566f-b755-5337887b9fac","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.18_Ensure_sshd_MaxStartups_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd MaxStartups is configured","remarks":"To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon.","description":"## Description\n\nThe `MaxStartups` parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.\n\n## Audit\n\nRun the following command to verify `MaxStartups` is `10:30:60` or more restrictive:\n\n```bash\n# sshd -T | awk '$1 ~ /^\\s*maxstartups/{split($2, a, \":\");{if(a[1] > 10 || a[2] > 30 || a[3] > 60) print $0}}'\n```\n\nNothing should be returned"},{"uuid":"386041b8-4b35-511b-9878-aa3f6f356688","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.18_Ensure_sshd_MaxStartups_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd MaxStartups is configured","description":"Edit the `/etc/ssh/sshd_config` file to set the `MaxStartups` parameter to `10:30:60` or more restrictive above any `Include` entries as follows:\n\n```bash\nMaxStartups 10:30:60\n```\n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.18 Ensure sshd MaxStartups is configured","description":"The `MaxStartups` parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon."},{"uuid":"a08cba50-5982-548f-840f-744137d089cd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.19_Ensure_sshd_PermitEmptyPasswords_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.19"}],"steps":[{"uuid":"33c504d9-cd5d-5ddc-80ec-2869e222b387","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.19_Ensure_sshd_PermitEmptyPasswords_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure sshd PermitEmptyPasswords is disabled","remarks":"Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system.","description":"## Description\n\nThe `PermitEmptyPasswords` parameter specifies if the SSH server allows login to accounts with empty password strings.\n\n## Audit\n\nRun the following command to verify `PermitEmptyPasswords` is set to `no`:\n\n```bash\n# sshd -T | grep permitemptypasswords\n\npermitemptypasswords no\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep permitemptypasswords\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"1afa6bfd-8fbe-59cc-aada-33225c910bb7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.19_Ensure_sshd_PermitEmptyPasswords_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd PermitEmptyPasswords is disabled","description":"Edit `/etc/ssh/sshd_config` and set the `PermitEmptyPasswords` parameter to `no` above any `Include` and `Match` entries as follows:\n\n```bash\nPermitEmptyPasswords no\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.19 Ensure sshd PermitEmptyPasswords is disabled","description":"The `PermitEmptyPasswords` parameter specifies if the SSH server allows login to accounts with empty password strings."},{"uuid":"b29b7aab-9aba-588c-9820-b14583177c71","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.20_Ensure_sshd_PermitRootLogin_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.20"}],"steps":[{"uuid":"3ffb29c7-78a5-5af3-8328-f48caf4896be","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.20_Ensure_sshd_PermitRootLogin_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure sshd PermitRootLogin is disabled","remarks":"Disallowing `root` logins over SSH requires system admins to authenticate using their own individual account, then escalating to `root`. This limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.","description":"## Description\n\nThe `PermitRootLogin` parameter specifies if the root user can log in using SSH. The default is `prohibit-password`.\n\n## Audit\n\nRun the following command to verify `PermitRootLogin` is set to `no`:\n\n```bash\n# sshd -T | grep permitrootlogin\n\npermitrootlogin no\n```\n\n**- IF -** `Match` set statements are used in your environment, specify the connection parameters to use for the `-T` extended test mode and run the audit to verify the setting is not incorrectly configured in a match block\n\nExample additional audit needed for a match block for the user `sshuser`:\n\n```bash\n# sshd -T -C user=sshuser | grep permitrootlogin\n```\n\n**Note:** If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr` (source address), `user` (user), `host` (resolved source host name), `laddr` (local address), `lport` (local port number), and `rdomain` (routing domain)"},{"uuid":"bd2e2fe5-6efb-5a38-b671-2639938e77db","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.20_Ensure_sshd_PermitRootLogin_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd PermitRootLogin is disabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `PermitRootLogin` parameter to `no` above any `Include` and `Match` entries as follows:\n\n```bash\nPermitRootLogin no\n```\n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location."}],"title":"5.1.20 Ensure sshd PermitRootLogin is disabled","description":"The `PermitRootLogin` parameter specifies if the root user can log in using SSH. The default is `prohibit-password`."},{"uuid":"ef4066b6-a3d5-5089-b85f-661fd458a030","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.21_Ensure_sshd_PermitUserEnvironment_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.21"}],"steps":[{"uuid":"b01a1312-dc47-503b-a44a-95045a065344","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.21_Ensure_sshd_PermitUserEnvironment_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure sshd PermitUserEnvironment is disabled","remarks":"Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs)","description":"## Description\n\nThe `PermitUserEnvironment` option allows users to present environment options to the SSH daemon.\n\n## Audit\n\nRun the following command to verify `PermitUserEnviroment` is set to `no`:\n\n```bash\n# sshd -T | grep permituserenvironment\n\npermituserenvironment no\n```"},{"uuid":"68a38843-1fa8-5bea-ba6e-8e968c16c8ce","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.21_Ensure_sshd_PermitUserEnvironment_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd PermitUserEnvironment is disabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `PermitUserEnvironment` parameter to `no` above any `Include` entries as follows:\n\n```bash\nPermitUserEnvironment no\n```\n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.21 Ensure sshd PermitUserEnvironment is disabled","description":"The `PermitUserEnvironment` option allows users to present environment options to the SSH daemon."},{"uuid":"3a65ee4b-51cc-5d55-a970-036855587841","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.1 Configure SSH Server"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.22_Ensure_sshd_UsePAM_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.1.22"}],"steps":[{"uuid":"17095346-1fdf-5851-8e7e-c9582a15976b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.22_Ensure_sshd_UsePAM_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure sshd UsePAM is enabled","remarks":"When `usePAM` is set to `yes`, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server","description":"## Description\n\nThe `UsePAM` directive enables the Pluggable Authentication Module (PAM) interface. If set to `yes` this will enable PAM authentication using `ChallengeResponseAuthentication` and `PasswordAuthentication` directives in addition to PAM account and session module processing for all authentication types.\n\n## Audit\n\nRun the following command to verify `UsePAM` is set to `yes`:\n\n```bash\n# sshd -T | grep -i usepam\n\nusepam yes\n```"},{"uuid":"77d55344-1805-5c4e-a72d-e086286cce3b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.1.22_Ensure_sshd_UsePAM_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sshd UsePAM is enabled","description":"Edit the `/etc/ssh/sshd_config` file to set the `UsePAM` parameter to `yes` above any `Include` entries as follows:\n\n```bash\nUsePAM yes\n```\n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location."}],"title":"5.1.22 Ensure sshd UsePAM is enabled","description":"The `UsePAM` directive enables the Pluggable Authentication Module (PAM) interface. If set to `yes` this will enable PAM authentication using `ChallengeResponseAuthentication` and `PasswordAuthentication` directives in addition to PAM account and session module processing for all authentication types."},{"uuid":"7511af01-9a25-59a9-85d8-ee73f439b77b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.1_Ensure_sudo_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.1"}],"steps":[{"uuid":"0c468225-865e-5203-b39f-d9a26bbe701c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.1_Ensure_sudo_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure sudo is installed","remarks":"`sudo` supports a plug-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug-ins to work seamlessly with the `sudo` front end. The default security policy is `sudoers`, which is configured via the file `/etc/sudoers` and any entries in `/etc/sudoers.d`.\n\nThe security policy determines what privileges, if any, a user has to run `sudo`. The policy may require that users authenticate themselves with a password or another authentication mechanism. If authentication is required, `sudo` will exit if the user's password is not entered within a configurable time limit. This limit is policy-specific.","description":"## Description\n\n`sudo` allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. The invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy.\n\n## Audit\n\nRun the following command to verify that either `sudo` is installed:\n\n```bash\n# dpkg-query -s sudo &>/dev/null && echo \"sudo is installed\"\n\nsudo is installed\n```\n\n**- OR -**\n\nRun the following command to verify that either `sudo-ldap` is installed:\n\n```bash\n# dpkg-query -s sudo-ldap &>/dev/null && echo \"sudo-ldap is installed\"\n\nsudo-ldap is installed\n```"},{"uuid":"4a894fc2-824e-5992-afb0-d097ffbcad04","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.1_Ensure_sudo_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sudo is installed","description":"First determine is LDAP functionality is required. If so, then install `sudo-ldap`, else install `sudo`.\n\nExample:\n\n```bash\n# apt install sudo\n```"}],"title":"5.2.1 Ensure sudo is installed","description":"`sudo` allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. The invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy."},{"uuid":"4c194ba9-8c29-5e09-af21-c4bb0b189a48","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.2_Ensure_sudo_commands_use_pty"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.2"}],"steps":[{"uuid":"64c24916-6a72-50af-9178-0c7207d49089","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.2_Ensure_sudo_commands_use_pty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:1"}],"title":"Audit for Ensure sudo commands use pty","remarks":"Attackers can run a malicious program using `sudo` which would fork a background process that remains even when the main program has finished executing.","description":"## Description\n\n`sudo` can be configured to run only from a pseudo terminal (`pseudo-pty`).\n\n## Audit\n\nVerify that `sudo` can only run other commands from a pseudo terminal.\n\nRun the following command to verify `Defaults use_pty` is set:\n\n```bash\n# grep -rPi -- '^\\h*Defaults\\h+([^#\\n\\r]+,\\h*)?use_pty\\b' /etc/sudoers*\n```\n\nVerify the output matches:\n\n```bash\n/etc/sudoers:Defaults use_pty\n```\n\nRun the follow command to to verify `Defaults !use_pty` is not set:\n\n```bash\n# grep -rPi -- '^\\h*Defaults\\h+([^#\\n\\r]+,\\h*)?!use_pty\\b' /etc/sudoers*\n```\n\nNothing should be returned"},{"uuid":"e3c4f5d4-28d2-5920-87de-d4e0bd10f929","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.2_Ensure_sudo_commands_use_pty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sudo commands use pty","description":"Edit the file `/etc/sudoers` with `visudo` or a file in `/etc/sudoers.d/` with `visudo -f ` and add the following line:\n\n```bash\nDefaults use_pty\n```\n\nEdit the file `/etc/sudoers` with `visudo` and any files in `/etc/sudoers.d/` with `visudo -f ` and remove any occurrence of `!use_pty`\n\n**Note:**\n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact:\n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files."}],"title":"5.2.2 Ensure sudo commands use pty","description":"`sudo` can be configured to run only from a pseudo terminal (`pseudo-pty`)."},{"uuid":"9a36445b-fee2-5d49-be82-caa87b3ea93d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.3_Ensure_sudo_log_file_exists"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.3"}],"steps":[{"uuid":"3d5d4901-7201-5a02-84a5-a43ae737e327","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.3_Ensure_sudo_log_file_exists"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure sudo log file exists","remarks":"A sudo log file simplifies auditing of sudo commands","description":"## Description\n\nsudo can use a custom log file\n\n## Audit\n\nRun the following command to verify that sudo has a custom log file configured:\n\n```bash\n# grep -rPsi \"^\\h*Defaults\\h+([^#]+,\\h*)?logfile\\h*=\\h*(\\\"|\\')?\\H+(\\\"|\\')?(,\\h*\\H+\\h*)*\\h*(#.*)?$\" /etc/sudoers*\n```\n\nVerify the output matches:\n\n```bash\nDefaults logfile=\"/var/log/sudo.log\"\n```"},{"uuid":"cd0873ce-1ddc-5342-bc69-348a165bdad5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.3_Ensure_sudo_log_file_exists"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sudo log file exists","description":"Edit the file `/etc/sudoers` or a file in `/etc/sudoers.d/` with `visudo` or `visudo -f ` and add the following line:\n\nExample:\n\n```bash\nDefaults logfile=\"/var/log/sudo.log\"\n```\n\n**Note:**\n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact:\n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files."}],"title":"5.2.3 Ensure sudo log file exists","description":"sudo can use a custom log file"},{"uuid":"d2b8c195-9bf8-57b8-8a0a-83234f920aa4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.4_Ensure_users_must_provide_password_for_privilege_escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.4"}],"steps":[{"uuid":"9a60e9d4-6b5d-5127-961d-7de9d3a9615d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.4_Ensure_users_must_provide_password_for_privilege_escalation"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure users must provide password for privilege escalation","remarks":"Without (re-)authentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user (re-)authenticate.","description":"## Description\n\nThe operating system must be configured so that users must provide a password for privilege escalation.\n\n## Audit\n\n**Note:** If passwords are not being used for authentication, this is not applicable.\n\nVerify the operating system requires users to supply a password for privilege escalation.\n\nCheck the configuration of the `/etc/sudoers` and `/etc/sudoers.d/*` files with the following command:\n\n```bash\n# grep -r \"^[^#].*NOPASSWD\" /etc/sudoers*\n```\n\nIf any line is found refer to the remediation procedure below."},{"uuid":"60a23d2c-2faa-5dd8-8211-5cb92035d52e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.4_Ensure_users_must_provide_password_for_privilege_escalation"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure users must provide password for privilege escalation","description":"Based on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file.\n\nRemove any line with occurrences of `NOPASSWD` tags in the file.\n\nImpact:\n\nThis will prevent automated processes from being able to elevate privileges."}],"title":"5.2.4 Ensure users must provide password for privilege escalation","description":"The operating system must be configured so that users must provide a password for privilege escalation."},{"uuid":"95810d0c-7283-5fbb-9bc4-13bd9dd2d0a3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.5_Ensure_re-authentication_for_privilege_escalation_is_not_disabled_globally"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.5"}],"steps":[{"uuid":"4abe073e-31c9-512c-a0ed-8892fc4c5a1c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.5_Ensure_re-authentication_for_privilege_escalation_is_not_disabled_globally"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure re-authentication for privilege escalation is not disabled globally","remarks":"Without re-authentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re-authenticate.","description":"## Description\n\nThe operating system must be configured so that users must re-authenticate for privilege escalation.\n\n## Audit\n\nVerify the operating system requires users to re-authenticate for privilege escalation.\n\nCheck the configuration of the `/etc/sudoers` and `/etc/sudoers.d/*` files with the following command:\n\n```bash\n# grep -r \"^[^#].*\\!authenticate\" /etc/sudoers*\n```\n\nIf any line is found with a `!authenticate` tag, refer to the remediation procedure below."},{"uuid":"1887e3e2-e374-5f2a-a516-3d09913166a9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.5_Ensure_re-authentication_for_privilege_escalation_is_not_disabled_globally"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure re-authentication for privilege escalation is not disabled globally","description":"Configure the operating system to require users to reauthenticate for privilege escalation.\n\nBased on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file.\n\nRemove any occurrences of `!authenticate` tags in the file(s)."}],"title":"5.2.5 Ensure re-authentication for privilege escalation is not disabled globally","description":"The operating system must be configured so that users must re-authenticate for privilege escalation."},{"uuid":"d9ef5df3-a781-5186-a3b4-5b090a2df012","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.6_Ensure_sudo_authentication_timeout_is_configured_correctly"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.6"}],"steps":[{"uuid":"3a23f49e-7280-541e-ae95-a7a7d0d1ac9b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.6_Ensure_sudo_authentication_timeout_is_configured_correctly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:3"}],"title":"Audit for Ensure sudo authentication timeout is configured correctly","remarks":"Setting a timeout value reduces the window of opportunity for unauthorized privileged access to another user.","description":"## Description\n\n`sudo` caches used credentials for a default of 15 minutes. This is for ease of use when there are multiple administrative tasks to perform. The timeout can be modified to suit local security policies.\n\nThis default is distribution specific. See audit section for further information.\n\n## Audit\n\nEnsure that the caching timeout is no more than 15 minutes.\n\nExample:\n\n```bash\n# grep -roP \"timestamp_timeout=\\K[0-9]*\" /etc/sudoers*\n```\n\nIf there is no `timestamp_timeout` configured in `/etc/sudoers*` then the default is 15 minutes. This default can be checked with:\n\n```bash\n# sudo -V | grep \"Authentication timestamp timeout:\"\n```\n\n**NOTE:** A value of `-1` means that the timeout is disabled. Depending on the configuration of the `timestamp_type`, this could mean for all terminals / processes of that user and not just that one single terminal session."},{"uuid":"d4956bd5-27bc-5bf3-a1eb-3dc8dbb676d6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.6_Ensure_sudo_authentication_timeout_is_configured_correctly"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure sudo authentication timeout is configured correctly","description":"If the currently configured timeout is larger than 15 minutes, edit the file listed in the audit section with `visudo -f ` and modify the entry `timestamp_timeout=` to 15 minutes or less as per your site policy. The value is in minutes. This particular entry may appear on it's own, or on the same line as `env_reset`. See the following two examples:\n\n```bash\nDefaults env_reset, timestamp_timeout=15\n```\n\n```bash\nDefaults timestamp_timeout=15\nDefaults env_reset\n```"}],"title":"5.2.6 Ensure sudo authentication timeout is configured correctly","description":"`sudo` caches used credentials for a default of 15 minutes. This is for ease of use when there are multiple administrative tasks to perform. The timeout can be modified to suit local security policies.\n\nThis default is distribution specific. See audit section for further information."},{"uuid":"3e1ebdf0-1520-5571-adf2-d3eb1c0373a7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.2 Configure privilege escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.7_Ensure_access_to_the_su_command_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.2.7"}],"steps":[{"uuid":"58b40b36-0127-5ac3-9ebe-c12f4f5c544d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.7_Ensure_access_to_the_su_command_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to the su command is restricted","remarks":"Restricting the use of `su` , and using `sudo` in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via `sudo` , whereas `su` can only record that a user executed the `su` program.","description":"## Description\n\nThe `su` command allows a user to run a command or shell as another user. The program has been superseded by `sudo`, which allows for more granular control over privileged access. Normally, the `su` command can be executed by any user. By uncommenting the `pam_wheel.so` statement in `/etc/pam.d/su`, the `su` command will only allow users in a specific groups to execute `su`. This group should be empty to reinforce the use of `sudo` for privileged access.\n\n## Audit\n\nRun the following command:\n\n```bash\n# grep -Pi '^\\h*auth\\h+(?:required|requisite)\\h+pam_wheel\\.so\\h+(?:[^#\\n\\r]+\\h+)?((?!\\2)(use_uid\\b|group=\\H+\\b))\\h+(?:[^#\\n\\r]+\\h+)?((?!\\1)(use_uid\\b|group=\\H+\\b))(\\h+.*)?$' /etc/pam.d/su\n```\n\nVerify the output matches:\n\n```bash\nauth required pam_wheel.so use_uid group=\n```\n\nRun the following command and verify that the group specified in `` contains no users:\n\n```bash\n# grep /etc/group\n```\n\nVerify the output does not contain any users in the relevant group:\n\n```bash\n:x::\n```"},{"uuid":"d69b8e78-0f67-5e80-afba-04fab463e105","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.2.7_Ensure_access_to_the_su_command_is_restricted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to the su command is restricted","description":"Create an empty group that will be specified for use of the `su` command. The group should be named according to site policy.\n\nExample:\n\n```bash\n# groupadd sugroup\n```\n\nAdd the following line to the `/etc/pam.d/su` file, specifying the empty group:\n\n```bash\nauth required pam_wheel.so use_uid group=sugroup\n```"}],"title":"5.2.7 Ensure access to the su command is restricted","description":"The `su` command allows a user to run a command or shell as another user. The program has been superseded by `sudo`, which allows for more granular control over privileged access. Normally, the `su` command can be executed by any user. By uncommenting the `pam_wheel.so` statement in `/etc/pam.d/su`, the `su` command will only allow users in a specific groups to execute `su`. This group should be empty to reinforce the use of `sudo` for privileged access."},{"uuid":"4fda5948-183d-5aaa-a40f-4f07a272e5e8","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.1 Configure PAM software packages"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.1_Ensure_latest_version_of_pam_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.1.1"}],"steps":[{"uuid":"124c7dbe-89d9-53ef-8d59-736002aa56a7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.1_Ensure_latest_version_of_pam_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"}],"title":"Audit for Ensure latest version of pam is installed","remarks":"To ensure the system has full functionality and access to the options covered by this Benchmark the latest version of `libpam-runtime` should be installed on the system","description":"## Description\n\nUpdated versions of PAM include additional functionality\n\n## Audit\n\nRun the following command to verify the version of `libpam-runtime` on the system:\n\n```bash\n# dpkg-query -s libpam-runtime | grep -P -- '^(Status|Version)\\b'\n```\n\nThe output should be similar to:\n\n```bash\nStatus: install ok installed\nVersion: 1.5.3-5\n```"},{"uuid":"21410d8b-9264-575b-9c2b-8f767b33611a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.1_Ensure_latest_version_of_pam_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure latest version of pam is installed","description":"**- IF -** the version of `libpam-runtime` on the system is less than version `1.5.3-5`:\n\nRun the following command to update to the latest version of `PAM`:\n\n```bash\n# apt upgrade libpam-runtime\n```"}],"title":"5.3.1.1 Ensure latest version of pam is installed","description":"Updated versions of PAM include additional functionality"},{"uuid":"a0824196-2ffb-59be-b45c-d0026e543d7e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.1 Configure PAM software packages"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.2_Ensure_libpam-modules_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.1.2"}],"steps":[{"uuid":"6301d0f7-0269-58c2-97cd-f36b3d017bb9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.2_Ensure_libpam-modules_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"}],"title":"Audit for Ensure libpam-modules is installed","remarks":"To ensure the system has full functionality and access to the PAM options covered by this Benchmark","description":"## Description\n\nPluggable Authentication Modules for PAM\n\n## Audit\n\nRun the following command to verify `libpam-modules` is installed and version `1.5.3-5` or later:\n\n```bash\n# dpkg-query -s libpam-modules | grep -P -- '^(Status|Version)\\b'\n```\n\nThe output should be similar to:\n\n```bash\nStatus: install ok installed\nVersion: 1.5.3-5\n```"},{"uuid":"4794597f-9686-5f5e-a665-abb203149da0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.2_Ensure_libpam-modules_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure libpam-modules is installed","description":"**- IF -** the version of `libpam-modules` on the system is less than version `1.5.3-5`:\n\nRun the following command to update to the latest version of `PAM`:\n\n```bash\n# apt upgrade libpam-modules\n```"}],"title":"5.3.1.2 Ensure libpam-modules is installed","description":"Pluggable Authentication Modules for PAM"},{"uuid":"f3248672-2e19-57d7-aee5-69c995a50b3b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.1 Configure PAM software packages"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.3_Ensure_libpam-pwquality_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.1.3"}],"steps":[{"uuid":"67a58e39-023a-5fdb-9b75-2b908f13750b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.3_Ensure_libpam-pwquality_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"}],"title":"Audit for Ensure libpam-pwquality is installed","remarks":"Strong passwords reduce the risk of systems being hacked through brute force methods.","description":"## Description\n\n`libpwquality` provides common functions for password quality checking and scoring them based on their apparent randomness. The library also provides a function for generating random passwords with good pronounceability.\n\nThis module can be plugged into the password stack of a given service to provide some plug-in strength-checking for passwords. The code was originally based on `pam_cracklib` module and the module is backwards compatible with its options.\n\n## Audit\n\nRun the following command to verify `libpam-pwquality` is installed:\n\n```bash\n# dpkg-query -s libpam-pwquality | grep -P -- '^(Status|Version)\\b'\n```\n\nThe output should be similar to:\n\n```bash\nStatus: install ok installed\nVersion: 1.4.5-3+build1\n```"},{"uuid":"f6a73629-8224-58d5-9edb-a089b371e903","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.1.3_Ensure_libpam-pwquality_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure libpam-pwquality is installed","description":"Run the following command to install `libpam-pwquality`:\n\n```bash\n# apt install libpam-pwquality\n```"}],"title":"5.3.1.3 Ensure libpam-pwquality is installed","description":"`libpwquality` provides common functions for password quality checking and scoring them based on their apparent randomness. The library also provides a function for generating random passwords with good pronounceability.\n\nThis module can be plugged into the password stack of a given service to provide some plug-in strength-checking for passwords. The code was originally based on `pam_cracklib` module and the module is backwards compatible with its options."},{"uuid":"45d62c9c-bb8c-558c-acd0-cdd472f1e2d6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.2 Configure pam-auth-update profiles"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.1_Ensure_pam_unix_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.2.1"}],"steps":[{"uuid":"b3c6c53b-0680-51f7-b8e2-eeb65ade90c6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.1_Ensure_pam_unix_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5(1)"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure pam_unix module is enabled","remarks":"The system should only provide access after performing authentication of a user.","description":"## Description\n\n`pam_unix` is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the `/etc/passwd` and if shadow is enabled, the `/etc/shadow` file as well.\n\nThe account component performs the task of establishing the status of the user's account and password based on the following shadow elements: `expire`, `last_change`, `max_change`, `min_change`, `warn_change`. In the case of the latter, it may offer advice to the user on changing their password or, through the `PAM_AUTHTOKEN_REQD` return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed.\n\nThe authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank.\n\n## Audit\n\nRun the following command to verify that `pam_unix` is enabled:\n\n```bash\n# grep -P -- '\\bpam_unix\\.so\\b' /etc/pam.d/common-{account,session,auth,password}\n```\n\nOutput should be simular to:\n\n```bash\n/etc/pam.d/common-account:account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so\n/etc/pam.d/common-session:session required pam_unix.so\n/etc/pam.d/common-auth:auth [success=2 default=ignore] pam_unix.so try_first_pass\n/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\n```"},{"uuid":"9730bcd7-54d5-5ccc-8652-c604d93b2a78","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.1_Ensure_pam_unix_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_unix module is enabled","description":"Run the following command to enable the `pam_unix` module:\n\n```bash\n# pam-auth-update --enable unix\n```\n\n**Note:** If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead"}],"title":"5.3.2.1 Ensure pam_unix module is enabled","description":"`pam_unix` is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the `/etc/passwd` and if shadow is enabled, the `/etc/shadow` file as well.\n\nThe account component performs the task of establishing the status of the user's account and password based on the following shadow elements: `expire`, `last_change`, `max_change`, `min_change`, `warn_change`. In the case of the latter, it may offer advice to the user on changing their password or, through the `PAM_AUTHTOKEN_REQD` return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed.\n\nThe authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank."},{"uuid":"926d045d-1176-55eb-83fe-c32b514fb245","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.2 Configure pam-auth-update profiles"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.2_Ensure_pam_faillock_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.2.2"}],"steps":[{"uuid":"125c3675-85f2-5efa-809b-fbaf223d66f2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.2_Ensure_pam_faillock_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/7"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:7"}],"title":"Audit for Ensure pam_faillock module is enabled","remarks":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.","description":"## Description\n\nThe `pam_faillock.so` module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the `deny` parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory.\n\n## Audit\n\nRun the following commands to verify that `pam_faillock` is enabled:\n\n```bash\n# grep -P -- '\\bpam_faillock\\.so\\b' /etc/pam.d/common-{auth,account}\n```\n\nOutput should be similar to:\n\n```bash\n/etc/pam.d/common-auth:auth requisite pam_faillock.so preauth\n/etc/pam.d/common-auth:auth [default=die] pam_faillock.so authfail\n/etc/pam.d/common-account:account required pam_faillock.so\n```"},{"uuid":"1a68e886-821e-51a3-8f6f-2ccc2ec2fe95","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.2_Ensure_pam_faillock_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_faillock module is enabled","description":"Create two pam-auth-update profiles in `/usr/share/pam-configs/`:\n\n- Create the `faillock` profile in `/usr/share/pam-configs/` with the following lines:\n\n```bash\nName: Enable pam_faillock to deny access\nDefault: yes\nPriority: 0\nAuth-Type: Primary\nAuth:\n [default=die] pam_faillock.so authfail\n```\n\nExample Script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail') \n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock\n}\n```\n\n- Create the `faillock_notify` profile in `/usr/share/pam-configs/` with the following lines:\n\n```bash\nName: Notify of failed login attempts and reset count upon success\nDefault: yes\nPriority: 1024\nAuth-Type: Primary\nAuth:\n requisite pam_faillock.so preauth\nAccount-Type: Primary\nAccount:\n required pam_faillock.so\n```\n\nExample Script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so') \n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock_notify\n}\n```\n\nRun the following command to update the `common-auth` and `common-account` PAM files with the new profiles:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable faillock\n# pam-auth-update --enable faillock_notify\n```\n\n**Note:**\n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead"}],"title":"5.3.2.2 Ensure pam_faillock module is enabled","description":"The `pam_faillock.so` module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the `deny` parameter in the faillock configuration). It stores the failure records into per-user files in the tally directory."},{"uuid":"f28b97fb-e0d6-5cea-b28d-9485e62b9423","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.2 Configure pam-auth-update profiles"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.3_Ensure_pam_pwquality_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.2.3"}],"steps":[{"uuid":"6138a4d0-1d17-5814-93a2-47104f9e771a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.3_Ensure_pam_pwquality_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure pam_pwquality module is enabled","remarks":"Use of a unique, complex passwords helps to increase the time and resources required to compromise the password.","description":"## Description\n\nThe `pam_pwquality.so` module performs password quality checking. This module can be plugged into the password stack of a given service to provide strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options.\n\nThe action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices.\n\nThe first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token.\n\n## Audit\n\nRun the following command to verify that pam_pwhistory is enabled:\n\n```bash\n# grep -P -- '\\bpam_pwquality\\.so\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\npassword requisite pam_pwquality.so retry=3\n```"},{"uuid":"37af9e87-b16a-5014-acb4-ef0e0a7cb161","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.3_Ensure_pam_pwquality_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_pwquality module is enabled","description":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile:\n\n```bash\n# grep -P -- '\\bpam_pwquality\\.so\\b' /usr/share/pam-configs/*\n```\n\nOutput should be similar to:\n\n```bash\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n```\n\n**- IF -** similar output is returned:\n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile:\n\n```bash\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\nExample:\n\n```bash\n# pam-auth-update pwquality\n```\n\n**- IF -** similar output is **NOT** returned:\n\nCreate a pam-auth-update profile in `/usr/share/pam-configs/` with the following lines:\n\n```bash\nName: Pwquality password strength checking\nDefault: yes\nPriority: 1024\nConflicts: cracklib\nPassword-Type: Primary\nPassword:\n requisite pam_pwquality.so retry=3\n```\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n arr=('Name: Pwquality password strength checking' 'Default: yes' 'Priority: 1024' 'Conflicts: cracklib' 'Password-Type: Primary' 'Password:' ' requisite pam_pwquality.so retry=3')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwquality\n}\n```\n\nRun the following command to update `/etc/pam.d/common-password` with the `pwquality` profile:\n\n```bash\n# pam-auth-update --enable pwquality\n```\n\n**Note:**\n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwquality` module, enable that module instead"}],"title":"5.3.2.3 Ensure pam_pwquality module is enabled","description":"The `pam_pwquality.so` module performs password quality checking. This module can be plugged into the password stack of a given service to provide strength-checking for passwords. The code was originally based on pam_cracklib module and the module is backwards compatible with its options.\n\nThe action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices.\n\nThe first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token."},{"uuid":"b3c1c7d4-8cb5-523d-bc9a-98929c35cb8b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.2 Configure pam-auth-update profiles"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.4_Ensure_pam_pwhistory_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.2.4"}],"steps":[{"uuid":"11ca6500-a751-55b1-8f06-baa14cbe3f59","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.4_Ensure_pam_pwhistory_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure pam_pwhistory module is enabled","remarks":"Use of a unique, complex passwords helps to increase the time and resources required to compromise the password.","description":"## Description\n\nThe `pam_pwhistory.so` module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.\n\nThis module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with `NIS` or `LDAP`, since the old passwords are stored on the local machine and are not available on another machine for password history checking.\n\n## Audit\n\nRun the following command to verify that pam_pwhistory is enabled:\n\n```bash\n# grep -P -- '\\bpam_pwhistory\\.so\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\npassword requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```"},{"uuid":"a9c0c750-02fa-5ebf-babd-6524548da006","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.2.4_Ensure_pam_pwhistory_module_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_pwhistory module is enabled","description":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile:\n\n```bash\n# grep -P -- '\\bpam_pwhistory\\.so\\b' /usr/share/pam-configs/*\n```\n\nOutput should be similar to:\n\n```bash\n/usr/share/pam-configs/pwhistory: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\n**- IF -** similar output is returned:\n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile:\n\n```bash\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\nExample:\n\n```bash\n# pam-auth-update pwhistory\n```\n\n**- IF -** similar output is **NOT** returned:\n\nCreate a `pwhistory` profile in `/usr/share/pam-configs/` with the following lines:\n\n```bash\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\nExample Script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n arr=('Name: pwhistory password history checking' 'Default: yes' 'Priority: 1024' 'Password-Type: Primary' 'Password:' ' requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwhistory\n}\n```\n\nRun the following command to update `/etc/pam.d/common-password` with the `pwhistory` profile:\n\n```bash\n# pam-auth-update --enable pwhistory\n```\n\n**Note:**\n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwhistory` module, enable that module instead"}],"title":"5.3.2.4 Ensure pam_pwhistory module is enabled","description":"The `pam_pwhistory.so` module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.\n\nThis module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with `NIS` or `LDAP`, since the old passwords are stored on the local machine and are not available on another machine for password history checking."},{"uuid":"6d5eb2cc-e72c-516c-8f29-c0e1848c648c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.1 Configure pam_faillock module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.1_Ensure_password_failed_attempts_lockout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.1.1"}],"steps":[{"uuid":"464c6e39-ac47-508c-9f97-ea42d8595052","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.1_Ensure_password_failed_attempts_lockout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/7"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:7"}],"title":"Audit for Ensure password failed attempts lockout is configured","remarks":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.","description":"## Description\n\nThe `deny=` option will deny access if the number of consecutive authentication failures for this user during the recent interval exceeds .\n\n## Audit\n\nRun the following command to verify that Number of failed logon attempts before the account is locked is no greater than `5` and meets local site policy:\n\n```bash\n# grep -Pi -- '^\\h*deny\\h*=\\h*[1-5]\\b' /etc/security/faillock.conf\n\ndeny = 5\n```\n\nRun the following command to verify that the `deny` argument has not been set, or `5` or less and meets local site policy:\n\n```bash\n# grep -Pi -- '^\\h*auth\\h+(requisite|required|sufficient)\\h+pam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?deny\\h*=\\h*(0|[6-9]|[1-9][0-9]+)\\b' /etc/pam.d/common-auth\n```\n\nNothing should be returned"},{"uuid":"1c9eca0c-2550-527f-9c2d-f9637fada789","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.1_Ensure_password_failed_attempts_lockout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password failed attempts lockout is configured","description":"Create or edit the following line in `/etc/security/faillock.conf` setting the `deny` option to `5` or less:\n\n```bash\ndeny = 5\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?deny\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `deny=` arguments from the `pam_faillock.so` line(s):"}],"title":"5.3.3.1.1 Ensure password failed attempts lockout is configured","description":"The `deny=` option will deny access if the number of consecutive authentication failures for this user during the recent interval exceeds ."},{"uuid":"b283ebcf-912d-5034-8d2c-71389db7ccfe","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.1 Configure pam_faillock module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.2_Ensure_password_unlock_time_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.1.2"}],"steps":[{"uuid":"6404658e-5a67-52aa-864b-89f569746f1d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.2_Ensure_password_unlock_time_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/7"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:7"}],"title":"Audit for Ensure password unlock time is configured","remarks":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.","description":"## Description\n\n`unlock_time=` - The access will be re-enabled after seconds after the lock out. The value `0` has the same meaning as value never - the access will not be re-enabled without resetting the faillock entries by the faillock(8) command.\n\n**Note:**\n\n- The default directory that pam_faillock uses is usually cleared on system boot so the access will be also re-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option.\n- It is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers.\n- The maximum configurable value for `unlock_time` is `604800`\n\n## Audit\n\nRun the following command to verify that the time in seconds before the account is unlocked is either `0` (never) or `900` (15 minutes) or more and meets local site policy:\n\n```bash\n# grep -Pi -- '^\\h*unlock_time\\h*=\\h*(0|9[0-9][0-9]|[1-9][0-9]{3,})\\b' /etc/security/faillock.conf\n\nunlock_time = 900\n```\n\nRun the following command to verify that the `unlock_time` argument has not been set, or is either `0` (never) or `900` (15 minutes) or more and meets local site policy:\n\n```bash\n# grep -Pi -- '^\\h*auth\\h+(requisite|required|sufficient)\\h+pam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?unlock_time\\h*=\\h*([1-9]|[1-9][0-9]|[1-8][0-9][0-9])\\b' /etc/pam.d/common-auth\n```\n\nNothing should be returned"},{"uuid":"d50ac8b3-b28b-5a47-a3f5-50b74ae3c0cf","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.2_Ensure_password_unlock_time_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password unlock time is configured","description":"Set password unlock time to conform to site policy. `unlock_time` should be `0` (never), or `900` seconds or greater.\n\nEdit `/etc/security/faillock.conf` and update or add the following line:\n\n```bash\nunlock_time = 900\n```\n\nRun the following command: remove the `unlock_time` argument from the `pam_faillock.so` module in the PAM files:\n\n```bash\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?unlock_time\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `unlock_time=` argument from the `pam_faillock.so` line(s):\n\nImpact:\n\nUse of `unlock_time=0` may allow an attacker to cause denial of service to legitimate users. This will also require a systems administrator with elevated privileges to unlock the account."}],"title":"5.3.3.1.2 Ensure password unlock time is configured","description":"`unlock_time=` - The access will be re-enabled after seconds after the lock out. The value `0` has the same meaning as value never - the access will not be re-enabled without resetting the faillock entries by the faillock(8) command.\n\n**Note:**\n\n- The default directory that pam_faillock uses is usually cleared on system boot so the access will be also re-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option.\n- It is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers.\n- The maximum configurable value for `unlock_time` is `604800`"},{"uuid":"2fa73b76-b095-5412-aef9-15203e424e07","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.1 Configure pam_faillock module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.3_Ensure_password_failed_attempts_lockout_includes_root_account"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.1.3"}],"steps":[{"uuid":"ae2952eb-c6fe-50af-a2d0-7f1381ed5f7e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.3_Ensure_password_failed_attempts_lockout_includes_root_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/7"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:7"}],"title":"Audit for Ensure password failed attempts lockout includes root account","remarks":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems.","description":"## Description\n\n`even_deny_root` - Root account can become locked as well as regular accounts\n\n`root_unlock_time=n` - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.\n\n## Audit\n\nRun the following command to verify that `even_deny_root` and/or `root_unlock_time` is enabled:\n\n```bash\n# grep -Pi -- '^\\h*(even_deny_root|root_unlock_time\\h*=\\h*\\d+)\\b' /etc/security/faillock.conf\n```\n\nExample output:\n\n```bash\neven_deny_root\n\n--AND/OR--\n\nroot_unlock_time = 60\n```\n\nRun the following command to verify that **- IF -** `root_unlock_time` is set, it is set to `60` (One minute) or more:\n\n```bash\n# grep -Pi -- '^\\h*root_unlock_time\\h*=\\h*([1-9]|[1-5][0-9])\\b' /etc/security/faillock.conf\n```\n\nNothing should be returned\n\nRun the following command to check the `pam_faillock.so` module for the `root_unlock_time` argument. Verify **-IF-** `root_unlock_time` is set, it is set to `60` (One minute) or more:\n\n```bash\n# grep -Pi -- '^\\h*auth\\h+([^#\\n\\r]+\\h+)pam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?root_unlock_time\\h*=\\h*([1-9]|[1-5][0-9])\\b' /etc/pam.d/common-auth\n```\n\nNothing should be returned"},{"uuid":"5e9b5e6f-63a6-5133-9953-9397f12ba078","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.3_Ensure_password_failed_attempts_lockout_includes_root_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password failed attempts lockout includes root account","description":"Edit `/etc/security/faillock.conf`:\n\n- Remove or update any line containing `root_unlock_time`, **- OR -** set it to a value of `60` or more\n- Update or add the following line:\n\n```bash\neven_deny_root\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?(even_deny_root|root_unlock_time)' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `even_deny_root` and `root_unlock_time` arguments from the `pam_faillock.so` line(s):\n\nImpact:\n\nUse of `unlock_time=0` or `root_unlock_time=0` may allow an attacker to cause denial of service to legitimate users."}],"title":"5.3.3.1.3 Ensure password failed attempts lockout includes root account","description":"`even_deny_root` - Root account can become locked as well as regular accounts\n\n`root_unlock_time=n` - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option."},{"uuid":"1d9d45b7-e918-56b2-9fce-0c1d0197a247","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.1_Ensure_password_number_of_changed_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.1"}],"steps":[{"uuid":"bf6a93e1-a988-5ffb-b872-95df499b87ce","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.1_Ensure_password_number_of_changed_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password number of changed characters is configured","remarks":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.","description":"## Description\n\nThe `pwquality` `difok` option sets the number of characters in a password that must not be present in the old password.\n\n## Audit\n\nRun the following command to verify that the `difok` option is set to `2` or more and follows local site policy:\n\n```bash\n# grep -Psi -- '^\\h*difok\\h*=\\h*([2-9]|[1-9][0-9]+)\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwdifok.conf:difok = 2\n```\n\nVerify returned value(s) are `2` or more and meet local site policy\n\nRun the following command to verify that `difok` is not set, is `2` or more, and conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?difok\\h*=\\h*([0-1])\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- settings should be configured in only **one** location for clarity\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"f220047a-8328-573c-beed-eedf569933c1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.1_Ensure_password_number_of_changed_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password number of changed characters is configured","description":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `difok` to `2` or more. Ensure setting conforms to local site policy:\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*difok\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"difok = 2\" > /etc/security/pwquality.conf.d/50-pwdifok.conf\n}\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?difok\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `difok` argument from the `pam_pwquality.so` line(s):"}],"title":"5.3.3.2.1 Ensure password number of changed characters is configured","description":"The `pwquality` `difok` option sets the number of characters in a password that must not be present in the old password."},{"uuid":"e87ab7f1-e4c6-5cfd-b934-9dfbcd356681","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.2_Ensure_minimum_password_length_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.2"}],"steps":[{"uuid":"1b5a655d-4e2e-57bd-b070-9ba286936728","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.2_Ensure_minimum_password_length_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5(1)"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure minimum password length is configured","remarks":"Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords.","description":"## Description\n\nThe minimum password length setting determines the lowers number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps \"passphrase\" is a better term than \"password\".\n\nThe `minlen` option sets the minimum acceptable size for the new password (plus one if credits are not disabled which is the default). Cannot be set to lower value than 6.\n\n## Audit\n\nRun the following command to verify that password length is `14` or more characters, and conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*minlen\\h*=\\h*(1[4-9]|[2-9][0-9]|[1-9][0-9]{2,})\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwlength.conf:minlen = 14\n```\n\nVerify returned value(s) are no less than `14` characters and meet local site policy\n\nRun the following command to verify that `minlen` is not set, or is `14` or more characters, and conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?minlen\\h*=\\h*([0-9]|1[0-3])\\b' /etc/pam.d/system-auth /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- settings should be configured in only **one** location for clarity\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"5e74b869-8b71-5c62-8038-1230d884b192","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.2_Ensure_minimum_password_length_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure minimum password length is configured","description":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set password length of `14` or more characters. Ensure that password length conforms to local site policy:\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minlen\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minlen = 14\" > /etc/security/pwquality.conf.d/50-pwlength.conf\n}\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?minlen\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `minlen` argument from the `pam_pwquality.so` line(s):\n\nImpact:\n\nIn general, it is true that longer passwords are better (harder to crack), but it is also true that forced password length requirements can cause user behavior that is predictable and undesirable. For example, requiring users to have a minimum 16-character password may cause them to choose repeating patterns like fourfourfourfour or passwordpassword that meet the requirement but aren’t hard to guess. Additionally, length requirements increase the chances that users will adopt other insecure practices, like writing them down, re-using them or storing them unencrypted in their documents.\n\nHaving a reasonable minimum length with no maximum character limit increases the resulting\naverage password length used (and therefore the strength).6"}],"title":"5.3.3.2.2 Ensure minimum password length is configured","description":"The minimum password length setting determines the lowers number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps \"passphrase\" is a better term than \"password\".\n\nThe `minlen` option sets the minimum acceptable size for the new password (plus one if credits are not disabled which is the default). Cannot be set to lower value than 6."},{"uuid":"e8896ed3-ac04-5082-88dc-5fe758e5668d","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.3_Ensure_password_complexity_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.3"}],"steps":[{"uuid":"edbc8ae9-1519-5a2a-8189-1c0931fba5fc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.3_Ensure_password_complexity_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password complexity is configured","remarks":"Strong passwords protect systems from being hacked through brute force methods.\n\nRequiring at least one non-alphabetic character increases the search space beyond pure dictionary words, which makes the resulting password harder to crack.\n\nForcing users to choose an excessively complex password, e.g. some combination of upper-case, lower-case, numbers, and special characters, has a negative impact. It places an extra burden on users and many will use predictable patterns (for example, a capital letter in the first position, followed by lowercase letters, then one or two numbers, and a “special character” at the end). Attackers know this, so dictionary attacks will often contain these common patterns and use the most common substitutions like, $ for s, @ for a, 1 for l, 0 for o.","description":"## Description\n\nPassword complexity can be set through:\n\n- `minclass` - The minimum number of classes of characters required in a new password. (digits, uppercase, lowercase, others). e.g. `minclass = 4` requires digits, uppercase, lower case, and special characters.\n- `dcredit` - The maximum credit for having digits in the new password. If less than `0` it is the minimum number of digits in the new password. e.g. `dcredit = -1` requires at least one digit\n- `ucredit` - The maximum credit for having uppercase characters in the new password. If less than `0` it is the minimum number of uppercase characters in the new password. e.g. `ucredit = -1` requires at least one uppercase character\n- `ocredit` - The maximum credit for having other characters in the new password. If less than `0` it is the minimum number of other characters in the new password. e.g. `ocredit = -1` requires at least one special character\n- `lcredit` - The maximum credit for having lowercase characters in the new password. If less than `0` it is the minimum number of lowercase characters in the new password. e.g. `lcredit = -1` requires at least one lowercase character\n\n## Audit\n\nRun the following command to verify:\n\n- `dcredit`, `ucredit`, `lcredit`, and `ocredit` are not set to a value greater than `0`\n- Complexity conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*(minclass|[dulo]credit)\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwcomplexity.conf:minclass = 3\n/etc/security/pwquality.conf.d/50-pwcomplexity.conf:ucredit = -2\n/etc/security/pwquality.conf.d/50-pwcomplexity.conf:lcredit = -2\n/etc/security/pwquality.conf.d/50-pwcomplexity.conf:dcredit = -1\n/etc/security/pwquality.conf.d/50-pwcomplexity.conf:ocredit = 0\n```\n\nThe example represents a requirement of three character classes, with passwords requiring two upper case, two lower case, and one numeric character.\n\nRun the following command to verify that module arguments in the configuration file(s) are not being overridden by arguments in `/etc/pam.d/common-password`:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?(minclass=\\d*|[dulo]credit=-?\\d*)\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- settings should be configured in only **one** location for clarity\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"9716a0dc-e189-574d-a478-3fb59d97c11c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.3_Ensure_password_complexity_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password complexity is configured","description":"Run the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?(minclass|[dulo]credit)\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `minclass`, `dcredit`, `ucredit`, `lcredit`, and `ocredit` arguments from the `pam_pwquality.so` line(s)\n\nCreate or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line(s) to set complexity according to local site policy:\n\n- `minclass = _N_`\n- `dcredit = _N_` # Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ucredit = -1` # Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ocredit = -1` # Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `lcredit = -1` # Value should be either `0` or a number proceeded by a minus (`-`) symbol\n\nExample 1 - Set `minclass = 3`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minclass = 3\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\nExample 2 - set `dcredit = -1`, `ucredit = -1`, and `lcredit = -1`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '%s\\n' \"dcredit = -1\" \"ucredit = -1\" \"lcredit = -1\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\nImpact:\n\nPasswords that are too complex in nature make it harder for users to remember, leading to bad practices. In addition, composition requirements provide no defense against common attack types such as social engineering or insecure storage of passwords"}],"title":"5.3.3.2.3 Ensure password complexity is configured","description":"Password complexity can be set through:\n\n- `minclass` - The minimum number of classes of characters required in a new password. (digits, uppercase, lowercase, others). e.g. `minclass = 4` requires digits, uppercase, lower case, and special characters.\n- `dcredit` - The maximum credit for having digits in the new password. If less than `0` it is the minimum number of digits in the new password. e.g. `dcredit = -1` requires at least one digit\n- `ucredit` - The maximum credit for having uppercase characters in the new password. If less than `0` it is the minimum number of uppercase characters in the new password. e.g. `ucredit = -1` requires at least one uppercase character\n- `ocredit` - The maximum credit for having other characters in the new password. If less than `0` it is the minimum number of other characters in the new password. e.g. `ocredit = -1` requires at least one special character\n- `lcredit` - The maximum credit for having lowercase characters in the new password. If less than `0` it is the minimum number of lowercase characters in the new password. e.g. `lcredit = -1` requires at least one lowercase character"},{"uuid":"2e0669db-62e8-550c-abdd-4f5b97617ba7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.4_Ensure_password_same_consecutive_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.4"}],"steps":[{"uuid":"56cd6e40-c98c-585f-8c70-6f734716e9bb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.4_Ensure_password_same_consecutive_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password same consecutive characters is configured","remarks":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.","description":"## Description\n\nThe `pwquality` `maxrepeat` option sets the maximum number of allowed same consecutive characters in a new password.\n\n## Audit\n\nRun the following command to verify that the `maxrepeat` option is set to `3` or less, not `0`, and follows local site policy:\n\n```bash\n# grep -Psi -- '^\\h*maxrepeat\\h*=\\h*[1-3]\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwrepeat.conf:maxrepeat = 3\n```\n\nVerify returned value(s) are `3` or less, not `0`, and meet local site policy\n\nRun the following command to verify that `maxrepeat` is not set, is `3` or less, not `0`, and conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxrepeat\\h*=\\h*(0|[4-9]|[1-9][0-9]+)\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- settings should be configured in only **one** location for clarity\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"84034fae-2a0c-5dc8-b44e-2fefb6b44952","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.4_Ensure_password_same_consecutive_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password same consecutive characters is configured","description":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxrepeat` to `3` or less and not `0`. Ensure setting conforms to local site policy:\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxrepeat\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxrepeat = 3\" > /etc/security/pwquality.conf.d/50-pwrepeat.conf\n}\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxrepeat\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `maxrepeat` argument from the `pam_pwquality.so` line(s):"}],"title":"5.3.3.2.4 Ensure password same consecutive characters is configured","description":"The `pwquality` `maxrepeat` option sets the maximum number of allowed same consecutive characters in a new password."},{"uuid":"a8c875e4-a8ac-5ada-93ca-ece4ced896f2","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.5_Ensure_password_maximum_sequential_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.5"}],"steps":[{"uuid":"f968b757-0906-5dd1-a90d-8c3bc7fe1d4c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.5_Ensure_password_maximum_sequential_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password maximum sequential characters is configured","remarks":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.","description":"## Description\n\nThe `pwquality` `maxsequence` option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are `12345` or `fedcb`. The check is disabled if the value is `0`.\n\n**Note:** Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password.\n\n## Audit\n\nRun the following command to verify that the `maxsequence` option is set to `3` or less, not `0`, and follows local site policy:\n\n```bash\n# grep -Psi -- '^\\h*maxsequence\\h*=\\h*[1-3]\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwmaxsequence.conf:maxsequence = 3\n```\n\nVerify returned value(s) are `3` or less, not `0`, and meet local site policy\n\nRun the following command to verify that `maxsequence` is not set, is `3` or less, not `0`, and conforms to local site policy:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxsequence\\h*=\\h*(0|[4-9]|[1-9][0-9]+)\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- settings should be configured in only **one** location for clarity\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"7d6284a3-bbf9-5daf-abf2-d04c622ec447","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.5_Ensure_password_maximum_sequential_characters_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password maximum sequential characters is configured","description":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxsequence` to `3` or less and not `0`. Ensure setting conforms to local site policy:\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxsequence\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxsequence = 3\" > /etc/security/pwquality.conf.d/50-pwmaxsequence.conf\n}\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxsequence\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `maxsequence` argument from the `pam_pwquality.so` line(s):"}],"title":"5.3.3.2.5 Ensure password maximum sequential characters is configured","description":"The `pwquality` `maxsequence` option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are `12345` or `fedcb`. The check is disabled if the value is `0`.\n\n**Note:** Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password."},{"uuid":"30cb493d-884e-5bc1-a092-3b50edd16870","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.6_Ensure_password_dictionary_check_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.6"}],"steps":[{"uuid":"71cc1111-80d7-599a-8d79-40dd4d575a3e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.6_Ensure_password_dictionary_check_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password dictionary check is enabled","remarks":"If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute-force attacks.","description":"## Description\n\nThe `pwquality` `dictcheck` option sets whether to check for the words from the `cracklib` dictionary.\n\n## Audit\n\nRun the following command to verify that the `dictcheck` option is not set to `0` (disabled) in a pwquality configuration file:\n\n```bash\n# grep -Psi -- '^\\h*dictcheck\\h*=\\h*0\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nNothing should be returned\n\nRun the following command to verify that the `dictcheck` option is not set to `0` (disabled) as a module argument in a PAM file:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+(requisite|required|sufficient)\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?dictcheck\\h*=\\h*0\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned\n\n**Note:**\n\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"2e023e0f-0b8c-5acf-8b26-a75aef0f4b31","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.6_Ensure_password_dictionary_check_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password dictionary check is enabled","description":"Edit any file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and/or the file `/etc/security/pwquality.conf` and comment out or remove any instance of `dictcheck = 0`:\n\nExample:\n\n```bash\n# sed -ri 's/^\\s*dictcheck\\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nRun the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?dictcheck\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `dictcheck` argument from the `pam_pwquality.so` line(s)"}],"title":"5.3.3.2.6 Ensure password dictionary check is enabled","description":"The `pwquality` `dictcheck` option sets whether to check for the words from the `cracklib` dictionary."},{"uuid":"a2b51651-c787-5556-b3bd-9a5f404d5065","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.7_Ensure_password_quality_checking_is_enforced"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.7"}],"steps":[{"uuid":"57d9e492-7745-513e-8e86-39325b5e6184","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.7_Ensure_password_quality_checking_is_enforced"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password quality checking is enforced","remarks":"Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords.","description":"## Description\n\nThe `pam_pwquality` module can be configured to either reject a password if it fails the checks, or only print a warning.\n\nThis is configured by setting the `enforcing=` argument. If nonzero, a password will be rejected if it fails the checks, otherwise only a warning message will be provided.\n\nThis setting applies only to the pam_pwquality module and possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1).\n\n## Audit\n\nRun the following command to verify that `enforcing=0` has not been set in a `pwquality` configuration file:\n\n```bash\n# grep -PHsi -- '^\\h*enforcing\\h*=\\h*0\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nNothing should be returned\n\nRun the following command to verify that the `enforcing=0` argument has not been set on the `pam_pwquality` module:\n\n```bash\n# grep -PHsi -- '^\\h*password\\h+[^#\\n\\r]+\\h+pam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?enforcing=0\\b' /etc/pam.d/common-password\n```\n\nNothing should be returned"},{"uuid":"b3237c80-8a0d-5357-ba29-838d13f9441b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.7_Ensure_password_quality_checking_is_enforced"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password quality checking is enforced","description":"Run the following command:\n\n```bash\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?enforcing=0\\b' /usr/share/pam-configs/*\n```\n\nEdit any returned files and remove the `enforcing=0` argument from the `pam_pwquality.so` line(s)\n\nEdit `/etc/security/pwquality.conf` and all files ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and remove or comment out any line containing the `enforcing = 0` argument:\n\nExample:\n\n```bash\n# sed -ri 's/^\\s*enforcing\\s*=\\s*0/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```"}],"title":"5.3.3.2.7 Ensure password quality checking is enforced","description":"The `pam_pwquality` module can be configured to either reject a password if it fails the checks, or only print a warning.\n\nThis is configured by setting the `enforcing=` argument. If nonzero, a password will be rejected if it fails the checks, otherwise only a warning message will be provided.\n\nThis setting applies only to the pam_pwquality module and possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1)."},{"uuid":"ce8af1c9-566a-5fb3-8c7e-a83c2a442b1d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.2 Configure pam_pwquality module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.8_Ensure_password_quality_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.2.8"}],"steps":[{"uuid":"fd032e0a-61d5-5ae8-845f-4f3dbfac6d64","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.8_Ensure_password_quality_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password quality is enforced for the root user","remarks":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.","description":"## Description\n\nIf the `pwquality` `enforce_for_root` option is enabled, the module will return error on failed check even if the user changing the password is root.\n\nThis option is off by default which means that just the message about the failed check is printed but root can change the password anyway.\n\n**Note:** The root is not asked for an old password so the checks that compare the old and new password are not performed.\n\n## Audit\n\nRun the following command to verify that the `enforce_for_root` option is enabled in a pwquality configuration file:\n\n```bash\n# grep -Psi -- '^\\h*enforce_for_root\\b' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\nExample output:\n\n```bash\n/etc/security/pwquality.conf.d/50-pwroot.conf:enforce_for_root\n```\n\n**Note:**\n\n- Settings observe an order of precedence:\n\nmodule arguments override the settings in the `/etc/security/pwquality.conf` configuration file\n- settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory\n- settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory are read in canonical order, with last read file containing the setting taking precedence\n\n- It is recommended that settings be configured in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory for clarity, convenience, and durability."},{"uuid":"f0ae973a-6cd5-5c3e-af4e-f5ae89ac7a3e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.8_Ensure_password_quality_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password quality is enforced for the root user","description":"Edit or add the following line in a `*.conf` file in `/etc/security/pwquality.conf.d` or in `/etc/security/pwquality.conf`:\n\nExample:\n\n```bash\n#!/urs/bin/env bash\n\n{\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s\\n' \"enforce_for_root\" > /etc/security/pwquality.conf.d/50-pwroot.conf\n}\n```"}],"title":"5.3.3.2.8 Ensure password quality is enforced for the root user","description":"If the `pwquality` `enforce_for_root` option is enabled, the module will return error on failed check even if the user changing the password is root.\n\nThis option is off by default which means that just the message about the failed check is printed but root can change the password anyway.\n\n**Note:** The root is not asked for an old password so the checks that compare the old and new password are not performed."},{"uuid":"8bd1f390-820c-5f12-baa1-32a272180747","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.3 Configure pam_pwhistory module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.1_Ensure_password_history_remember_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.3.1"}],"steps":[{"uuid":"d5ce927c-9761-56ea-b99f-0133afd44bf6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.1_Ensure_password_history_remember_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5(1)"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password history remember is configured","remarks":"Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password.\n\n**Note:** These change only apply to accounts configured on the local system.","description":"## Description\n\nThe `/etc/security/opasswd` file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set via the remember argument value in set for the `pam_pwhistory` module.\n\n- remember= - `` is the number of old passwords to remember\n\n## Audit\n\nRun the following command and verify:\n\n- The `pwhistory` line in `/etc/pam.d/common-password` includes `remember=`\n- The value of is `24` or more\n- The value meets local site policy\n\n```bash\n# grep -Psi -- '^\\h*password\\h+[^#\\n\\r]+\\h+pam_pwhistory\\.so\\h+([^#\\n\\r]+\\h+)?remember=\\d+\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\npassword requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```"},{"uuid":"e33d80c4-1969-515d-ad20-23733c21c9ba","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.1_Ensure_password_history_remember_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password history remember is configured","description":"Run the following command:\n\n```bash\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```\n\nEdit any returned files and edit or add the `remember=` argument, with a value of `24` or more, that meets local site policy to the `pam_pwhistory` line in the `Password` section:\n\nExample File:\n\n```bash\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # **\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable pwhistory\n```"}],"title":"5.3.3.3.1 Ensure password history remember is configured","description":"The `/etc/security/opasswd` file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set via the remember argument value in set for the `pam_pwhistory` module.\n\n- remember= - `` is the number of old passwords to remember"},{"uuid":"80bb2cc7-f0d9-55c5-892c-503f130e1bc6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.3 Configure pam_pwhistory module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.2_Ensure_password_history_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.3.2"}],"steps":[{"uuid":"25f4abea-a038-5f4d-993b-a1c9e5f7090a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.2_Ensure_password_history_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password history is enforced for the root user","remarks":"Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password\n\n**Note:** These change only apply to accounts configured on the local system.","description":"## Description\n\nIf the `pwhistory` `enforce_for_root` option is enabled, the module will enforce password history for the root user as well\n\n## Audit\n\nRun the following command to verify that the `enforce_for_root` argument is exists on the `pwhistory` line in `/etc/pam.d/common-password`:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+[^#\\n\\r]+\\h+pam_pwhistory\\.so\\h+([^#\\n\\r]+\\h+)?enforce_for_root\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\npassword requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```"},{"uuid":"64e68712-4d67-5b87-b028-28a7df23d9fb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.2_Ensure_password_history_is_enforced_for_the_root_user"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password history is enforced for the root user","description":"Run the following command:\n\n```bash\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```\n\nEdit any returned files and add the `enforce_for_root` argument to the `pam_pwhistory` line in the `Password` section:\n\nExample File:\n\n```bash\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes enforce_for_root**\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable pwhistory\n```"}],"title":"5.3.3.3.2 Ensure password history is enforced for the root user","description":"If the `pwhistory` `enforce_for_root` option is enabled, the module will enforce password history for the root user as well"},{"uuid":"da7ec04e-885f-55a0-bca4-33a779bad54e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.3 Configure pam_pwhistory module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.3_Ensure_pam_pwhistory_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.3.3"}],"steps":[{"uuid":"53f9375c-1368-5295-bc17-256399d654ff","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.3_Ensure_pam_pwhistory_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:4"}],"title":"Audit for Ensure pam_pwhistory includes use_authtok","remarks":"`use_authtok` allows multiple pam modules to confirm a new password before it is accepted.","description":"## Description\n\n`use_authtok` - When password changing enforce the module to set the new password to the one provided by a previously stacked password module\n\n## Audit\n\nRun the following command to verify that the `use_authtok` argument exists on the `pwhistory` line in `/etc/pam.d/common-password`:\n\n```bash\n# grep -Psi -- '^\\h*password\\h+[^#\\n\\r]+\\h+pam_pwhistory\\.so\\h+([^#\\n\\r]+\\h+)?use_authtok\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\npassword requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```"},{"uuid":"f42174c4-f006-573e-aa05-a66469a2a86f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.3_Ensure_pam_pwhistory_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_pwhistory includes use_authtok","description":"Run the following command:\n\n```bash\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```\n\nEdit any returned files and add the `use_authtok` argument to the `pam_pwhistory` line in the `Password` section:\n\nExample File:\n\n```bash\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes use_authtok**\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable pwhistory\n```"}],"title":"5.3.3.3.3 Ensure pam_pwhistory includes use_authtok","description":"`use_authtok` - When password changing enforce the module to set the new password to the one provided by a previously stacked password module"},{"uuid":"72740713-efb7-5dc4-bf2d-9499f569e0ad","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.4 Configure pam_unix module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.1_Ensure_pam_unix_does_not_include_nullok"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.4.1"}],"steps":[{"uuid":"61edc057-4458-582a-8236-d68b96cf7dd6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.1_Ensure_pam_unix_does_not_include_nullok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure pam_unix does not include nullok","remarks":"Using a strong password is essential to helping protect personal and sensitive information from unauthorized access","description":"## Description\n\nThe `nullok` argument overrides the default action of `pam_unix.so` to not permit the user access to a service if their official password is blank.\n\n## Audit\n\nRun the following command to verify that the `nullok` argument is not set on the `pam_unix.so` module:\n\n```bash\n# grep -PH -- '^\\h*^\\h*[^#\\n\\r]+\\h+pam_unix\\.so\\b' /etc/pam.d/common-{password,auth,account,session,session-noninteractive} | grep -Pv -- '\\bnullok\\b'\n```\n\nOutput should be similar to:\n\n```bash\n/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\n/etc/pam.d/common-auth:auth [success=2 default=ignore] pam_unix.so try_first_pass\n/etc/pam.d/common-account:account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so\n/etc/pam.d/common-session:session required pam_unix.so\n/etc/pam.d/common-session-noninteractive:session required pam_unix.so\n```"},{"uuid":"61469267-b009-565c-967c-424ccc5b8956","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.1_Ensure_pam_unix_does_not_include_nullok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_unix does not include nullok","description":"Run the following command:\n\n```bash\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?nullok\\b' /usr/share/pam-configs/*\n```\n\nEdit any files returned and remove the `nullok` argument for the `pam_unix` lines\n\nExample File:\n\n```bash\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass # <- **ensure line does not include nullok nullok**\nAuth-Initial:\n [success=end default=ignore] pam_unix.so # <- **ensure line does not include nullok nullok**\nAccount-Type: Primary\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable unix\n```\n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped"}],"title":"5.3.3.4.1 Ensure pam_unix does not include nullok","description":"The `nullok` argument overrides the default action of `pam_unix.so` to not permit the user access to a service if their official password is blank."},{"uuid":"b3a1d4b8-c0d4-567d-925e-258b26b5898d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.4 Configure pam_unix module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.2_Ensure_pam_unix_does_not_include_remember"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.4.2"}],"steps":[{"uuid":"c2839d7c-0a7c-55b2-bdb5-30c2aad066b4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.2_Ensure_pam_unix_does_not_include_remember"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure pam_unix does not include remember","remarks":"The `remember=n` argument should be removed to ensure a strong password hashing algorithm is being used. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user's old passwords stored in `/etc/security/opasswd`.","description":"## Description\n\nThe `remember=n` argument saves the last n passwords for each user in `/etc/security/opasswd` in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the `pam_pwhistory` module should be used. The `pam_pwhistory` module saves the last n passwords for each user in `/etc/security/opasswd` using the password hash algorithm set on the `pam_unix` module. This allows for the `yescrypt` or `sha512` hash algorithm to be used.\n\n## Audit\n\nRun the following command to verify that the `remember` argument is not set on the `pam_unix.so` module:\n\n```bash\n# grep -PH -- '^\\h*^\\h*[^#\\n\\r]+\\h+pam_unix\\.so\\b' /etc/pam.d/common-{password,auth,account,session,session-noninteractive} | grep -Pv -- '\\bremember=\\d+\\b'\n```\n\nOutput should be similar to:\n\n```bash\n/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure yescrypt\n/etc/pam.d/common-auth:auth [success=1 default=ignore] pam_unix.so\n/etc/pam.d/common-account:account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so\n/etc/pam.d/common-session:session required pam_unix.so\n/etc/pam.d/common-session-noninteractive:session required pam_unix.so\n```"},{"uuid":"5be357bc-11ec-5153-8054-cf6f5a0080dd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.2_Ensure_pam_unix_does_not_include_remember"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_unix does not include remember","description":"Run the following command:\n\n```bash\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?remember\\b' /usr/share/pam-configs/*\n```\n\nEdit any files returned and remove the `remember=__` argument for the `pam_unix` lines\n\nExample output:\n\n```bash\n[success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5 # ****\n[success=end default=ignore] pam_unix.so obscure yescrypt remember=5 # ****\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable unix\n```\n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped"}],"title":"5.3.3.4.2 Ensure pam_unix does not include remember","description":"The `remember=n` argument saves the last n passwords for each user in `/etc/security/opasswd` in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the `pam_pwhistory` module should be used. The `pam_pwhistory` module saves the last n passwords for each user in `/etc/security/opasswd` using the password hash algorithm set on the `pam_unix` module. This allows for the `yescrypt` or `sha512` hash algorithm to be used."},{"uuid":"c095b8d8-ca07-5cf4-9853-d5dfcb63c26d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.4 Configure pam_unix module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.3_Ensure_pam_unix_includes_a_strong_password_hashing_algorithm"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.4.3"}],"steps":[{"uuid":"c2b927a4-d55c-57b6-97e1-7c8e46cfee09","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.3_Ensure_pam_unix_includes_a_strong_password_hashing_algorithm"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:4"}],"title":"Audit for Ensure pam_unix includes a strong password hashing algorithm","remarks":"The `SHA-512` and `yescrypt` algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user passwords.\n\n**Note:** These changes only apply to the local system.","description":"## Description\n\nA cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.\n\nThe `pam_unix` module can be configured to use one of the following hashing algorithms for user's passwords:\n\n- `md5` - When a user changes their password next, encrypt it with the `MD5` algorithm.\n- `bigcrypt` - When a user changes their password next, encrypt it with the `DEC C2` algorithm.\n- `sha256` - When a user changes their password next, encrypt it with the `SHA256` algorithm. The `SHA256` algorithm must be supported by the crypt(3) function.\n- `sha512` - When a user changes their password next, encrypt it with the `SHA512` algorithm. The `SHA512` algorithm must be supported by the crypt(3) function.\n- `blowfish` - When a user changes their password next, encrypt it with the `blowfish` algorithm. The `blowfish` algorithm must be supported by the crypt(3) function.\n- `gost_yescrypt` - When a user changes their password next, encrypt it with the `gost-yescrypt` algorithm. The `gost-yescrypt` algorithm must be supported by the crypt(3) function.\n- `yescrypt` - When a user changes their password next, encrypt it with the `yescrypt` algorithm. The `yescrypt` algorithm must be supported by the crypt(3) function.\n\n## Audit\n\nRun the following command to verify that a strong password hashing algorithm is set on the pam_unix.so module:\n\n```bash\n# grep -PH -- '^\\h*password\\h+([^#\\n\\r]+)\\h+pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?(sha512|yescrypt)\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\n/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\n```\n\nVerify that the line(s) include either `sha512` **- OR -** `yescrypt`"},{"uuid":"14f9a7da-a6a3-5c47-9312-5add964ba0bb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.3_Ensure_pam_unix_includes_a_strong_password_hashing_algorithm"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_unix includes a strong password hashing algorithm","description":"Run the following command:\n\n```bash\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```\n\nEdit any returned files and edit or add a strong hashing algorithm, either sha512 or yescrypt, that meets local site policy to the `pam_unix` lines in the `Password` section:\n\nExample File:\n\n```bash\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable unix\n```"}],"title":"5.3.3.4.3 Ensure pam_unix includes a strong password hashing algorithm","description":"A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.\n\nThe `pam_unix` module can be configured to use one of the following hashing algorithms for user's passwords:\n\n- `md5` - When a user changes their password next, encrypt it with the `MD5` algorithm.\n- `bigcrypt` - When a user changes their password next, encrypt it with the `DEC C2` algorithm.\n- `sha256` - When a user changes their password next, encrypt it with the `SHA256` algorithm. The `SHA256` algorithm must be supported by the crypt(3) function.\n- `sha512` - When a user changes their password next, encrypt it with the `SHA512` algorithm. The `SHA512` algorithm must be supported by the crypt(3) function.\n- `blowfish` - When a user changes their password next, encrypt it with the `blowfish` algorithm. The `blowfish` algorithm must be supported by the crypt(3) function.\n- `gost_yescrypt` - When a user changes their password next, encrypt it with the `gost-yescrypt` algorithm. The `gost-yescrypt` algorithm must be supported by the crypt(3) function.\n- `yescrypt` - When a user changes their password next, encrypt it with the `yescrypt` algorithm. The `yescrypt` algorithm must be supported by the crypt(3) function."},{"uuid":"64a1fe59-2ab9-5007-b100-e817f126bf70","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.3 Pluggable Authentication Modules > 5.3.3 Configure PAM Arguments > 5.3.3.4 Configure pam_unix module"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.4_Ensure_pam_unix_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.3.3.4.4"}],"steps":[{"uuid":"fd1b8f09-3d49-5452-8c19-bebce81fdcc0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.4_Ensure_pam_unix_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:4"}],"title":"Audit for Ensure pam_unix includes use_authtok","remarks":"`use_authtok` allows multiple pam modules to confirm a new password before it is accepted.","description":"## Description\n\n`use_authtok` - When password changing enforce the module to set the new password to the one provided by a previously stacked password module\n\n## Audit\n\nRun the following command to verify that `use_authtok` is set on the pam_unix.so module lines in the password stack:\n\n```bash\n# grep -PH -- '^\\h*password\\h+([^#\\n\\r]+)\\h+pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?use_authtok\\b' /etc/pam.d/common-password\n```\n\nOutput should be similar to:\n\n```bash\n/etc/pam.d/common-password:password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\n```\n\nVerify that the line(s) include `use_authtok`"},{"uuid":"ded1341c-1e59-5c92-9e7c-4b4f27974366","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.4_Ensure_pam_unix_includes_use_authtok"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure pam_unix includes use_authtok","description":"Run the following command:\n\n```bash\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```\n\nEdit any returned files add `use_authtok` to the `pam_unix` line in the `Password` section under `Password:` subsection:\n\n**Note:** The if the file's `Password` section includes a `Password-Initial:` subsection, `use_authtok` should not be added to the `pam_unix` line in the `Password-Initial:` subsection\n\nExample File:\n\n```bash\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure line includes use_authtok**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **Password-Initial: subsection does not include use_authtok\n```\n\nRun the following command to update the files in the `/etc/pam.d/` directory:\n\n```bash\n# pam-auth-update --enable\n```\n\nExample:\n\n```bash\n# pam-auth-update --enable unix\n```"}],"title":"5.3.3.4.4 Ensure pam_unix includes use_authtok","description":"`use_authtok` - When password changing enforce the module to set the new password to the one provided by a previously stacked password module"},{"uuid":"d30efac0-5449-59f2-8c16-a254eae58333","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.1_Ensure_password_expiration_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.1"}],"steps":[{"uuid":"588b2a80-6742-5fca-b76e-d005a0a09417","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.1_Ensure_password_expiration_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password expiration is configured","remarks":"The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. Therefore, reducing the maximum age of a password also reduces an attacker's window of opportunity.\n\nWe recommend a yearly password change. This is primarily because for all their good intentions users will share credentials across accounts. Therefore, even if a breach is publicly identified, the user may not see this notification, or forget they have an account on that site. This could leave a shared credential vulnerable indefinitely. Having an organizational policy of a 1-year (annual) password expiration is a reasonable compromise to mitigate this with minimal user burden.","description":"## Description\n\nThe `PASS_MAX_DAYS` parameter in `/etc/login.defs` allows an administrator to force passwords to expire once they reach a defined age.\n\n`PASS_MAX_DAYS` - The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, -1 will be assumed (which disables the restriction).\n\n## Audit\n\nRun the following command and verify `PASS_MAX_DAYS` is set to 365 days or less and conforms to local site policy:\n\n```bash\n# grep -Pi -- '^\\h*PASS_MAX_DAYS\\h+\\d+\\b' /etc/login.defs\n```\n\nExample output:\n\n```bash\nPASS_MAX_DAYS 365\n```\n\nRun the following command to verify all `/etc/shadow` passwords `PASS_MAX_DAYS`:\n\n- is greater than `0` days\n- is less than or equal to `365` days\n- conforms to local site policy\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($5 > 365 || $5 < 1)print \"User: \" $1 \" PASS_MAX_DAYS: \" $5}' /etc/shadow\n```\n\nNothing should be returned"},{"uuid":"5ada9d2a-061d-5953-b777-eadc0a4ca983","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.1_Ensure_password_expiration_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password expiration is configured","description":"Set the `PASS_MAX_DAYS` parameter to conform to site policy in `/etc/login.defs` :\n\n```bash\nPASS_MAX_DAYS 365\n```\n\nModify user parameters for all users with a password set to match:\n\n```bash\n# chage --maxdays 365\n```\n\nEdit `/etc/login.defs` and set `PASS_MAX_DAYS` to a value greater than `0` that follows local site policy:\n\nExample:\n\n```bash\nPASS_MAX_DAYS 365\n```\n\nRun the following command to modify user parameters for all users with a password set to a maximum age no greater than `365` or less than `1` that follows local site policy:\n\n```bash\n# chage --maxdays\n```\n\nExample:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($5 > 365 || $5 < 1)system (\"chage --maxdays 365 \" $1)}' /etc/shadow\n```\n\n**Warning:** If a password has been set at system install or kickstart, the `last change date` field is not set, In this case, setting `PASS_MAX_DAYS` will immediately expire the password. One possible solution is to populate the `last change date` field through a command like: `chage -d \"$(date +%Y-%m-%d)\" root`\n\nImpact:\n\nThe password expiration must be greater than the minimum days between password changes or users will be unable to change their password.\n\nExcessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous one (incrementing a number used in the password for\nexample). Also, password expiration requirements offer no containment benefits because attackers will often use credentials as soon as they compromise them. Instead, immediate password changes should be based on key events including, but not limited to:\n\n- Indication of compromise\n- Change of user roles\n- When a user leaves the organization.\n\nNot only does changing passwords every few weeks or months frustrate the user, but it’s also been suggested that it does more harm than good, because it could lead to bad practices by the user such as adding a character to the end of their existing password."}],"title":"5.4.1.1 Ensure password expiration is configured","description":"The `PASS_MAX_DAYS` parameter in `/etc/login.defs` allows an administrator to force passwords to expire once they reach a defined age.\n\n`PASS_MAX_DAYS` - The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, -1 will be assumed (which disables the restriction)."},{"uuid":"9f0b1347-21e1-54f7-9def-870627a3d98f","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.2_Ensure_minimum_password_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.2"}],"steps":[{"uuid":"79208a85-6d59-5c47-8667-51fdacb97348","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.2_Ensure_minimum_password_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure minimum password days is configured","remarks":"Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords are compromised and if an attacker is targeting a specific individual user account, with foreknowledge of data about that user, reuse of old, potentially compromised passwords, may cause a security breach.\n\nBy restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls","description":"## Description\n\n`PASS_MIN_DAYS` - The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, 0 will be assumed (which disables the restriction).\n\n## Audit\n\nRun the following command to verify that `PASS_MIN_DAYS` is set to a value greater than `0`and follows local site policy:\n\n```bash\n# grep -Pi -- '^\\h*PASS_MIN_DAYS\\h+\\d+\\b' /etc/login.defs\n```\n\nExample output:\n\n```bash\nPASS_MIN_DAYS 1\n```\n\nRun the following command to verify all passwords have a `PASS_MIN_DAYS` greater than `0`:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($4 < 1)print \"User: \" $1 \" PASS_MIN_DAYS: \" $4}' /etc/shadow\n```\n\nNothing should be returned"},{"uuid":"7e86921d-f4a6-5b2a-b04d-d2c8c15a76a0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.2_Ensure_minimum_password_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure minimum password days is configured","description":"Edit `/etc/login.defs` and set `PASS_MIN_DAYS` to a value greater than `0` that follows local site policy:\n\nExample:\n\n```bash\nPASS_MIN_DAYS 1\n```\n\nRun the following command to modify user parameters for all users with a password set to a minimum days greater than zero that follows local site policy:\n\n```bash\n# chage --mindays\n```\n\nExample:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($4 < 1)system (\"chage --mindays 1 \" $1)}' /etc/shadow\n```\n\nImpact:\n\nIf a users password is set by other personnel as a procedure in dealing with a lost or expired password, the user should be forced to update this \"set\" password with their own password. e.g. force \"change at next logon\".\n\nIf it is not possible to have a user set their own password immediately, and this recommendation or local site procedure may cause a user to continue using a third party generated password, `PASS_MIN_DAYS` for the effected user should be temporally changed to `0`, to allow a user to change their password immediately.\n\nFor applications where the user is not using the password at console, the ability to \"change at next logon\" may be limited. This may cause a user to continue to use a password created by other personnel."}],"title":"5.4.1.2 Ensure minimum password days is configured","description":"`PASS_MIN_DAYS` - The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, 0 will be assumed (which disables the restriction)."},{"uuid":"8ff0227b-6e05-5722-9351-6d786201a733","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.3_Ensure_password_expiration_warning_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.3"}],"steps":[{"uuid":"cb20d5a0-6f12-5200-afa5-9e920efb88a1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.3_Ensure_password_expiration_warning_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:1"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure password expiration warning days is configured","remarks":"Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered.","description":"## Description\n\nThe `PASS_WARN_AGE` parameter in `/etc/login.defs` allows an administrator to notify users that their password will expire in a defined number of days.\n\n`PASS_WARN_AGE` - The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided.\n\n## Audit\n\nRun the following command and verify `PASS_WARN_AGE` is `7` or more and follows local site policy:\n\n```bash\n# grep -Pi -- '^\\h*PASS_WARN_AGE\\h+\\d+\\b' /etc/login.defs\n```\n\nExample output:\n\n```bash\nPASS_WARN_AGE 7\n```\n\nRun the following command to verify all passwords have a `PASS_WARN_AGE` of `7` or more:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($6 < 7)print \"User: \" $1 \" PASS_WARN_AGE: \" $6}' /etc/shadow\n```\n\nNothing should be returned"},{"uuid":"719e2dee-f7cb-5b3d-bbee-8c6930f6dd8b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.3_Ensure_password_expiration_warning_days_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure password expiration warning days is configured","description":"Edit `/etc/login.defs` and set `PASS_WARN_AGE` to a value of `7` or more that follows local site policy:\n\nExample:\n\n```bash\nPASS_WARN_AGE 7\n```\n\nRun the following command to modify user parameters for all users with a password set to a minimum warning to `7` or more days that follows local site policy:\n\n```bash\n# chage --warndays\n```\n\nExample:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($6 < 7)system (\"chage --warndays 7 \" $1)}' /etc/shadow\n```"}],"title":"5.4.1.3 Ensure password expiration warning days is configured","description":"The `PASS_WARN_AGE` parameter in `/etc/login.defs` allows an administrator to notify users that their password will expire in a defined number of days.\n\n`PASS_WARN_AGE` - The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided."},{"uuid":"b73cdd9c-4df5-537d-9efe-5a7391f647a6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.4_Ensure_strong_password_hashing_algorithm_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.4"}],"steps":[{"uuid":"da18c0e8-1572-5244-b871-87de5ce1d13b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.4_Ensure_strong_password_hashing_algorithm_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:4"}],"title":"Audit for Ensure strong password hashing algorithm is configured","remarks":"The `SHA-512` and `yescrypt` algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local group passwords.","description":"## Description\n\nA cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.\n\n`ENCRYPT_METHOD` (string) - This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values:\n\n- `MD5` - MD5-based algorithm will be used for encrypting password\n- `SHA256` - SHA256-based algorithm will be used for encrypting password\n- `SHA512` - SHA512-based algorithm will be used for encrypting password\n- `BCRYPT` - BCRYPT-based algorithm will be used for encrypting password\n- `YESCRYPT` - YESCRYPT-based algorithm will be used for encrypting password\n- `DES` - DES-based algorithm will be used for encrypting password (default)\n\n**Note:**\n\n- This parameter overrides the deprecated `MD5_CRYPT_ENAB` variable.\n- This parameter will only affect the generation of group passwords.\n- The generation of user passwords is done by PAM and subject to the PAM configuration.\n- It is recommended to set this variable consistently with the PAM configuration.\n\n## Audit\n\nRun the following command to verify the hashing algorithm is `sha512` or `yescrypt` in `/etc/login.defs`:\n\n```bash\n# grep -Pi -- '^\\h*ENCRYPT_METHOD\\h+(SHA512|yescrypt)\\b' /etc/login.defs\n```\n\nExample output:\n\n```bash\nENCRYPT_METHOD SHA512\n - OR -\nENCRYPT_METHOD YESCRYPT\n```"},{"uuid":"848b0e35-54d3-5574-8ed7-b06cbcc2f508","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.4_Ensure_strong_password_hashing_algorithm_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure strong password hashing algorithm is configured","description":"Edit `/etc/login.defs` and set the `ENCRYPT_METHOD` to `SHA512` or `YESCRYPT`:\n\n```bash\nENCRYPT_METHOD\n```\n\nExample:\n\n```bash\nENCRYPT_METHOD YESCRYPT\n```\n\n**Note:**\n\n- This only effects local groups' passwords created after updating the file to use `sha512` or `yescrypt`.\n- If it is determined that the password algorithm being used is not `sha512` or `yescrypt`, once it is changed, it is recommended that all group passwords be updated to use the stronger hashing algorithm.\n- It is recommended that the chosen hashing algorithm is consistent across `/etc/login.defs` and the PAM configuration"}],"title":"5.4.1.4 Ensure strong password hashing algorithm is configured","description":"A cryptographic hash function converts an arbitrary-length input into a fixed length output. Password hashing performs a one-way transformation of a password, turning the password into another string, called the hashed password.\n\n`ENCRYPT_METHOD` (string) - This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values:\n\n- `MD5` - MD5-based algorithm will be used for encrypting password\n- `SHA256` - SHA256-based algorithm will be used for encrypting password\n- `SHA512` - SHA512-based algorithm will be used for encrypting password\n- `BCRYPT` - BCRYPT-based algorithm will be used for encrypting password\n- `YESCRYPT` - YESCRYPT-based algorithm will be used for encrypting password\n- `DES` - DES-based algorithm will be used for encrypting password (default)\n\n**Note:**\n\n- This parameter overrides the deprecated `MD5_CRYPT_ENAB` variable.\n- This parameter will only affect the generation of group passwords.\n- The generation of user passwords is done by PAM and subject to the PAM configuration.\n- It is recommended to set this variable consistently with the PAM configuration."},{"uuid":"04f86ced-1cff-5ca9-9f70-dbacf2a8527e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.5_Ensure_inactive_password_lock_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.5"}],"steps":[{"uuid":"c60a0e37-07ef-5e8a-bd4e-eac23ef041a3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.5_Ensure_inactive_password_lock_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure inactive password lock is configured","remarks":"Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies.","description":"## Description\n\nUser accounts that have been inactive for over a given period of time can be automatically disabled.\n\n`INACTIVE` - Defines the number of days after the password exceeded its maximum age where the user is expected to replace this password.\n\nThe value is stored in the shadow password file. An input of `0` will disable an expired password with no delay. An input of `-1` will blank the respective field in the shadow password file.\n\n## Audit\n\nRun the following command and verify `INACTIVE` conforms to site policy (no more than 45 days):\n\n```bash\n# useradd -D | grep INACTIVE\n\nINACTIVE=45\n```\n\nVerify all users with a password have Password inactive no more than 45 days after password expires\n\nVerify all users with a password have Password inactive no more than 45 days after password expires: Run the following command and Review list of users and `INACTIVE` to verify that all users `INACTIVE` conforms to site policy (no more than 45 days):\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($7 > 45 || $7 < 0)print \"User: \" $1 \" INACTIVE: \" $7}' /etc/shadow\n```\n\nNothing should be returned"},{"uuid":"857801cb-ba2c-5953-9bb1-ee57b7f09695","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.5_Ensure_inactive_password_lock_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure inactive password lock is configured","description":"Run the following command to set the default password inactivity period to 45 days or less that meets local site policy:\n\n```bash\n# useradd -D -f\n```\n\nExample:\n\n```bash\n# useradd -D -f 45\n```\n\nRun the following command to modify user parameters for all users with a password set to a inactive age of `45` days or less that follows local site policy:\n\n```bash\n# chage --inactive\n```\n\nExample:\n\n```bash\n# awk -F: '($2~/^\\$.+\\$/) {if($7 > 45 || $7 < 0)system (\"chage --inactive 45 \" $1)}' /etc/shadow\n```"}],"title":"5.4.1.5 Ensure inactive password lock is configured","description":"User accounts that have been inactive for over a given period of time can be automatically disabled.\n\n`INACTIVE` - Defines the number of days after the password exceeded its maximum age where the user is expected to replace this password.\n\nThe value is stored in the shadow password file. An input of `0` will disable an expired password with no delay. An input of `-1` will blank the respective field in the shadow password file."},{"uuid":"5e4c739a-4ad6-5405-98ae-4fb63a37a43e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.1 Configure shadow password suite parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.6_Ensure_all_users_last_password_change_date_is_in_the_past"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.1.6"}],"steps":[{"uuid":"649fcf46-a9d1-5ff0-8401-4f824adbd9a2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.6_Ensure_all_users_last_password_change_date_is_in_the_past"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure all users last password change date is in the past","remarks":"If a user's recorded password change date is in the future, then they could bypass any set password expiration.","description":"## Description\n\nAll users should have a password change date in the past.\n\n## Audit\n\nRun the following command and verify nothing is returned\n\n```bash\n{\n while IFS= read -r l_user; do\n l_change=$(date -d \"$(chage --list $l_user | grep '^Last password change' | cut -d: -f2 | grep -v 'never$')\" +%s)\n if [[ \"$l_change\" -gt \"$(date +%s)\" ]]; then\n echo \"User: \\\"$l_user\\\" last password change was \\\"$(chage --list $l_user | grep '^Last password change' | cut -d: -f2)\\\"\"\n fi\n done < <(awk -F: '$2~/^\\$.+\\$/{print $1}' /etc/shadow)\n}\n```"},{"uuid":"417b1762-57c2-5ad3-8822-ce3da38cc534","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.1.6_Ensure_all_users_last_password_change_date_is_in_the_past"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure all users last password change date is in the past","description":"Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate."}],"title":"5.4.1.6 Ensure all users last password change date is in the past","description":"All users should have a password change date in the past."},{"uuid":"a5894ddc-6f82-5a32-95c6-3a0a288a7ac7","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.1_Ensure_root_is_the_only_UID_0_account"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.1"}],"steps":[{"uuid":"fdd11def-d3b1-597a-b15e-f633a0e47cf7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.1_Ensure_root_is_the_only_UID_0_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure root is the only UID 0 account","remarks":"This access must be limited to only the default `root` account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism as noted in Item 5.6 Ensure access to the su command is restricted.","description":"## Description\n\nAny account with UID 0 has superuser privileges on the system.\n\n## Audit\n\nRun the following command and verify that only \"root\" is returned:\n\n```bash\n# awk -F: '($3 == 0) { print $1 }' /etc/passwd\n\nroot\n```"},{"uuid":"370fbd02-ee77-5dd5-8695-79473dfd78f5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.1_Ensure_root_is_the_only_UID_0_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure root is the only UID 0 account","description":"Run the following command to change the `root` account UID to `0`:\n\n```bash\n# usermod -u 0 root\n```\n\nModify any users other than `root` with UID `0` and assign them a new UID."}],"title":"5.4.2.1 Ensure root is the only UID 0 account","description":"Any account with UID 0 has superuser privileges on the system."},{"uuid":"758f0b06-7390-5e95-b7d5-c1123ce6db57","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.2_Ensure_root_is_the_only_GID_0_account"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.2"}],"steps":[{"uuid":"387f513f-a328-5770-95ec-4633aaf031e9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.2_Ensure_root_is_the_only_GID_0_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure root is the only GID 0 account","remarks":"Using GID 0 for the `root` account helps prevent `root` -owned files from accidentally becoming accessible to non-privileged users.","description":"## Description\n\nThe `usermod` command can be used to specify which group the `root` account belongs to. This affects permissions of files that are created by the `root` account.\n\n## Audit\n\nRun the following command to verify the `root` user's primary GID is `0`, and no other user's have GID `0` as their primary GID:\n\n```bash\n# awk -F: '($1 !~ /^(sync|shutdown|halt|operator)/ && $4==\"0\") {print $1\":\"$4}' /etc/passwd\n\nroot:0\n```\n\n**Note:** User's: sync, shutdown, halt, and operator are excluded from the check for other user's with GID `0`"},{"uuid":"c3e4d63d-9170-5ab5-9379-0ad1d6914d0a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.2_Ensure_root_is_the_only_GID_0_account"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure root is the only GID 0 account","description":"Run the following command to set the `root` user's GID to `0`:\n\n```bash\n# usermod -g 0 root\n```\n\nRun the following command to set the `root` group's GID to `0`:\n\n```bash\n# groupmod -g 0 root\n```\n\nRemove any users other than the `root` user with GID 0 or assign them a new GID if appropriate."}],"title":"5.4.2.2 Ensure root is the only GID 0 account","description":"The `usermod` command can be used to specify which group the `root` account belongs to. This affects permissions of files that are created by the `root` account."},{"uuid":"57110c66-435e-5860-bb4b-a8d019b1de1a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.3_Ensure_group_root_is_the_only_GID_0_group"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"root"}],"steps":[{"uuid":"086ebcd9-117b-549f-9c0b-4ed0ad81cfbd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.3_Ensure_group_root_is_the_only_GID_0_group"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure group root is the only GID 0 group","remarks":"Using GID 0 for the `root` group helps prevent `root` group owned files from accidentally becoming accessible to non-privileged users.","description":"## Description\n\nThe `groupmod` command can be used to specify which group the `root` group belongs to. This affects permissions of files that are group owned by the `root` group.\n\n## Audit\n\nRun the following command to verify no group other than `root` is assigned GID `0`:\n\n```bash\n# awk -F: '$3==\"0\"{print $1\":\"$3}' /etc/group\n\nroot:0\n```"},{"uuid":"c26f8390-77f8-5a6b-a388-4ed39b16804a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.3_Ensure_group_root_is_the_only_GID_0_group"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure group root is the only GID 0 group","description":"Run the following command to set the `root` group's GID to `0`:\n\n```bash\n# groupmod -g 0 root\n```\n\nRemove any groups other than the `root` group with GID 0 or assign them a new GID if appropriate."}],"title":"root Ensure group root is the only GID 0 group","description":"The `groupmod` command can be used to specify which group the `root` group belongs to. This affects permissions of files that are group owned by the `root` group."},{"uuid":"63f740eb-f146-5c94-a6a9-cd25429b5775","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.4_Ensure_root_account_access_is_controlled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.4"}],"steps":[{"uuid":"d5b05abb-a27c-51ae-8fac-8d16cb268ed1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.4_Ensure_root_account_access_is_controlled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure root account access is controlled","remarks":"Access to `root` should be secured at all times.","description":"## Description\n\nThere are a number of methods to access the root account directly. Without a password set any user would be able to gain access and thus control over the entire system.\n\n## Audit\n\nRun the following command to verify that either the root user's password is set or the root user's account is locked:\n\n```bash\n# passwd -S root | awk '$2 ~ /^(P|L)/ {print \"User: \\\"\" $1 \"\\\" Password is status: \" $2}'\n```\n\nVerify the output is either:\n\n```bash\nUser: \"root\" Password is status: P \n- OR -\nUser: \"root\" Password is status: L\n```\n\n**Note:**\n\n- `P` - Password is set\n- `L` - Password is locked"},{"uuid":"6040b7bf-77cb-519a-bdfc-b89534c116e4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.4_Ensure_root_account_access_is_controlled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure root account access is controlled","description":"Run the following command to set a password for the `root` user:\n\n```bash\n# passwd root\n```\n\n**- OR -**\n\nRun the following command to lock the `root` user account:\n\n```bash\n# usermod -L root\n```\n\nImpact:\n\nIf there are any automated processes that relies on access to the root account without authentication, they will fail after remediation."}],"title":"5.4.2.4 Ensure root account access is controlled","description":"There are a number of methods to access the root account directly. Without a password set any user would be able to gain access and thus control over the entire system."},{"uuid":"17386ef6-a6b0-50aa-a43b-0e32e2989466","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.5_Ensure_root_path_integrity"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.5"}],"steps":[{"uuid":"7076f5f3-6eb4-5fdc-8a56-34afea1ffcd2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.5_Ensure_root_path_integrity"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure root path integrity","remarks":"Including the current working directory (.) or other writable directory in `root`'s executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as `root` to execute a Trojan horse program.","description":"## Description\n\nThe `root` user can execute any command on the system and could be fooled into executing programs unintentionally if the `PATH` is not set correctly.\n\n## Audit\n\nRun the following script to verify root's path does not include:\n\n- Locations that are not directories\n- An empty directory (`::`)\n- A trailing (`:`)\n- Current working directory (`.`)\n- Non `root` owned directories\n- Directories that less restrictive than mode `0755`\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output2=\"\"\n l_pmask=\"0022\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n l_root_path=\"$(sudo -Hiu root env | grep '^PATH' | cut -d= -f2)\"\n unset a_path_loc && IFS=\":\" read -ra a_path_loc <<< \"$l_root_path\"\n grep -q \"::\" <<< \"$l_root_path\" && l_output2=\"$l_output2\\n - root's path contains a empty directory (::)\"\n grep -Pq \":\\h*$\" <<< \"$l_root_path\" && l_output2=\"$l_output2\\n - root's path contains a trailing (:)\"\n grep -Pq '(\\h+|:)\\.(:|\\h*$)' <<< \"$l_root_path\" && l_output2=\"$l_output2\\n - root's path contains current working directory (.)\"\n while read -r l_path; do\n if [ -d \"$l_path\" ]; then\n while read -r l_fmode l_fown; do\n [ \"$l_fown\" != \"root\" ] && l_output2=\"$l_output2\\n - Directory: \\\"$l_path\\\" is owned by: \\\"$l_fown\\\" should be owned by \\\"root\\\"\"\n [ $(( $l_fmode & $l_pmask )) -gt 0 ] && l_output2=\"$l_output2\\n - Directory: \\\"$l_path\\\" is mode: \\\"$l_fmode\\\" and should be mode: \\\"$l_maxperm\\\" or more restrictive\"\n done <<< \"$(stat -Lc '%#a %U' \"$l_path\")\"\n else\n l_output2=\"$l_output2\\n - \\\"$l_path\\\" is not a directory\"\n fi\n done <<< \"$(printf \"%s\\n\" \"${a_path_loc[@]}\")\"\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n *** PASS ***\\n - Root's path is correctly configured\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\\n\"\n fi\n}\n```"},{"uuid":"4ae39bbb-a110-5012-aa5e-e8852bcdc267","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.5_Ensure_root_path_integrity"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure root path integrity","description":"Correct or justify any:\n\n- Locations that are not directories\n- Empty directories (`::`)\n- Trailing (`:`)\n- Current working directory (`.`)\n- Non `root` owned directories\n- Directories that less restrictive than mode `0755`"}],"title":"5.4.2.5 Ensure root path integrity","description":"The `root` user can execute any command on the system and could be fooled into executing programs unintentionally if the `PATH` is not set correctly."},{"uuid":"cac6d1be-88df-5825-b75f-89e64122575a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.6_Ensure_root_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.6"}],"steps":[{"uuid":"6c861eb0-0e5f-5d82-a970-9f7d4ea9631c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.6_Ensure_root_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure root user umask is configured","remarks":"Setting a secure value for `umask` ensures that users make a conscious choice about their file permissions. A permissive `umask` value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users.","description":"## Description\n\nThe user file-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value - Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value - Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\n**root user Shell Configuration Files:**\n\n- `/root/.bash_profile` - Is executed to configure the root users' shell before the initial command prompt. **Is only read by login shells.**\n- `/root/.bashrc` - Is executed for interactive shells. **only read by a shell that's both interactive and non-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n- `/root/.bash_profile`\n- `/root/.bashrc`\n- The system default umask\n\n## Audit\n\nRun the following to verify the root user `umask` is set to enforce a newly created directories' permissions to be `750 (drwxr-x---)`, and a newly created file's permissions be `640 (rw-r-----)`, or more restrictive:\n\n```bash\n# grep -Psi -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0-6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\\b)))' /root/.bash_profile /root/.bashrc\n```\n\nNothing should be returned."},{"uuid":"57bd0f09-6c32-56b0-8c8c-e5a7dd0ad4e8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.6_Ensure_root_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure root user umask is configured","description":"Edit `/root/.bash_profile` and `/root/.bashrc` and remove, comment out, or update any line with `umask` to be `0027` or more restrictive."}],"title":"5.4.2.6 Ensure root user umask is configured","description":"The user file-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value - Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value - Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\n**root user Shell Configuration Files:**\n\n- `/root/.bash_profile` - Is executed to configure the root users' shell before the initial command prompt. **Is only read by login shells.**\n- `/root/.bashrc` - Is executed for interactive shells. **only read by a shell that's both interactive and non-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n- `/root/.bash_profile`\n- `/root/.bashrc`\n- The system default umask"},{"uuid":"4d902eab-aaa2-5030-8779-ee6920fc04f1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.7_Ensure_system_accounts_do_not_have_a_valid_login_shell"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.7"}],"steps":[{"uuid":"bbe73bc9-021c-59b6-ba92-a1f1ac74e168","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.7_Ensure_system_accounts_do_not_have_a_valid_login_shell"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-2(5)"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure system accounts do not have a valid login shell","remarks":"It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the `nologin` shell. This prevents the account from potentially being used to run any commands.","description":"## Description\n\nThere are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell.\n\n## Audit\n\nRun the following command to verify system accounts, except for `root`, `halt`, `sync`, `shutdown` or `nfsnobody`, do not have a valid login shell:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($(awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n awk -v pat=\"$l_valid_shells\" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'\"$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\"' || $3 == 65534) && $(NF) ~ pat) {print \"Service account: \\\"\" $1 \"\\\" has a valid shell: \" $7}' /etc/passwd\n}\n```\n\nNothing should be returned"},{"uuid":"8906513d-b1f2-53d7-b48d-78b1b6bd3d56","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.7_Ensure_system_accounts_do_not_have_a_valid_login_shell"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure system accounts do not have a valid login shell","description":"Run the following command to set the shell for any service accounts returned by the audit to `nologin`:\n\n```bash\n# usermod -s $(command -v nologin)\n```\n\nExample script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n awk -v pat=\"$l_valid_shells\" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'\"$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\"' || $3 == 65534) && $(NF) ~ pat) {system (\"usermod -s '\"$(command -v nologin)\"' \" $1)}' /etc/passwd\n}\n```"}],"title":"5.4.2.7 Ensure system accounts do not have a valid login shell","description":"There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell."},{"uuid":"64b73089-4fa4-5420-8d58-365d971b6fc8","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.2 Configure root and system accounts and environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.8_Ensure_accounts_without_a_valid_login_shell_are_locked"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.2.8"}],"steps":[{"uuid":"a3b5beff-9fc8-5001-9336-d3011764b0f9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.8_Ensure_accounts_without_a_valid_login_shell_are_locked"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-2(5)"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure accounts without a valid login shell are locked","remarks":"It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the `nologin` shell. This prevents the account from potentially being used to run any commands.","description":"## Description\n\nThere are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell.\n\n## Audit\n\nRun the following script to verify all non-root accounts without a valid login shell are locked.\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($(awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n while IFS= read -r l_user; do\n passwd -S \"$l_user\" | awk '$2 !~ /^L/ {print \"Account: \\\"\" $1 \"\\\" does not have a valid login shell and is not locked\"}'\n done < <(awk -v pat=\"$l_valid_shells\" -F: '($1 != \"root\" && $(NF) !~ pat) {print $1}' /etc/passwd)\n}\n```\n\nNothing should be returned"},{"uuid":"d0a59772-5ea4-57e7-8efc-90f2859202d1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.2.8_Ensure_accounts_without_a_valid_login_shell_are_locked"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure accounts without a valid login shell are locked","description":"Run the following command to lock any non-root accounts without a valid login shell returned by the audit:\n\n```bash\n# usermod -L\n```\n\nExample script::\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($(awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n while IFS= read -r l_user; do\n passwd -S \"$l_user\" | awk '$2 !~ /^L/ {system (\"usermod -L \" $1)}'\n done < <(awk -v pat=\"$l_valid_shells\" -F: '($1 != \"root\" && $(NF) !~ pat) {print $1}' /etc/passwd)\n}\n```"}],"title":"5.4.2.8 Ensure accounts without a valid login shell are locked","description":"There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell."},{"uuid":"cb34742f-1b27-55c4-82d0-e9124295cf57","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.3 Configure user default environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.1_Ensure_nologin_is_not_listed_in_etcshells"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.3.1"}],"steps":[{"uuid":"f5985b4b-4237-50cc-86f1-ba1a1f04e022","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.1_Ensure_nologin_is_not_listed_in_etcshells"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure nologin is not listed in /etc/shells","remarks":"A user can use `chsh` to change their configured shell.\n\nIf a user has a shell configured that isn't in in `/etc/shells`, then the system assumes that they're somehow restricted. In the case of `chsh` it means that the user cannot change that value.\n\nOther programs might query that list and apply similar restrictions.\n\nBy putting `nologin` in `/etc/shells`, any user that has `nologin` as its shell is considered a full, unrestricted user. This is not the expected behavior for `nologin`.","description":"## Description\n\n`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs.\n\nBe aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.\n\n## Audit\n\nRun the following command to verify that `nologin` is not listed in the `/etc/shells` file:\n\n```bash\n# grep -Ps '^\\h*([^#\\n\\r]+)?\\/nologin\\b' /etc/shells\n```\n\nNothing should be returned"},{"uuid":"b2847ddf-a3c5-5f4f-b0c1-a8e962a02a9c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.1_Ensure_nologin_is_not_listed_in_etcshells"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure nologin is not listed in /etc/shells","description":"Edit `/etc/shells` and remove any lines that include `nologin`"}],"title":"5.4.3.1 Ensure nologin is not listed in /etc/shells","description":"`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs.\n\nBe aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file."},{"uuid":"f577403b-4288-5d3d-a65a-4d931459cf17","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.3 Configure user default environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.2_Ensure_default_user_shell_timeout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.3.2"}],"steps":[{"uuid":"fbfafeab-4a76-5036-b734-df261874f064","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.2_Ensure_default_user_shell_timeout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:11"}],"title":"Audit for Ensure default user shell timeout is configured","remarks":"Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session.","description":"## Description\n\n`TMOUT` is an environmental setting that determines the timeout of a shell in seconds.\n\n- TMOUT=n - Sets the shell timeout to n seconds. A setting of `TMOUT=0` disables timeout.\n- readonly TMOUT- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time.\n- export TMOUT - exports the TMOUT variable\n\n**System Wide Shell Configuration Files:**\n\n- `/etc/profile` - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive login shells, or shells executed with the --login parameter.**\n- `/etc/profile.d` - `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n- `/etc/bashrc` - System wide version of `.bashrc`. In Fedora derived distributions, `/etc/bashrc` also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to `/dev/null` if non-interactive. **Is only executed for interactive shells or if `BASH_ENV` is set to `/etc/bashrc`.**\n\n## Audit\n\nRun the following script to verify that `TMOUT` is configured to: include a timeout of no more than `900` seconds, to be `readonly`, to be `exported`, and is not being changed to a longer timeout.\n\n```bash\n#!/usr/bin/env bash\n\n{\n output1=\"\" output2=\"\"\n [ -f /etc/bashrc ] && BRC=\"/etc/bashrc\"\n for f in \"$BRC\" /etc/profile /etc/profile.d/*.sh ; do\n grep -Pq '^\\s*([^#]+\\s+)?TMOUT=(900|[1-8][0-9][0-9]|[1-9][0-9]|[1-9])\\b' \"$f\" && grep -Pq '^\\s*([^#]+;\\s*)?readonly\\s+TMOUT(\\s+|\\s*;|\\s*$|=(900|[1-8][0-9][0-9]|[1-9][0-9]|[1-9]))\\b' \"$f\" && grep -Pq '^\\s*([^#]+;\\s*)?export\\s+TMOUT(\\s+|\\s*;|\\s*$|=(900|[1-8][0-9][0-9]|[1-9][0-9]|[1-9]))\\b' \"$f\" && \n output1=\"$f\"\n done\n grep -Pq '^\\s*([^#]+\\s+)?TMOUT=(9[0-9][1-9]|9[1-9][0-9]|0+|[1-9]\\d{3,})\\b' /etc/profile /etc/profile.d/*.sh \"$BRC\" && output2=$(grep -Ps '^\\s*([^#]+\\s+)?TMOUT=(9[0-9][1-9]|9[1-9][0-9]|0+|[1-9]\\d{3,})\\b' /etc/profile /etc/profile.d/*.sh $BRC)\n if [ -n \"$output1\" ] && [ -z \"$output2\" ]; then\n echo -e \"\\nPASSED\\n\\nTMOUT is configured in: \\\"$output1\\\"\\n\"\n else\n [ -z \"$output1\" ] && echo -e \"\\nFAILED\\n\\nTMOUT is not configured\\n\"\n [ -n \"$output2\" ] && echo -e \"\\nFAILED\\n\\nTMOUT is incorrectly configured in: \\\"$output2\\\"\\n\"\n fi\n}\n```"},{"uuid":"0dd01e0d-4462-50b6-9788-b96a139435ef","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.2_Ensure_default_user_shell_timeout_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure default user shell timeout is configured","description":"Review `/etc/bashrc`, `/etc/profile`, and all files ending in `*.sh` in the `/etc/profile.d/` directory and remove or edit all `TMOUT=_n_` entries to follow local site policy. `TMOUT` should not exceed 900 or be equal to `0`.\n\nConfigure `TMOUT` in **one** of the following files:\n\n- A file in the `/etc/profile.d/` directory ending in `.sh`\n- `/etc/profile`\n- `/etc/bashrc`\n\n`TMOUT` configuration examples:\n\n- As multiple lines:\n\n```bash\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\n```\n\n- As a single line:\n\n```bash\nreadonly TMOUT=900 ; export TMOUT\n```"}],"title":"5.4.3.2 Ensure default user shell timeout is configured","description":"`TMOUT` is an environmental setting that determines the timeout of a shell in seconds.\n\n- TMOUT=n - Sets the shell timeout to n seconds. A setting of `TMOUT=0` disables timeout.\n- readonly TMOUT- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time.\n- export TMOUT - exports the TMOUT variable\n\n**System Wide Shell Configuration Files:**\n\n- `/etc/profile` - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive login shells, or shells executed with the --login parameter.**\n- `/etc/profile.d` - `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n- `/etc/bashrc` - System wide version of `.bashrc`. In Fedora derived distributions, `/etc/bashrc` also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to `/dev/null` if non-interactive. **Is only executed for interactive shells or if `BASH_ENV` is set to `/etc/bashrc`.**"},{"uuid":"c6879c3d-932e-51b8-afe6-253c0f8434ab","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Access Control"},{"ns":"https://cisecurity.org/ns","name":"group","value":"5 Access Control > 5.4 User Accounts and Environment > 5.4.3 Configure user default environment"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.3_Ensure_default_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"5.4.3.3"}],"steps":[{"uuid":"fe80def1-5225-547a-a8a9-8acdebbc931f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.3_Ensure_default_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure default user umask is configured","remarks":"Setting a secure default value for `umask` ensures that users make a conscious choice about their file permissions. A permissive `umask` value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users.","description":"## Description\n\nThe user file-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value - Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value - Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\nThe default `umask` can be set to use the `pam_umask` module or in a `System Wide Shell Configuration File`. The user creating the directories or files has the discretion of changing the permissions via the chmod command, or choosing a different default `umask` by adding the `umask` command into a `User Shell Configuration File`, ( `.bash_profile` or `.bashrc`), in their home directory.\n\n**Setting the default umask:**\n\n- pam_umask module:\n\nwill set the umask according to the system default in `/etc/login.defs` and user settings, solving the problem of different `umask` settings with different shells, display managers, remote sessions etc.\n- `umask=` value in the `/etc/login.defs` file is interpreted as Octal\n- Setting `USERGROUPS_ENAB` to yes in `/etc/login.defs` (default):\n\nwill enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 -> 002, 077 -> 007) for non-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n- userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n\n- `System Wide Shell Configuration File`:\n\n`/etc/profile` - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive login shells, or shells executed with the --login parameter.**\n- `/etc/profile.d` - `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n- `/etc/bashrc` - System wide version of `.bashrc`. In Fedora derived distributions, `etc/bashrc` also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to `/dev/null` if non-interactive. **Is only executed for interactive shells or if `BASH_ENV` is set to `/etc/bashrc`.**\n\n**User Shell Configuration Files:**\n\n- `~/.bash_profile` - Is executed to configure your shell before the initial command prompt. **Is only read by login shells.**\n- `~/.bashrc` - Is executed for interactive shells. **only read by a shell that's both interactive and non-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n- A file in `/etc/profile.d/` ending in `.sh` - This will override any other system-wide `umask` setting\n- In the file `/etc/profile`\n- On the `pam_umask.so` module in `/etc/pam.d/postlogin`\n- In the file `/etc/login.defs`\n- In the file `/etc/default/login`\n\n## Audit\n\nRun the following to verify the default user `umask` is set to `027`(octal) or `u=rwx,g=rx,o=` (Symbolic) to enforce newly created directories' permissions to be `750 (drwxr-x---)`, and newly created file's permissions be `640 (rw-r-----)`, or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{ \n l_output=\"\" l_output2=\"\"\n file_umask_chk()\n {\n if grep -Psiq -- '^\\h*umask\\h+(0?[0-7][2-7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\\h*#.*)?$' \"$l_file\"; then\n l_output=\"$l_output\\n - umask is set correctly in \\\"$l_file\\\"\"\n elif grep -Psiq -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0-6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\\b)))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - umask is incorrectly set in \\\"$l_file\\\"\"\n fi\n }\n while IFS= read -r -d $'\\0' l_file; do\n file_umask_chk\n done < <(find /etc/profile.d/ -type f -name '*.sh' -print0)\n [ -z \"$l_output\" ] && l_file=\"/etc/profile\" && file_umask_chk\n [ -z \"$l_output\" ] && l_file=\"/etc/bashrc\" && file_umask_chk\n [ -z \"$l_output\" ] && l_file=\"/etc/bash.bashrc\" && file_umask_chk\n [ -z \"$l_output\" ] && l_file=\"/etc/pam.d/postlogin\"\n if [ -z \"$l_output\" ]; then\n if grep -Psiq -- '^\\h*session\\h+[^#\\n\\r]+\\h+pam_umask\\.so\\h+([^#\\n\\r]+\\h+)?umask=(0?[0-7][2-7]7)\\b' \"$l_file\"; then\n l_output1=\"$l_output1\\n - umask is set correctly in \\\"$l_file\\\"\"\n elif grep -Psiq '^\\h*session\\h+[^#\\n\\r]+\\h+pam_umask\\.so\\h+([^#\\n\\r]+\\h+)?umask=(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - umask is incorrectly set in \\\"$l_file\\\"\"\n fi\n fi\n [ -z \"$l_output\" ] && l_file=\"/etc/login.defs\" && file_umask_chk\n [ -z \"$l_output\" ] && l_file=\"/etc/default/login\" && file_umask_chk\n [[ -z \"$l_output\" && -z \"$l_output2\" ]] && l_output2=\"$l_output2\\n - umask is not set\"\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\"\n [ -n \"$l_output\" ] && echo -e \"\\n- * Correctly configured * :\\n$l_output\\n\"\n fi\n}\n```"},{"uuid":"6b7711ff-e3d4-518a-bbea-eb73d0fbdd88","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_5.4.3.3_Ensure_default_user_umask_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure default user umask is configured","description":"Run the following script and perform the instructions in the output to set the default umask to `027` or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_out=\"\"\n file_umask_chk()\n {\n if grep -Psiq -- '^\\h*umask\\h+(0?[0-7][2-7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\\h*#.*)?$' \"$l_file\"; then\n l_out=\"$l_out\\n - umask is set correctly in \\\"$l_file\\\"\"\n elif grep -Psiq -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0-6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\\b)))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - \\\"$l_file\\\"\"\n fi\n }\n while IFS= read -r -d $'\\0' l_file; do\n file_umask_chk\n done /etc/profile.d/50-systemwide_umask.sh\\n\"\n fi\n}\n```\n\n**Notes:**\n\n- This method only applies to bash and shell. If other shells are supported on the system, it is recommended that their configuration files also are checked\n- If the `pam_umask.so` module is going to be used to set `umask`, ensure that it's not being overridden by another setting. Refer to the PAM_UMASK(8) man page for more information"}],"title":"5.4.3.3 Ensure default user umask is configured","description":"The user file-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value - Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value - Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\nThe default `umask` can be set to use the `pam_umask` module or in a `System Wide Shell Configuration File`. The user creating the directories or files has the discretion of changing the permissions via the chmod command, or choosing a different default `umask` by adding the `umask` command into a `User Shell Configuration File`, ( `.bash_profile` or `.bashrc`), in their home directory.\n\n**Setting the default umask:**\n\n- pam_umask module:\n\nwill set the umask according to the system default in `/etc/login.defs` and user settings, solving the problem of different `umask` settings with different shells, display managers, remote sessions etc.\n- `umask=` value in the `/etc/login.defs` file is interpreted as Octal\n- Setting `USERGROUPS_ENAB` to yes in `/etc/login.defs` (default):\n\nwill enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 -> 002, 077 -> 007) for non-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n- userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n\n- `System Wide Shell Configuration File`:\n\n`/etc/profile` - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive login shells, or shells executed with the --login parameter.**\n- `/etc/profile.d` - `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n- `/etc/bashrc` - System wide version of `.bashrc`. In Fedora derived distributions, `etc/bashrc` also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to `/dev/null` if non-interactive. **Is only executed for interactive shells or if `BASH_ENV` is set to `/etc/bashrc`.**\n\n**User Shell Configuration Files:**\n\n- `~/.bash_profile` - Is executed to configure your shell before the initial command prompt. **Is only read by login shells.**\n- `~/.bashrc` - Is executed for interactive shells. **only read by a shell that's both interactive and non-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n- A file in `/etc/profile.d/` ending in `.sh` - This will override any other system-wide `umask` setting\n- In the file `/etc/profile`\n- On the `pam_umask.so` module in `/etc/pam.d/postlogin`\n- In the file `/etc/login.defs`\n- In the file `/etc/default/login`"},{"uuid":"d95a7d7d-bcd5-54e9-a691-3e630ef06852","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.1 Configure systemd-journald service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.1_Ensure_journald_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.1.1"}],"steps":[{"uuid":"2eed8e18-ccaa-50b5-b4b7-1bae4fa849ce","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.1_Ensure_journald_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure journald service is enabled and active","remarks":"If the `systemd-journald` service is not enabled to start on boot, the system will not capture logging events.","description":"## Description\n\nEnsure that the `systemd-journald` service is enabled to allow capturing of logging events.\n\n## Audit\n\nRun the following command to verify `systemd-journald` is enabled:\n\n```bash\n# systemctl is-enabled systemd-journald.service\n\nstatic\n```\n\n**Note:** By default the `systemd-journald` service does not have an `[Install]` section and thus cannot be enabled / disabled. It is meant to be referenced as `Requires` or `Wants` by other unit files. As such, if the status of `systemd-journald` is not `static`, investigate why\n\nRun the following command to verify `systemd-journald` is active:\n\n```bash\n# systemctl is-active systemd-journald.service\n\nactive\n```"},{"uuid":"71171a98-0d20-539c-b559-3d75607b11af","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.1_Ensure_journald_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald service is enabled and active","description":"Run the following commands to unmask and start `systemd-journald.service`\n\n```bash\n# systemctl unmask systemd-journald.service\n# systemctl start systemd-journald.service\n```"}],"title":"6.1.1.1 Ensure journald service is enabled and active","description":"Ensure that the `systemd-journald` service is enabled to allow capturing of logging events."},{"uuid":"14c39c0e-2b90-52ec-b429-56c9c23c55ee","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.1 Configure systemd-journald service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.2_Ensure_journald_log_file_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.1.2"}],"steps":[{"uuid":"35faa828-22ed-5e39-93c3-fba908ef68a3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.2_Ensure_journald_log_file_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure journald log file access is configured","remarks":"It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.","description":"## Description\n\nJournald will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.\n\n## Audit\n\nRun the following script to verify:\n\n- systemd-journald logfiles are mode `0640` or more restrictive\n- Directories /run/ and /var/lib/systemd/ are mode `0755` or more restrictive\n- All other configured directories are mode `2755`, `0750`, or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=()\n l_systemd_config_file=\"/etc/tmpfiles.d/systemd.conf\" l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\"\n f_file_chk()\n {\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n if [ $(( $l_mode & $l_perm_mask )) -le 0 ] || [[ \"$l_type\" = \"Directory\" && \"$l_mode\" =~ 275(0|5) ]]; then\n a_out+=(\" - $l_type \\\"$l_logfile\\\" access is:\" \\\n \" mode: \\\"$l_mode\\\", owned by: \\\"$l_user\\\", and group owned by: \\\"$l_group\\\"\")\n else\n a_out2+=(\" - $l_type \\\"$l_logfile\\\" access is:\" \\\n \" mode: \\\"$l_mode\\\", owned by: \\\"$l_user\\\", and group owned by: \\\"$l_group\\\"\" \\\n \" should be mode: \\\"$l_maxperm\\\" or more restrictive\")\n fi\n }\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\" a_out=() a_out2=()\n l_logfile_perms_line=\"$(awk '($1~/^(f|d)$/ && $2~/\\/\\S+/ && $3~/[0-9]{3,}/){print $2 \":\" $3 \":\" $4 \":\" $5}' \"$l_file\")\"\n while IFS=: read -r l_logfile l_mode l_user l_group; do\n if [ -d \"$l_logfile\" ]; then\n l_perm_mask=\"0027\" l_type=\"Directory\"\n grep -Psq '^(\\/run|\\/var\\/lib\\/systemd)\\b' <<< \"$l_logfile\" && l_perm_mask=\"0022\"\n else\n l_perm_mask=\"0137\" l_type=\"File\"\n fi\n grep -Psq '^(\\/run|\\/var\\/lib\\/systemd)\\b' <<< \"$l_logfile\" && l_perm_mask=\"0022\"\n f_file_chk\n done <<< \"$l_logfile_perms_line\"\n [ \"${#a_out[@]}\" -gt \"0\" ] && a_output+=(\" - File: \\\"$l_file\\\" sets:\" \"${a_out[@]}\")\n [ \"${#a_out2[@]}\" -gt \"0\" ] && a_output2+=(\" - File: \\\"$l_file\\\" sets:\" \"${a_out2[@]}\")\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** REVIEW **\" \\\n \" - Review file access to ensure they are set IAW site policy:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi \n}\n```\n\nReview the output"},{"uuid":"af2b76be-35c6-5bd3-9f09-84cff8064cc1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.2_Ensure_journald_log_file_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald log file access is configured","description":"If the default configuration is not appropriate for the site specific requirements, copy `/usr/lib/tmpfiles.d/systemd.conf` to `/etc/tmpfiles.d/systemd.conf` and modify as required. Recommended mode for logfiles is `0640` or more restrictive."}],"title":"6.1.1.2 Ensure journald log file access is configured","description":"Journald will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files."},{"uuid":"53801d05-4592-59f8-b409-9871439b959d","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.1 Configure systemd-journald service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.3_Ensure_journald_log_file_rotation_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.1.3"}],"steps":[{"uuid":"a0c72e52-d61e-5ccd-9e74-28146e1bd04d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.3_Ensure_journald_log_file_rotation_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure journald log file rotation is configured","remarks":"By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.","description":"## Description\n\nJournald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/systemd/journald.conf` is the configuration file used to specify how logs generated by Journald should be rotated.\n\n## Audit\n\nReview the `systemd-journald` configuration. Verify logs are rotated according to site policy. The specific parameters for log rotation are:\n\nRun the following script and review the output to ensure logs are rotated according to site policy:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journald.conf\"\n a_parameters=(\"SystemMaxUse=^.+$\" \"SystemKeepFree=^.+$\" \"RuntimeMaxUse=^.+$\" \"RuntimeKeepFree=^.+$\" \"MaxFileSec=^.+$\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: ***\" \" \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"2a8aea41-e6a6-5c2c-bfe0-ce80be4e9599","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.3_Ensure_journald_log_file_rotation_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald log file rotation is configured","description":"Edit `/etc/systemd/journald.conf` or a file ending in `.conf` the `/etc/systemd/journald.conf.d/` directory. Set the following parameters in the `[Journal]` section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters.\n\nExample Configuration:\n\n```bash\n[Journal]\nSystemMaxUse=1G\nSystemKeepFree=500M\nRuntimeMaxUse=200M\nRuntimeKeepFree=50M\nMaxFileSec=1month\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n{\n a_settings=(\"SystemMaxUse=1G\" \"SystemKeepFree=500M\" \"RuntimeMaxUse=200M\" \"RuntimeKeepFree=50M\" \"MaxFileSec=1month\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n**Note:**\n\n- If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten\n- Logfile size and configuration to move logfiles to a remote log server should be accounted for when configuring these settings\n\nRun to following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journald\n```"}],"title":"6.1.1.3 Ensure journald log file rotation is configured","description":"Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/systemd/journald.conf` is the configuration file used to specify how logs generated by Journald should be rotated."},{"uuid":"4b03b64e-6eff-5842-80d0-da1a3776c199","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.1 Configure systemd-journald service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.4_Ensure_only_one_logging_system_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.1.4"}],"steps":[{"uuid":"44d5fd7a-1ef0-569e-a326-8e7729916db9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.4_Ensure_only_one_logging_system_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"}],"title":"Audit for Ensure only one logging system is in use","remarks":"Configuring only one logging service either `rsyslog` **- OR -** `journald` avoids redundancy, optimizes resources, simplifies configuration and management, and ensures consistency.","description":"## Description\n\nBest practices recommend that a single centralized logging system be used for log management, choose a single service either `rsyslog` **- OR -** `journald` to be used as a single centralized logging system.\n\n## Audit\n\nRun the following script to ensure only one logging system is in use:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" # Check the status of rsyslog and journald\n if systemctl is-active --quiet rsyslog; then\n l_output=\"$l_output\\n - rsyslog is in use\\n- follow the recommendations in Configure rsyslog subsection only\"\n elif systemctl is-active --quiet systemd-journald; then\n l_output=\"$l_output\\n - journald is in use\\n- follow the recommendations in Configure journald subsection only\"\n else\n echo -e “unable to determine system logging”\n l_output2=\"$l_output2\\n - unable to determine system logging\\n- Configure only ONE system logging: rsyslog OR journald\"\n fi\n if [ -z \"$l_output2\" ]; then # Provide audit results\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - Reason(s) for audit failure:\\n$l_output2\"\n fi\n}\n```"},{"uuid":"662ec8e7-af37-587c-ab95-76ccca13c975","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.1.4_Ensure_only_one_logging_system_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure only one logging system is in use","description":"- Determine whether to use `journald` **- OR -** `rsyslog` depending on site needs\n- Configure `systemd-jounald.service`\n- Configure only **ONE** either `journald` **- OR -** `rsyslog` and complete the recommendations in that subsection\n- Return to this recommendation to ensure only one logging system is in use\n\nImpact:\n\nTransitioning from one logging service to another can be complex and time consuming, it involves reconfiguration and may result in data loss if not managed and reconfigured correctly."}],"title":"6.1.1.4 Ensure only one logging system is in use","description":"Best practices recommend that a single centralized logging system be used for log management, choose a single service either `rsyslog` **- OR -** `journald` to be used as a single centralized logging system."},{"uuid":"f18c6236-90c1-5fc8-abb2-2b36926d07fd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald > 6.1.2.1 Configure systemd-journal-remote"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.1_Ensure_systemd-journal-remote_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.1.1"}],"steps":[{"uuid":"f2727665-313b-5d0b-98e5-69683e1ee43a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.1_Ensure_systemd-journal-remote_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure systemd-journal-remote is installed","remarks":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nJournald `systemd-journal-remote` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management.\n\n## Audit\n\n**- IF -** `journald` will be used for logging on the system:\n\nRun the following command to verify `systemd-journal-remote` is installed.\n\n```bash\n# dpkg-query -s systemd-journal-remote &>/dev/null && echo \"systemd-journal-remote is installed\"\n```\n\nVerify the output matches:\n\n```bash\nsystemd-journal-remote is installed\n```"},{"uuid":"687a8510-6809-57e8-8b6f-e3ede4dafc0e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.1_Ensure_systemd-journal-remote_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-journal-remote is installed","description":"Run the following command to install `systemd-journal-remote`:\n\n```bash\n# apt install systemd-journal-remote\n```"}],"title":"6.1.2.1.1 Ensure systemd-journal-remote is installed","description":"Journald `systemd-journal-remote` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."},{"uuid":"4eaf9a6f-7880-5ba2-ba46-8ec866e03d67","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald > 6.1.2.1 Configure systemd-journal-remote"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.2_Ensure_systemd-journal-upload_authentication_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.1.2"}],"steps":[{"uuid":"d13a9861-fd2b-5bc3-945a-f3858b82c1d2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.2_Ensure_systemd-journal-upload_authentication_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure systemd-journal-upload authentication is configured","remarks":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nJournald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host.\n\n## Audit\n\nRun the following script to verify `systemd-journal-upload` authentication is configured:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journal-upload.conf\"\n a_parameters=(\"URL=^.+$\" \"ServerKeyFile=^.+$\" \"ServerCertificateFile=^.+$\" \"TrustedCertificateFile=^.+$\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: ***\" \" \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\nReview the output to ensure it matches your environments' certificate locations and the URL of the log server:\n\nExample output:\n\n```bash\n- Audit Result:\n ** PASS **\n - Parameter: \"URL\"\n set to: \"192.168.50.42\"\n in the file: \"/etc/systemd/journal-upload.conf.d/60-journald_upload.conf\"\n - Parameter: \"ServerKeyFile\"\n set to: \"/etc/ssl/private/journal-upload.pem\"\n in the file: \"/etc/systemd/journal-upload.conf.d/60-journald_upload.conf\"\n - Parameter: \"ServerCertificateFile\"\n set to: \"/etc/ssl/certs/journal-upload.pem\"\n in the file: \"/etc/systemd/journal-upload.conf.d/60-journald_upload.conf\"\n - Parameter: \"TrustedCertificateFile\"\n set to: \"/etc/ssl/ca/trusted.pem\"\n in the file: \"/etc/systemd/journal-upload.conf.d/60-journald_upload.conf\"\n```"},{"uuid":"01db3814-e045-594e-962f-0e435dc237ae","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.2_Ensure_systemd-journal-upload_authentication_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-journal-upload authentication is configured","description":"Edit the `/etc/systemd/journal-upload.conf` file or a file in `/etc/systemd/journal-upload.conf.d` ending in `.conf` and ensure the following lines are set in the `[Upload]` section per your environment:\n\nExample settings:\n\n```bash\n[Upload]\nURL=192.168.50.42\nServerKeyFile=/etc/ssl/private/journal-upload.pem\nServerCertificateFile=/etc/ssl/certs/journal-upload.pem\nTrustedCertificateFile=/etc/ssl/ca/trusted.pem\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"URL=192.168.50.42\" \"ServerKeyFile=/etc/ssl/private/journal-upload.pem\" \\\n \"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem\" \"TrustedCertificateFile=/etc/ssl/ca/trusted.pem\")\n [ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/\n if grep -Psq -- '^\\h*\\[Upload\\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n fi\n}\n```\n\nRun the following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journal-upload\n```"}],"title":"6.1.2.1.2 Ensure systemd-journal-upload authentication is configured","description":"Journald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host."},{"uuid":"ab1a0335-5402-56c1-aff5-a579d6d15c1e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald > 6.1.2.1 Configure systemd-journal-remote"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.3_Ensure_systemd-journal-upload_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.1.3"}],"steps":[{"uuid":"412aba71-7048-5bdb-81c2-8ff6e9b49860","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.3_Ensure_systemd-journal-upload_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure systemd-journal-upload is enabled and active","remarks":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nJournald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host.\n\n## Audit\n\nRun the following command to verify `systemd-journal-upload` is enabled.\n\n```bash\n# systemctl is-enabled systemd-journal-upload.service\n\nenabled\n```\n\nRun the following command to verify `systemd-journal-upload` is active:\n\n```bash\n# systemctl is-active systemd-journal-upload.service\n\nactive\n```"},{"uuid":"fdd7cb5b-d264-5e87-a9ff-203f8406d8f3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.3_Ensure_systemd-journal-upload_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-journal-upload is enabled and active","description":"Run the following commands to unmask, enable and start `systemd-journal-upload`:\n\n```bash\n# systemctl unmask systemd-journal-upload.service\n# systemctl --now enable systemd-journal-upload.service\n```"}],"title":"6.1.2.1.3 Ensure systemd-journal-upload is enabled and active","description":"Journald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host."},{"uuid":"0546fff2-b6f2-5d60-a9bd-0744e8c790bf","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald > 6.1.2.1 Configure systemd-journal-remote"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.4_Ensure_systemd-journal-remote_service_is_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.1.4"}],"steps":[{"uuid":"5faf8e5a-27e2-5a37-8aba-26732a60d801","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.4_Ensure_systemd-journal-remote_service_is_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure systemd-journal-remote service is not in use","remarks":"If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nJournald `systemd-journal-remote` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts.\n\n**Note:**\n\n- The same package, `systemd-journal-remote`, is used for both sending logs to remote hosts and receiving incoming logs.\n- With regards to receiving logs, there are two services; `systemd-journal-remote.socket` and `systemd-journal-remote.service`.\n\n## Audit\n\nRun the following command to verify `systemd-journal-remote.socket` and `systemd-journal-remote.service` are not enabled:\n\n```bash\n# systemctl is-enabled systemd-journal-remote.socket systemd-journal-remote.service | grep -P -- '^enabled'\n```\n\nNothing should be returned\n\nRun the following command to verify `systemd-journal-remote.socket` and `systemd-journal-remote.service` are not active:\n\n```bash\n# systemctl is-active systemd-journal-remote.socket systemd-journal-remote.service | grep -P -- '^active'\n```\n\nNothing should be returned"},{"uuid":"c17406a1-08d0-5a78-9c82-4bd2e409ad24","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.4_Ensure_systemd-journal-remote_service_is_not_in_use"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure systemd-journal-remote service is not in use","description":"Run the following commands to stop and mask `systemd-journal-remote.socket` and systemd-journal-remote.service:\n\n```bash\n# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service\n# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service\n```"}],"title":"6.1.2.1.4 Ensure systemd-journal-remote service is not in use","description":"Journald `systemd-journal-remote` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts.\n\n**Note:**\n\n- The same package, `systemd-journal-remote`, is used for both sending logs to remote hosts and receiving incoming logs.\n- With regards to receiving logs, there are two services; `systemd-journal-remote.socket` and `systemd-journal-remote.service`."},{"uuid":"01956a85-a953-51dc-873d-b90c1365a97a","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.2_Ensure_journald_ForwardToSyslog_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.2"}],"steps":[{"uuid":"c9570f90-4cc9-57be-8857-da425441fe61","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.2_Ensure_journald_ForwardToSyslog_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure journald ForwardToSyslog is disabled","remarks":"**- IF -** `journald` is the method for capturing logs, all logs of the system should be handled by `journald` and not forwarded to other logging mechanisms.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nData from `journald` should be kept in the confines of the service and not forwarded to other services.\n\n## Audit\n\n**- IF -** `journald` is the method for capturing logs\n\nRun the following script to verify `ForwardToSyslog` is set to `no`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journald.conf\"\n a_parameters=(\"ForwardToSyslog=no\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" correctly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n else\n a_output2+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" incorrectly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\" \\\n \" Should be set to: \\\"$l_value_out\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"3f8161f5-8185-5021-a715-85230a929c95","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.2_Ensure_journald_ForwardToSyslog_is_disabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald ForwardToSyslog is disabled","description":"**- IF -** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed.\n\n**- IF -** `journald` is the preferred method for capturing logs:\n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`:\n\n```bash\nForwardToSyslog=no\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=no\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\nRun to following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journald\n```"}],"title":"6.1.2.2 Ensure journald ForwardToSyslog is disabled","description":"Data from `journald` should be kept in the confines of the service and not forwarded to other services."},{"uuid":"7db33784-4a14-5102-97f0-db394cf6ad91","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.3_Ensure_journald_Compress_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.3"}],"steps":[{"uuid":"84987401-9374-5022-94b2-b1e5f5a434ae","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.3_Ensure_journald_Compress_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-4"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure journald Compress is configured","remarks":"Uncompressed large files may unexpectedly fill a filesystem leading to resource unavailability. Compressing logs prior to write can prevent sudden, unexpected filesystem impacts.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nThe journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large.\n\n## Audit\n\n**- IF -** `journald` is the method for capturing logs\n\nRun the following script to verify `Compress` is set to `yes`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journald.conf\"\n a_parameters=(\"Compress=yes\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" correctly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n else\n a_output2+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" incorrectly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\" \\\n \" Should be set to: \\\"$l_value_out\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"d21fa527-7f0d-5209-9a20-b796962e4775","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.3_Ensure_journald_Compress_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald Compress is configured","description":"**- IF -** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed.\n\n**- IF -** `journald` is the preferred method for capturing logs:\n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`:\n\n```bash\nCompress=yes\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Compress=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\nRun to following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journald\n```"}],"title":"6.1.2.3 Ensure journald Compress is configured","description":"The journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large."},{"uuid":"f33ef7ed-963e-5538-b93c-a10c8e537038","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.2 Configure journald"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.4_Ensure_journald_Storage_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.2.4"}],"steps":[{"uuid":"d4a000fa-8747-5b14-aae3-1635e3c4f5fc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.4_Ensure_journald_Storage_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure journald Storage is configured","remarks":"Writing log data to disk will provide the ability to forensically reconstruct events which may have impacted the operations or security of a system even after a system crash or reboot.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used.","description":"## Description\n\nData from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss due to a reboot.\n\n## Audit\n\n**- IF -** `journald` is the method for capturing logs\n\nRun the following script to verify `Storage` is set to `persistent`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journald.conf\"\n a_parameters=(\"Storage=persistent\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" correctly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n else\n a_output2+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" incorrectly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\" \\\n \" Should be set to: \\\"$l_value_out\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"3abd4852-e4ce-5dd9-9ddb-c8af08b4bded","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.2.4_Ensure_journald_Storage_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald Storage is configured","description":"**- IF -** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed.\n\n**- IF -** `journald` is the preferred method for capturing logs:\n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`:\n\n```bash\nStorage=persistent\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Storage=persistent\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\nRun to following command to update the parameters in the service:\n\n```bash\n# systemctl reload-or-restart systemd-journald\n```"}],"title":"6.1.2.4 Ensure journald Storage is configured","description":"Data from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss due to a reboot."},{"uuid":"682ea6e8-6cdd-5731-bfd6-a4ce4fec2812","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.1_Ensure_rsyslog_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.1"}],"steps":[{"uuid":"a4e8a654-69fd-5011-b3b0-15037b373f3c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.1_Ensure_rsyslog_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure rsyslog is installed","remarks":"The security enhancements of `rsyslog` such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server) justify installing and configuring the package.","description":"## Description\n\nThe `rsyslog` software is recommended in environments where `journald` does not meet operation requirements.\n\n## Audit\n\n**- IF -** `rsyslog` is being used for logging on the system:\n\nRun the following command to verify `rsyslog` is installed:\n\n```bash\n# dpkg-query -s rsyslog &>/dev/null && echo \"rsyslog is installed\"\n```\n\nVerify the output matches:\n\n```bash\nrsyslog is installed\n```"},{"uuid":"40905bd4-f8e6-5fbf-b2bb-fa01e4e31245","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.1_Ensure_rsyslog_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog is installed","description":"Run the following command to install `rsyslog`:\n\n```bash\n# apt install rsyslog\n```"}],"title":"6.1.3.1 Ensure rsyslog is installed","description":"The `rsyslog` software is recommended in environments where `journald` does not meet operation requirements."},{"uuid":"0f5b1c26-8867-5d45-9c5b-f065e011286d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.2_Ensure_rsyslog_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.2"}],"steps":[{"uuid":"50b6c6fd-5ee8-5752-82d3-4d48ddc12396","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.2_Ensure_rsyslog_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure rsyslog service is enabled and active","remarks":"If the `rsyslog` service is not enabled to start on boot, the system will not capture logging events.","description":"## Description\n\nOnce the `rsyslog` package is installed, ensure that the service is enabled.\n\n## Audit\n\n**- IF -** `rsyslog` is being used for logging on the system:\n\nRun the following command to verify `rsyslog.service` is enabled:\n\n```bash\n# systemctl is-enabled rsyslog\n\nenabled\n```\n\nRun the following command to verify `rsyslog.service` is active:\n\n```bash\n# systemctl is-active rsyslog.service\n\nactive\n```"},{"uuid":"28ca0449-361e-5d92-9c9c-6e1d23cf1308","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.2_Ensure_rsyslog_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog service is enabled and active","description":"**- IF -** `rsyslog` is being used for logging on the system:\n\nRun the following commands to unmask, enable, and start `rsyslog.service`:\n\n```bash\n# systemctl unmask rsyslog.service\n# systemctl enable rsyslog.service\n# systemctl start rsyslog.service\n```"}],"title":"6.1.3.2 Ensure rsyslog service is enabled and active","description":"Once the `rsyslog` package is installed, ensure that the service is enabled."},{"uuid":"a16bcca8-debe-5783-b9dd-d9d37fda0122","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.3_Ensure_journald_is_configured_to_send_logs_to_rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.3"}],"steps":[{"uuid":"7e589827-1375-5092-80c0-d8b82d76b11b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.3_Ensure_journald_is_configured_to_send_logs_to_rsyslog"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-4"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:9"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:5"}],"title":"Audit for Ensure journald is configured to send logs to rsyslog","remarks":"**- IF -** `rsyslog` is the preferred method for capturing logs, all logs of the system should be sent to it for further processing.\n\n**Note:** This recommendation **only applies if `rsyslog` is the chosen method for client side logging**. Do not apply this recommendation if `systemd-journald` is used.","description":"## Description\n\nData from `systemd-journald` may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of `systemd-journald` logs, however, use of the `rsyslog` service provides a consistent means of log collection and export.\n\n## Audit\n\n**- IF -** `rsyslog` is the preferred method for capturing logs\n\nRun the following script to verify that logs are forwarded to `rsyslog` by setting `ForwardToSyslog` to `yes` in the systemd-journald configuration:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_systemd_config_file=\"systemd/journald.conf\"\n a_parameters=(\"ForwardToSyslog=yes\")\n f_config_file_parameter_chk()\n {\n l_used_parameter_setting=\"\"\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"$l_systemd_config_file\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n if [ -n \"$l_used_parameter_setting\" ]; then\n while IFS=: read -r l_file_name l_file_parameter; do\n while IFS=\"=\" read -r l_file_parameter_name l_file_parameter_value; do\n if grep -Pq -- \"$l_parameter_value\" <<< \"$l_file_parameter_value\"; then\n a_output+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" correctly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\")\n else\n a_output2+=(\" - Parameter: \\\"${l_file_parameter_name// /}\\\"\" \\\n \" incorrectly set to: \\\"${l_file_parameter_value// /}\\\"\" \\\n \" in the file: \\\"$l_file_name\\\"\" \\\n \" Should be set to: \\\"$l_value_out\\\"\")\n fi\n done <<< \"$l_file_parameter\"\n done <<< \"$l_used_parameter_setting\"\n else\n a_output2+=(\" - Parameter: \\\"$l_parameter_name\\\" is not set in an included file\" \\\n \" *** Note: \\\"$l_parameter_name\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n }\n for l_input_parameter in \"${a_parameters[@]}\"; do\n while IFS=\"=\" read -r l_parameter_name l_parameter_value; do # Assess and check parameters\n l_parameter_name=\"${l_parameter_name// /}\"; l_parameter_value=\"${l_parameter_value// /}\"\n l_value_out=\"${l_parameter_value//-/ through }\"; l_value_out=\"${l_value_out//|/ or }\"\n l_value_out=\"$(tr -d '(){}' <<< \"$l_value_out\")\"\n f_config_file_parameter_chk\n done <<< \"$l_input_parameter\"\n done\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\nRun the following command to verify `systemd-journald.service` and `rsyslog.service` are loaded and active:\n\n```bash\n# systemctl list-units --type service | grep -P -- '(journald|rsyslog)'\n```\n\nOutput should be similar to:\n\n```bash\nrsyslog.service loaded active running System Logging Service\nsystemd-journald.service loaded active running Journal Service\n```"},{"uuid":"0208c3dd-6388-5655-bf65-df2becd413fe","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.3_Ensure_journald_is_configured_to_send_logs_to_rsyslog"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure journald is configured to send logs to rsyslog","description":"**- IF -** `Journald` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure Journald\" section followed.\n\n**- IF -** `rsyslog` is the preferred method for capturing logs:\n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`:\n\n```bash\nForwardToSyslog=yes\n```\n\nExample script to create systemd drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\nRun to following command to update the parameters in the service:\n\nRestart `systemd-journald.service`:\n\n```bash\n# systemctl reload-or-restart systemd-journald.service\n```"}],"title":"6.1.3.3 Ensure journald is configured to send logs to rsyslog","description":"Data from `systemd-journald` may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of `systemd-journald` logs, however, use of the `rsyslog` service provides a consistent means of log collection and export."},{"uuid":"5df94309-dd33-5f43-9451-4a9315170941","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.4_Ensure_rsyslog_log_file_creation_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.4"}],"steps":[{"uuid":"c71e6585-2b65-56f8-af80-9cee4c767949","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.4_Ensure_rsyslog_log_file_creation_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/1"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:1"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure rsyslog log file creation mode is configured","remarks":"It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.","description":"## Description\n\n`rsyslog` will create logfiles that do not already exist on the system.\n\nThe `global()` configuration object `umask`, available in rsyslog 8.26.0+, sets the rsyslogd process’ umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero.\n\nThe legacy `$umask` parameter sets the `rsyslogd` process' umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero.\n\nThe legacy `$FileCreateMode` parameter allows the setting of the mode with which `rsyslogd` creates new files. If not specified, the value `0644` is used. The value given must always be a 4-digit octal number, with the initial digit being zero. Please note that the actual permission depend on `rsyslogd` process `umask`. If in doubt, use `$umask 0000` right at the beginning of the configuration file to remove any restrictions.\n\nThe legacy `$FileCreateMode` may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next `$FileCreateMode` parameter. Order of lines is vitally important.\n\n## Audit\n\nRun the following command\n\nRun the following script to verify `$FileCreateMode` to set to mode `0640` or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\"\n l_include='\\$IncludeConfig' a_config_files=(\"rsyslog.conf\") l_parameter_name='\\$FileCreateMode'\n f_parameter_chk()\n {\n l_perm_mask=\"0137\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n l_mode=\"$(awk '{print $2}' /dev/null)\n while IFS= read -r l_file; do\n l_file=\"$(tr -d '# ' <<< \"$l_file\")\"\n l_used_parameter_setting=\"$(grep -PHs -- '^\\h*'\"$l_parameter_name\"'\\b' \"$l_file\" | tail -n 1)\"\n [ -n \"$l_used_parameter_setting\" ] && break\n done < <($l_analyze_cmd cat-config \"${a_config_files[@]}\" | tac | grep -Pio '^\\h*#\\h*\\/[^#\\n\\r\\h]+\\.conf\\b')\n\n if [ -n \"$l_used_parameter_setting\" ]; then\n f_parameter_chk\n else\n a_output2+=(\" - Parameter: \\\"${l_parameter_name//\\\\/}\\\" is not set in a configuration file\" \\\n \" *** Note: \\\"${l_parameter_name//\\\\/}\\\" May be set in a file that's ignored by load procedure ***\")\n fi\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```"},{"uuid":"558041a1-402a-5f80-ab09-9def11bce266","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.4_Ensure_rsyslog_log_file_creation_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog log file creation mode is configured","description":"Edit either `/etc/rsyslog.conf` or a dedicated `.conf` file in `/etc/rsyslog.d/` and set `$FileCreateMode` to `0640` or more restrictive:\n\n```bash\n$FileCreateMode 0640\n```\n\nExample script to create a drop-in configuration file in the default include location:\n\n```bash\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslog.d/\n printf '%s\\n' \"\" \"\\$FileCreateMode 0640\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```\n\nReload the service:\n\n```bash\n# systemctl reload-or-restart rsyslog\n```"}],"title":"6.1.3.4 Ensure rsyslog log file creation mode is configured","description":"`rsyslog` will create logfiles that do not already exist on the system.\n\nThe `global()` configuration object `umask`, available in rsyslog 8.26.0+, sets the rsyslogd process’ umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero.\n\nThe legacy `$umask` parameter sets the `rsyslogd` process' umask. If not specified, the system-provided default is used. The value given must always be a 4-digit octal number, with the initial digit being zero.\n\nThe legacy `$FileCreateMode` parameter allows the setting of the mode with which `rsyslogd` creates new files. If not specified, the value `0644` is used. The value given must always be a 4-digit octal number, with the initial digit being zero. Please note that the actual permission depend on `rsyslogd` process `umask`. If in doubt, use `$umask 0000` right at the beginning of the configuration file to remove any restrictions.\n\nThe legacy `$FileCreateMode` may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next `$FileCreateMode` parameter. Order of lines is vitally important."},{"uuid":"b4bbdb56-6984-5850-accc-ae0b68bef66e","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.5_Ensure_rsyslog_logging_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.5"}],"steps":[{"uuid":"6cc3cbc5-2376-5289-bac0-a8e5f0911554","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.5_Ensure_rsyslog_logging_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure rsyslog logging is configured","remarks":"A great deal of important security-related information is sent via `rsyslog` (e.g., successful and failed su attempts, failed login attempts, root login attempts, etc.).","description":"## Description\n\nThe `rsyslog` and configuration files specifies rules for logging and which files are to be used to log certain classes of messages.\n\n## Audit\n\nReview the contents of `/etc/rsyslog.conf` and `/etc/rsyslog.d/*.conf` files to ensure appropriate logging is set. In addition, run the following command and verify that the log files are logging information as expected:\n\nRun the following script and review the output from the `rsyslog` configuration to ensure appropriate logging is set an in accordance with local site policy.\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_include='\\$IncludeConfig' a_config_files=(\"rsyslog.conf\")\n while IFS= read -r l_file; do\n l_conf_loc=\"$(awk '$1~/^\\s*'\"$l_include\"'$/ {print $2}' \"$(tr -d '# ' /dev/null)\n for l_logfile in \"${a_config_files[@]}\"; do\n grep -PHs -- '^\\h*[^#\\n\\r\\/:]+\\/var\\/log\\/.*$' \"$l_logfile\"\n done\n}\n```\n\nExample output:\n\n```bash\n/etc/rsyslog.d/60-rsyslog.conf:auth,authpriv.* /var/log/secure\n/etc/rsyslog.d/60-rsyslog.conf:mail.* -/var/log/mail\n/etc/rsyslog.d/60-rsyslog.conf:mail.info -/var/log/mail.info\n/etc/rsyslog.d/60-rsyslog.conf:mail.warning -/var/log/mail.warn\n/etc/rsyslog.d/60-rsyslog.conf:mail.err /var/log/mail.err\n/etc/rsyslog.d/60-rsyslog.conf:cron.* /var/log/cron\n/etc/rsyslog.d/60-rsyslog.conf:*.=warning;*.=err -/var/log/warn\n/etc/rsyslog.d/60-rsyslog.conf:*.crit /var/log/warn\n/etc/rsyslog.d/60-rsyslog.conf:*.*;mail.none;news.none -/var/log/messages\n/etc/rsyslog.d/60-rsyslog.conf:local0,local1.* -/var/log/localmessages\n/etc/rsyslog.d/60-rsyslog.conf:local2,local3.* -/var/log/localmessages\n/etc/rsyslog.d/60-rsyslog.conf:local4,local5.* -/var/log/localmessages\n/etc/rsyslog.d/60-rsyslog.conf:local6,local7.* -/var/log/localmessages\n/etc/rsyslog.d/50-default.conf:auth,authpriv.* /var/log/auth.log #<- Will be ignored\n/etc/rsyslog.d/50-default.conf:*.*;auth,authpriv.none -/var/log/syslog\n/etc/rsyslog.d/50-default.conf:kern.* -/var/log/kern.log\n/etc/rsyslog.d/50-default.conf:mail.* -/var/log/mail.log #<- Will be ignored\n/etc/rsyslog.d/50-default.conf:mail.err /var/log/mail.err #<- Will be ignored\n```\n\n**Note:**\n\n- Output is generated as :\n- Files are listed in order of precedence. If the same parameter is listed multiple times, only the first occurrence will be used be the `rsyslog` daemon"},{"uuid":"f3daac9d-98d1-5b3d-a59d-4c2446034cef","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.5_Ensure_rsyslog_logging_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog logging is configured","description":"Edit the following lines in the configuration file(s) returned by the audit as appropriate for your environment.\n\n**Note:** The below configuration is shown for example purposes only. Due care should be given to how the organization wishes to store log data.\n\n```bash\n*.emerg :omusrmsg:*\nauth,authpriv.* /var/log/secure\nmail.* -/var/log/mail\nmail.info -/var/log/mail.info\nmail.warning -/var/log/mail.warn\nmail.err /var/log/mail.err\ncron.* /var/log/cron\n*.=warning;*.=err -/var/log/warn\n*.crit /var/log/warn\n*.*;mail.none;news.none -/var/log/messages\nlocal0,local1.* -/var/log/localmessages\nlocal2,local3.* -/var/log/localmessages\nlocal4,local5.* -/var/log/localmessages\nlocal6,local7.* -/var/log/localmessages\n```\n\nRun the following command to reload the `rsyslogd` configuration:\n\n```bash\n# systemctl reload-or-restart rsyslog\n```"}],"title":"6.1.3.5 Ensure rsyslog logging is configured","description":"The `rsyslog` and configuration files specifies rules for logging and which files are to be used to log certain classes of messages."},{"uuid":"2e860bcb-b6e0-5f95-9a32-c6ec3bd722eb","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.6_Ensure_rsyslog_is_configured_to_send_logs_to_a_remote_log_host"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.6"}],"steps":[{"uuid":"511aba47-9204-55e4-b111-c9ece038e458","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.6_Ensure_rsyslog_is_configured_to_send_logs_to_a_remote_log_host"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure rsyslog is configured to send logs to a remote log host","remarks":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.","description":"## Description\n\n`rsyslog` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management.\n\n## Audit\n\nRun the following script and review the output of `rsyslog` configuration. Verify that logs are sent to a central host used by your organization:\n\n**basic format**\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_include='\\$IncludeConfig' a_config_files=(\"rsyslog.conf\")\n while IFS= read -r l_file; do\n l_conf_loc=\"$(awk '$1~/^\\s*'\"$l_include\"'$/ {print $2}' \"$(tr -d '# ' /dev/null)\n for l_logfile in \"${a_config_files[@]}\"; do\n grep -Hs -- \"^*.*[^I][^I]*@\" \"$l_logfile\"\n done\n}\n```\n\nOutput should include `@@`:\n\nExample output:\n\n```bash\n/etc/rsyslog.d/60-rsyslog.conf:*.* @@loghost.example.com\n```\n\n**- OR -**\nRun the following script and review the output of `rsyslog` configuration. Verify that logs are sent to a central host used by your organization:\n\n**advanced format**\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_include='\\$IncludeConfig' a_config_files=(\"rsyslog.conf\")\n while IFS= read -r l_file; do\n l_conf_loc=\"$(awk '$1~/^\\s*'\"$l_include\"'$/ {print $2}' \"$(tr -d '# ' /dev/null)\n for l_logfile in \"${a_config_files[@]}\"; do\n grep -PHsi -- '^\\s*([^#]+\\s+)?action\\(([^#]+\\s+)?\\btarget=\\\"?[^#\"]+\\\"?\\b' \"$l_logfile\"\n done\n}\n```\n\nOutput should include `target=`:\n\nExample output:\n\n```bash\n/etc/rsyslog.d/60-rsyslog.conf:*.* action(type=\"omfwd\" target=\"loghost.example.com\" port=\"514\" protocol=\"tcp\"\n```"},{"uuid":"c049d69e-7bd1-5f3b-b89f-2ba41dbca9ef","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.6_Ensure_rsyslog_is_configured_to_send_logs_to_a_remote_log_host"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog is configured to send logs to a remote log host","description":"Edit the `rsyslog` configuration and add the following line (where `loghost.example.com` is the name of your central log host). The `target` directive may either be a fully qualified domain name or an IP address.\n\nExample script to create a drop-in configuration file:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_parameters=('*.* action(type=\"omfwd\" target=\"loghost.example.com\" port=\"514\" protocol=\"tcp\"' \\\n ' action.resumeRetryCount=\"100\"' ' queue.type=\"LinkedList\" queue.size=\"1000\")')\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslod.d/\n printf '%s\\n' \"\" \"${a_parameters[@]}\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```\n\nRun the following command to reload `rsyslog.service`:\n\n```bash\n# systemctl reload-or-restart rsyslog.service\n```"}],"title":"6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host","description":"`rsyslog` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."},{"uuid":"cd1d8024-8f7b-5b46-aa3e-9b74c9f8e2f0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.7_Ensure_rsyslog_is_not_configured_to_receive_logs_from_a_remote_client"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.7"}],"steps":[{"uuid":"7b851073-8873-5f73-994b-cdaae2320e27","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.7_Ensure_rsyslog_is_not_configured_to_receive_logs_from_a_remote_client"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/9/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:4:8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:9:2"}],"title":"Audit for Ensure rsyslog is not configured to receive logs from a remote client","remarks":"If a client is configured to also receive data, thus turning it into a server, the client system is acting outside its operational boundary.","description":"## Description\n\n`rsyslog` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts.\n\n## Audit\n\nUnless the system's primary function is to serve as a logfile server, run the following script to review the `rsyslog` configuration and verify that the system is not configured to accept incoming logs.\n\n**advanced format**\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=()\n l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_include='\\$IncludeConfig' a_config_files=(\"rsyslog.conf\")\n while IFS= read -r l_file; do\n l_conf_loc=\"$(awk '$1~/^\\s*'\"$l_include\"'$/ {print $2}' \"$(tr -d '# ' /dev/null)\n for l_logfile in \"${a_config_files[@]}\"; do\n l_fail=\"$(grep -Psi -- '^\\h*module\\(load=\\\"?imtcp\\\"?\\)' \"$l_logfile\")\"\n [ -n \"$l_fail\" ] && a_output2+=(\"- Advanced format entry to accept incoming logs: \\\"$l_fail\\\"\" \"found in: \\\"$l_logfile\\\"\")\n l_fail=\"$(grep -Psi -- '^\\h*input\\(type=\\\"?imtcp\\\"?\\b' \"$l_logfile\")\"\n [ -n \"$l_fail\" ] && a_output2+=(\"- Advanced format entry to accept incoming logs: \\\"$l_fail\\\"\" \"found in: \\\"$l_logfile\\\"\")\n l_fail=\"$(grep -Psi -- '^\\h*module\\(load=\\\"?imtcp\\\"?\\)' \"$l_logfile\")\"\n [ -n \"$l_fail\" ] && a_output2+=(\"- Obsolete format entry to accept incoming logs: \\\"$l_fail\\\"\" \"found in: \\\"$l_logfile\\\"\")\n l_fail=\"$(grep -Psi -- '^\\h*input\\(type=\\\"?imtcp\\\"?\\b' \"$l_logfile\")\"\n [ -n \"$l_fail\" ] && a_output2+=(\"- Obsolete format entry to accept incoming logs: \\\"$l_fail\\\"\" \"found in: \\\"$l_logfile\\\"\")\n done\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \" - No entries to accept incoming logs found\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n fi\n}\n```"},{"uuid":"3e936959-4b96-57ef-be77-733175e9257a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.7_Ensure_rsyslog_is_not_configured_to_receive_logs_from_a_remote_client"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure rsyslog is not configured to receive logs from a remote client","description":"Unless the system's primary function is to serve as a logfile server , modify the files returned by the Audit Procedure and remove the specific lines highlighted by the audit. Verify none of the following entries are present in the `rsyslog` configuration.\n\n**advanced format**\n\n```bash\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")\n```\n\n**deprecated legacy format**\n\n```bash\n$ModLoad imtcp\n$InputTCPServerRun\n```\n\nReload the service:\n\n```bash\n# systemctl reload-or-restart rsyslog\n```"}],"title":"6.1.3.7 Ensure rsyslog is not configured to receive logs from a remote client","description":"`rsyslog` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts."},{"uuid":"bc4c8753-ba9b-56f4-bcfe-6a97c0deca33","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.3 Configure rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.8_Ensure_logrotate_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.3.8"}],"steps":[{"uuid":"4cef53d3-cefe-584b-8e6f-dec70fab4319","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.8_Ensure_logrotate_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure logrotate is configured","remarks":"By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files.","description":"## Description\n\nThe system includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/logrotate.d/rsyslog` is the configuration file used to rotate log files created by `rsyslog`.\n\n## Audit\n\nRun the following script to analyze the `logrotate` configuration:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_analyze_cmd=\"$(readlink -f /bin/systemd-analyze)\" l_config_file=\"/etc/logrotate.conf\"\n l_include=\"$(awk '$1~/^\\s*include$/{print$2}' \"$l_config_file\" 2>/dev/null)\"\n [ -d \"$l_include\" ] && l_include=\"$l_include/*\"\n $l_analyze_cmd cat-config \"$l_config_file\" $l_include\n}\n```\n\n**Note:** The last occurrence of a argument is the one used for the `logrotate` configuration"},{"uuid":"ffc3fb3f-7a46-5c9a-8619-2cbf22bad45f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.3.8_Ensure_logrotate_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure logrotate is configured","description":"Edit `/etc/logrotate.conf`, or the appropriate configuration file provided by the script in the Audit Procedure, as necessary to ensure logs are rotated according to site policy."}],"title":"6.1.3.8 Ensure logrotate is configured","description":"The system includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/logrotate.d/rsyslog` is the configuration file used to rotate log files created by `rsyslog`."},{"uuid":"b552e8fa-7f16-5a71-b254-54b221ba53b5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.1 System Logging > 6.1.4 Configure Logfiles"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.4.1_Ensure_access_to_all_logfiles_has_been_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.1.4.1"}],"steps":[{"uuid":"a43f75ef-d89f-5805-9bbb-5a2175219109","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.4.1_Ensure_access_to_all_logfiles_has_been_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure access to all logfiles has been configured","remarks":"It is important that log files have the correct permissions to ensure that sensitive data is protected and that only the appropriate users / groups have access to them.","description":"## Description\n\nLog files contain information from many services on the the local system, or in the event of a centralized log server, others systems logs as well.\n\nIn general log files are found in `/var/log/`, although application can be configured to store logs elsewhere. Should your application store logs in another, ensure to run the same test on that location.\n\n## Audit\n\nRun the following script to verify that files in `/var/log/` have appropriate permissions and ownership:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n f_file_test_chk()\n {\n a_out2=() \n maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\"\n [ $(( $l_mode & $perm_mask )) -gt 0 ] && \\\n a_out2+=(\" o Mode: \\\"$l_mode\\\" should be \\\"$maxperm\\\" or more restrictive\")\n [[ ! \"$l_user\" =~ $l_auser ]] && \\\n a_out2+=(\" o Owned by: \\\"$l_user\\\" and should be owned by \\\"${l_auser//|/ or }\\\"\")\n [[ ! \"$l_group\" =~ $l_agroup ]] && \\\n a_out2+=(\" o Group owned by: \\\"$l_group\\\" and should be group owned by \\\"${l_agroup//|/ or }\\\"\")\n [ \"${#a_out2[@]}\" -gt 0 ] && a_output2+=(\" - File: \\\"$l_fname\\\" is:\" \"${a_out2[@]}\")\n }\n while IFS= read -r -d $'\\0' l_file; do\n while IFS=: read -r l_fname l_mode l_user l_group; do\n if grep -Pq -- '\\/(apt)\\h*$' <<< \"$(dirname \"$l_fname\")\"; then\n perm_mask='0133' l_auser=\"root\" l_agroup=\"(root|adm)\"; f_file_test_chk\n else\n case \"$(basename \"$l_fname\")\" in\n lastlog | lastlog.* | wtmp | wtmp.* | wtmp-* | btmp | btmp.* | btmp-* | README)\n perm_mask='0113' l_auser=\"root\" l_agroup=\"(root|utmp)\"\n f_file_test_chk ;;\n cloud-init.log* | localmessages* | waagent.log*)\n perm_mask='0133' l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n file_test_chk ;;\n secure{,*.*,.*,-*} | auth.log | syslog | messages)\n perm_mask='0137' l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n f_file_test_chk ;;\n SSSD | sssd)\n perm_mask='0117' l_auser=\"(root|SSSD)\" l_agroup=\"(root|SSSD)\"\n f_file_test_chk ;;\n gdm | gdm3)\n perm_mask='0117' l_auser=\"root\" l_agroup=\"(root|gdm|gdm3)\"\n f_file_test_chk ;;\n *.journal | *.journal~)\n perm_mask='0137' l_auser=\"root\" l_agroup=\"(root|systemd-journal)\"\n f_file_test_chk ;;\n *)\n perm_mask='0137' l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n if [ \"$l_user\" = \"root\" ] || ! grep -Pq -- \"^\\h*$(awk -F: '$1==\"'\"$l_user\"'\" {print $7}' /etc/passwd)\\b\" /etc/shells; then\n ! grep -Pq -- \"$l_auser\" <<< \"$l_user\" && l_auser=\"(root|syslog|$l_user)\"\n ! grep -Pq -- \"$l_agroup\" <<< \"$l_group\" && l_agroup=\"(root|adm|$l_group)\"\n fi\n f_file_test_chk ;;\n esac\n fi\n done < <(stat -Lc '%n:%#a:%U:%G' \"$l_file\")\n done < <(find -L /var/log -type f \\( -perm /0137 -o ! -user root -o ! -group root \\) -print0)\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n a_output+=(\" - All files in \\\"/var/log/\\\" have appropriate permissions and ownership\")\n printf '\\n%s' \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '\\n%s' \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"uuid":"cc9010ae-dd61-507e-88cc-d27e5f61115a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.1.4.1_Ensure_access_to_all_logfiles_has_been_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure access to all logfiles has been configured","description":"Run the following script to update permissions and ownership on files in `/var/log`.\n\nAlthough the script is not destructive, ensure that the output of the audit procedure is captured in the event that the remediation causes issues.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=()\n f_file_test_fix()\n {\n a_out2=()\n maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\"\n if [ $(( $l_mode & $perm_mask )) -gt 0 ]; then\n a_out2+=(\" o Mode: \\\"$l_mode\\\" should be \\\"$maxperm\\\" or more restrictive\" \" x Removing excess permissions\")\n chmod \"$l_rperms\" \"$l_fname\"\n fi\n if [[ ! \"$l_user\" =~ $l_auser ]]; then\n a_out2+=(\" o Owned by: \\\"$l_user\\\" and should be owned by \\\"${l_auser//|/ or }\\\"\" \" x Changing ownership to: \\\"$l_fix_account\\\"\")\n chown \"$l_fix_account\" \"$l_fname\"\n fi\n if [[ ! \"$l_group\" =~ $l_agroup ]]; then\n a_out2+=(\" o Group owned by: \\\"$l_group\\\" and should be group owned by \\\"${l_agroup//|/ or }\\\"\" \" x Changing group ownership to: \\\"$l_fix_account\\\"\")\n chgrp \"$l_fix_account\" \"$l_fname\"\n fi\n [ \"${#a_out2[@]}\" -gt 0 ] && a_output2+=(\" - File: \\\"$l_fname\\\" is:\" \"${a_out2[@]}\")\n }\n l_fix_account='root'\n while IFS= read -r -d $'\\0' l_file; do\n while IFS=: read -r l_fname l_mode l_user l_group; do\n if grep -Pq -- '\\/(apt)\\h*$' <<< \"$(dirname \"$l_fname\")\"; then\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"root\" l_agroup=\"(root|adm)\"; f_file_test_fix\n else\n case \"$(basename \"$l_fname\")\" in\n lastlog | lastlog.* | wtmp | wtmp.* | wtmp-* | btmp | btmp.* | btmp-* | README)\n perm_mask='0113' l_rperms=\"ug-x,o-wx\" l_auser=\"root\" l_agroup=\"(root|utmp)\"\n f_file_test_fix ;;\n cloud-init.log* | localmessages* | waagent.log*)\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n file_test_fix ;;\n secure | auth.log | syslog | messages)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n f_file_test_fix ;;\n SSSD | sssd)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"(root|SSSD)\" l_agroup=\"(root|SSSD)\"\n f_file_test_fix ;;\n gdm | gdm3)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"root\" l_agroup=\"(root|gdm|gdm3)\"\n f_file_test_fix ;;\n *.journal | *.journal~)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"root\" l_agroup=\"(root|systemd-journal)\" \n f_file_test_fix ;;\n *)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n if [ \"$l_user\" = \"root\" ] || ! grep -Pq -- \"^\\h*$(awk -F: '$1==\"'\"$l_user\"'\" {print $7}' /etc/passwd)\\b\" /etc/shells; then\n ! grep -Pq -- \"$l_auser\" <<< \"$l_user\" && l_auser=\"(root|syslog|$l_user)\"\n ! grep -Pq -- \"$l_agroup\" <<< \"$l_group\" && l_agroup=\"(root|adm|$l_group)\"\n fi\n f_file_test_fix ;;\n esac\n fi\n done < <(stat -Lc '%n:%#a:%U:%G' \"$l_file\")\n done < <(find -L /var/log -type f \\( -perm /0137 -o ! -user root -o ! -group root \\) -print0)\n if [ \"${#a_output2[@]}\" -le 0 ]; then # If all files passed, then we report no changes\n a_output+=(\" - All files in \\\"/var/log/\\\" have appropriate permissions and ownership\")\n printf '\\n%s' \"- All files in \\\"/var/log/\\\" have appropriate permissions and ownership\" \" o No changes required\" \"\"\n else\n printf '\\n%s' \"${a_output2[@]}\" \"\"\n fi\n}\n```\n\n**Note:** You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions.\n\nIf there are services that log to other locations, ensure that those log files have the appropriate permissions."}],"title":"6.1.4.1 Ensure access to all logfiles has been configured","description":"Log files contain information from many services on the the local system, or in the event of a centralized log server, others systems logs as well.\n\nIn general log files are found in `/var/log/`, although application can be configured to store logs elsewhere. Should your application store logs in another, ensure to run the same test on that location."},{"uuid":"e871ab34-b967-5686-bec6-762a4a587b7d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.1 Configure auditd Service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.1_Ensure_auditd_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.1.1"}],"steps":[{"uuid":"6ff8796a-387a-5c72-b286-9566117dfa66","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.1_Ensure_auditd_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure auditd packages are installed","remarks":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.","description":"## Description\n\nauditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk\n\n## Audit\n\nRun the following command and verify `auditd` is installed:\n\n```bash\n# dpkg-query -s auditd &>/dev/null && echo auditd is installed\n\nauditd is installed\n```\n\nRun the following command to verify `audispd-plugins` is installed:\n\n```bash\n# dpkg-query -s audispd-plugins &>/dev/null && echo audispd-plugins is installed\n\naudispd-plugins is installed\n```"},{"uuid":"0614d5d6-1d63-5b6f-8f2b-5c044df0c5f1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.1_Ensure_auditd_packages_are_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure auditd packages are installed","description":"Run the following command to Install `auditd` and `audispd-plugins`\n\n```bash\n# apt install auditd audispd-plugins\n```"}],"title":"6.2.1.1 Ensure auditd packages are installed","description":"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk"},{"uuid":"10cb17c1-4e7d-50ec-adea-ce6c8661360b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.1 Configure auditd Service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.2_Ensure_auditd_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.1.2"}],"steps":[{"uuid":"9511b30a-7cb0-5b2d-8d39-12ea4f9c27a2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.2_Ensure_auditd_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure auditd service is enabled and active","remarks":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.","description":"## Description\n\nTurn on the `auditd` daemon to record system events.\n\n## Audit\n\nRun the following command to verify `auditd` is enabled:\n\n```bash\n# systemctl is-enabled auditd | grep '^enabled'\n\nenabled\n```\n\nVerify result is \"enabled\".\n\nRun the following command to verify `auditd` is active:\n\n```bash\n# systemctl is-active auditd | grep '^active'\n\nactive\n```\n\nVerify result is active"},{"uuid":"96917886-d613-5217-aaf5-f24c1fe7f8bf","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.2_Ensure_auditd_service_is_enabled_and_active"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure auditd service is enabled and active","description":"Run the following commands to unmask, enable and start `auditd`:\n\n```bash\n# systemctl unmask auditd\n# systemctl enable auditd\n# systemctl start auditd\n```"}],"title":"6.2.1.2 Ensure auditd service is enabled and active","description":"Turn on the `auditd` daemon to record system events."},{"uuid":"abdf9acd-4a10-5f4a-b69a-981bd52b369b","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.1 Configure auditd Service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.3_Ensure_auditing_for_processes_that_start_prior_to_auditd_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.1.3"}],"steps":[{"uuid":"c4ef737e-4575-59b6-b812-f6a141b60eb1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.3_Ensure_auditing_for_processes_that_start_prior_to_auditd_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure auditing for processes that start prior to auditd is enabled","remarks":"Audit events need to be captured on processes that start up prior to `auditd` , so that potential malicious activity cannot go undetected.","description":"## Description\n\nConfigure `grub2` so that processes that are capable of being audited can be audited even if they start up prior to `auditd` startup.\n\n## Audit\n\nRun the following command:\n\n```bash\n# find /boot -type f -name 'grub.cfg' -exec grep -Ph -- '^\\h*linux' {} + | grep -v 'audit=1'\n```\n\nNothing should be returned."},{"uuid":"8385e1d7-761f-5949-8932-b130f93e19fb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.3_Ensure_auditing_for_processes_that_start_prior_to_auditd_is_enabled"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure auditing for processes that start prior to auditd is enabled","description":"Edit `/etc/default/grub` and add `audit=1` to `GRUB_CMDLINE_LINUX`:\n\nExample:\n\n```bash\nGRUB_CMDLINE_LINUX=\"audit=1\"\n```\n\nRun the following command to update the `grub2` configuration:\n\n```bash\n# update-grub\n```"}],"title":"6.2.1.3 Ensure auditing for processes that start prior to auditd is enabled","description":"Configure `grub2` so that processes that are capable of being audited can be audited even if they start up prior to `auditd` startup."},{"uuid":"baea3dac-e558-5167-906f-fc8e2c4828d3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.1 Configure auditd Service"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.4_Ensure_audit_backlog_limit_is_sufficient"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.1.4"}],"steps":[{"uuid":"a1ef78d4-2b23-59ac-9d97-9615b151ae03","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.4_Ensure_audit_backlog_limit_is_sufficient"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure audit_backlog_limit is sufficient","remarks":"If an audit event is logged which would grow the queue beyond the `audit_backlog_limit`, then a failure occurs, auditd records will be lost, and potential malicious activity could go undetected.","description":"## Description\n\nIn the kernel-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue.\n\nThe kernel boot parameter `audit_backlog_limit=N`, with `N` representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration\n\n## Audit\n\nRun the following command and verify the `audit_backlog_limit=` parameter is set:\n\n```bash\n# find /boot -type f -name 'grub.cfg' -exec grep -Ph -- '^\\h*linux' {} + | grep -Pv 'audit_backlog_limit=\\d+\\b'\n```\n\nNothing should be returned."},{"uuid":"1683598f-a811-504d-9c8d-3a14f809a525","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.1.4_Ensure_audit_backlog_limit_is_sufficient"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit_backlog_limit is sufficient","description":"Edit `/etc/default/grub` and add `audit_backlog_limit=N` to GRUB_CMDLINE_LINUX. The recommended size for `N` is `8192` or larger.\n\nExample:\n\n```bash\nGRUB_CMDLINE_LINUX=\"audit_backlog_limit=8192\"\n```\n\nRun the following command to update the `grub2` configuration:\n\n```bash\n# update-grub\n```"}],"title":"6.2.1.4 Ensure audit_backlog_limit is sufficient","description":"In the kernel-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue.\n\nThe kernel boot parameter `audit_backlog_limit=N`, with `N` representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration"},{"uuid":"dec9b679-cb94-54bf-80e8-070ecde391d4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.2 Configure Data Retention"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.1_Ensure_audit_log_storage_size_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.2.1"}],"steps":[{"uuid":"8b579da8-202f-5597-9cc9-f3f6a1a096d3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.1_Ensure_audit_log_storage_size_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure audit log storage size is configured","remarks":"It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost.","description":"## Description\n\nConfigure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started.\n\n## Audit\n\nRun the following command and ensure output is in compliance with site policy:\n\n```bash\n# grep -Po -- '^\\h*max_log_file\\h*=\\h*\\d+\\b' /etc/audit/auditd.conf\n\nmax_log_file =\n```"},{"uuid":"4f85cf20-4626-5a5a-a694-89e330a4fede","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.1_Ensure_audit_log_storage_size_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit log storage size is configured","description":"Set the following parameter in `/etc/audit/auditd.conf` in accordance with site policy:\n\n```bash\nmax_log_file =\n```"}],"title":"6.2.2.1 Ensure audit log storage size is configured","description":"Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started."},{"uuid":"705fcf23-48c2-5d54-9b95-a45aa816adda","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.2 Configure Data Retention"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.2_Ensure_audit_logs_are_not_automatically_deleted"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.2.2"}],"steps":[{"uuid":"addfed0d-d9f1-5968-9daf-95d7676aee91","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.2_Ensure_audit_logs_are_not_automatically_deleted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:4"}],"title":"Audit for Ensure audit logs are not automatically deleted","remarks":"In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history.","description":"## Description\n\nThe `max_log_file_action` setting determines how to handle the audit log file reaching the max file size. A value of `keep_logs` will rotate the logs but never delete old logs.\n\n## Audit\n\nRun the following command and verify output matches:\n\n```bash\n# grep max_log_file_action /etc/audit/auditd.conf\n\nmax_log_file_action = keep_logs\n```"},{"uuid":"74249af6-6cd3-5149-b18e-de3372c1cec2","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.2_Ensure_audit_logs_are_not_automatically_deleted"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit logs are not automatically deleted","description":"Set the following parameter in `/etc/audit/auditd.conf:`\n\n```bash\nmax_log_file_action = keep_logs\n```"}],"title":"6.2.2.2 Ensure audit logs are not automatically deleted","description":"The `max_log_file_action` setting determines how to handle the audit log file reaching the max file size. A value of `keep_logs` will rotate the logs but never delete old logs."},{"uuid":"37694047-e15e-5ea8-a0cf-0cc72321a4a5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.2 Configure Data Retention"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.3_Ensure_system_is_disabled_when_audit_logs_are_full"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.2.3"}],"steps":[{"uuid":"653c39d6-58da-5adc-9ccb-eb697ea10697","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.3_Ensure_system_is_disabled_when_audit_logs_are_full"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"}],"title":"Audit for Ensure system is disabled when audit logs are full","remarks":"In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.","description":"## Description\n\nThe `auditd` daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files.\n\nThe `disk_full_action` parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `rotate`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will issue a syslog message but no other action is taken\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `disk_error_action` parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will not take any action\n- `syslog`, the audit daemon will issue no more than 5 consecutive warnings to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\n## Audit\n\nRun the following command and verify the `disk_full_action` is set to either `halt` or `single`:\n\n```bash\n# grep -Pi -- '^\\h*disk_full_action\\h*=\\h*(halt|single)\\b' /etc/audit/auditd.conf\n\ndisk_full_action =\n```\n\nRun the following command and verify the `disk_error_action` is set to `syslog`, `single`, or `halt`:\n\n```bash\n# grep -Pi -- '^\\h*disk_error_action\\h*=\\h*(syslog|single|halt)\\b' /etc/audit/auditd.conf\n\ndisk_error_action =\n```"},{"uuid":"dafb4c03-314e-5e1a-b57b-04553c3b086a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.3_Ensure_system_is_disabled_when_audit_logs_are_full"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure system is disabled when audit logs are full","description":"Set one of the following parameters in `/etc/audit/auditd.conf` depending on your local security policies.\n\n```bash\ndisk_full_action = \ndisk_error_action =\n```\n\nExample:\n\n```bash\ndisk_full_action = halt\ndisk_error_action = halt\n```\n\nImpact:\n\n`disk_full_action` parameter:\n\n- Set to `halt` - the `auditd` daemon will shutdown the system when the disk partition containing the audit logs becomes full.\n- Set to `single` - the `auditd` daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.\n\n`disk_error_action` parameter:\n\n- Set to `halt` - the `auditd` daemon will shutdown the system when an error is detected on the partition that holds the audit log files.\n- Set to `single` - the `auditd` daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files.\n- Set to `syslog` - the `auditd` daemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files."}],"title":"6.2.2.3 Ensure system is disabled when audit logs are full","description":"The `auditd` daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files.\n\nThe `disk_full_action` parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `rotate`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will issue a syslog message but no other action is taken\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `disk_error_action` parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will not take any action\n- `syslog`, the audit daemon will issue no more than 5 consecutive warnings to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system"},{"uuid":"b0317911-dd06-5ab3-aff4-18dc5ae9d64d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.2 Configure Data Retention"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.4_Ensure_system_warns_when_audit_logs_are_low_on_space"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.2.4"}],"steps":[{"uuid":"08cf0986-b21e-5383-a2f0-3b3b4ab9bd07","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.4_Ensure_system_warns_when_audit_logs_are_low_on_space"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-8"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure system warns when audit logs are low on space","remarks":"In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability.","description":"## Description\n\nThe `auditd` daemon can be configured to halt the system, put the system in single user mode or send a warning message, if the partition that holds the audit log files is low on space.\n\nThe `space_left_action` parameter tells the system what action to take when the system has detected that it is starting to get low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `admin_space_left_action` parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\n## Audit\n\nRun the following command and verify the `space_left_action` is set to `email`, `exec`, `single`, or `halt`:\n\n```bash\n# grep -P -- '^\\h*space_left_action\\h*=\\h*(email|exec|single|halt)\\b' /etc/audit/auditd.conf\n```\n\nVerify the output is `email`, `exec`, `single`, or `halt`\n\nExample output\n\n```bash\nspace_left_action = email\n```\n\nRun the following command and verify the `admin_space_left_action` is set to `single` **- OR -** `halt`:\n\n```bash\n# grep -P -- '^\\h*admin_space_left_action\\h*=\\h*(single|halt)\\b' /etc/audit/auditd.conf\n```\n\nVerify the output is `single` or `halt`\n\nExample output:\n\n```bash\nadmin_space_left_action = single\n```\n\n**Note:** A Mail Transfer Agent (MTA) must be installed and configured properly to set `space_left_action = email`"},{"uuid":"a88610d9-0da5-52ee-a34b-ff2f01039634","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.2.4_Ensure_system_warns_when_audit_logs_are_low_on_space"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure system warns when audit logs are low on space","description":"Set the `space_left_action` parameter in `/etc/audit/auditd.conf` to `email`, `exec`, `single`, or `halt`:\n\nExample:\n\n```bash\nspace_left_action = email\n```\n\nSet the `admin_space_left_action` parameter in `/etc/audit/auditd.conf` to `single` or `halt`:\n\nExample:\n\n```bash\nadmin_space_left_action = single\n```\n\n**Note:** A Mail Transfer Agent (MTA) must be installed and configured properly to set `space_left_action = email`\n\nImpact:\n\nIf the `admin_space_left_action` is set to `single` the audit daemon will put the computer system in single user mode."}],"title":"6.2.2.4 Ensure system warns when audit logs are low on space","description":"The `auditd` daemon can be configured to halt the system, put the system in single user mode or send a warning message, if the partition that holds the audit log files is low on space.\n\nThe `space_left_action` parameter tells the system what action to take when the system has detected that it is starting to get low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `admin_space_left_action` parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path-to-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system"},{"uuid":"e023c2a2-888e-50c6-88f0-65b39ee3e4f4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.1_Ensure_changes_to_system_administration_scope_sudoers_is_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.1"}],"steps":[{"uuid":"25b04c8b-45fb-540f-a7e8-bf4669f6e5c9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.1_Ensure_changes_to_system_administration_scope_sudoers_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:8"}],"title":"Audit for Ensure changes to system administration scope (sudoers) is collected","remarks":"Changes in the `/etc/sudoers` and `/etc/sudoers.d` files can indicate that an unauthorized change has been made to the scope of system administrator activity.","description":"## Description\n\nMonitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the `sudo` command to execute privileged commands, it is possible to monitor changes in scope. The file `/etc/sudoers`, or files in `/etc/sudoers.d`, will be written to when the file(s) or related attributes have changed. The audit records will be tagged with the identifier \"scope\".\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-w/ \\\n&&/\\/etc\\/sudoers/ \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-w/ \\\n&&/\\/etc\\/sudoers/ \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n```"},{"uuid":"938e5e8b-f714-5f40-ae6e-9151dd951ddc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.1_Ensure_changes_to_system_administration_scope_sudoers_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure changes to system administration scope (sudoers) is collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor scope changes for system administrators.\n\nExample:\n\n```bash\n# printf \"\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n\" >> /etc/audit/rules.d/50-scope.rules\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.1 Ensure changes to system administration scope (sudoers) is collected","description":"Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the `sudo` command to execute privileged commands, it is possible to monitor changes in scope. The file `/etc/sudoers`, or files in `/etc/sudoers.d`, will be written to when the file(s) or related attributes have changed. The audit records will be tagged with the identifier \"scope\"."},{"uuid":"fe078acc-fe32-551d-bcdd-428c4e79bb35","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.2_Ensure_actions_as_another_user_are_always_logged"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.2"}],"steps":[{"uuid":"3711b778-a11a-5ba3-9787-4b494e02ec2b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.2_Ensure_actions_as_another_user_are_always_logged"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:9"}],"title":"Audit for Ensure actions as another user are always logged","remarks":"Creating an audit log of users with temporary elevated privileges and the operation(s) they performed is essential to reporting. Administrators will want to correlate the events written to the audit trail with the records written to `sudo`'s logfile to verify if unauthorized commands have been executed.","description":"## Description\n\n`sudo` provides users with temporary elevated privileges to perform operations, either as the superuser or another user.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-a *always,exit/ \\\n&&/ -F *arch=b(32|64)/ \\\n&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n&&(/ -C *euid!=uid/||/ -C *uid!=euid/) \\\n&&/ -S *execve/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation \n-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-a *always,exit/ \\\n&&/ -F *arch=b(32|64)/ \\\n&&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n&&(/ -C *euid!=uid/||/ -C *uid!=euid/) \\\n&&/ -S *execve/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation\n```"},{"uuid":"491aec18-6d80-562b-92f0-04c3df28bab7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.2_Ensure_actions_as_another_user_are_always_logged"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure actions as another user are always logged","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor elevated privileges.\n\nExample:\n\n```bash\n# printf \"\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation \n-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n\" >> /etc/audit/rules.d/50-user_emulation.rules\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.2 Ensure actions as another user are always logged","description":"`sudo` provides users with temporary elevated privileges to perform operations, either as the superuser or another user."},{"uuid":"719d8a19-a3b7-5311-a029-75a739e2ea45","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.3_Ensure_events_that_modify_the_sudo_log_file_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.3"}],"steps":[{"uuid":"0eeccbf8-ada4-55ff-9498-832eeed044aa","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.3_Ensure_events_that_modify_the_sudo_log_file_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:9"}],"title":"Audit for Ensure events that modify the sudo log file are collected","remarks":"Changes in `/var/log/sudo.log` indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to `/var/log/sudo.log` to verify if unauthorized commands have been executed.","description":"## Description\n\nMonitor the `sudo` log file. If the system has been properly configured to disable the use of the `su` command and force all administrators to have to log in first and then use `sudo` to execute privileged commands, then all administrator commands will be logged to `/var/log/sudo.log` . Any time a command is executed, an audit event will be triggered as the `/var/log/sudo.log` file will be opened for write and the executed administration command will be written to the log.\n\n## Audit\n\n**Note:** This recommendation requires that the sudo logfile is configured. See guidance provided in the recommendation \"Ensure sudo log file exists\"\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n SUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g' -e 's|/|\\\\/|g')\n [ -n \"${SUDO_LOG_FILE}\" ] && awk \"/^ *-w/ \\\n &&/\"${SUDO_LOG_FILE}\"/ \\\n &&/ +-p *wa/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\"\n}\n```\n\nVerify output of matches:\n\n```bash\n-w /var/log/sudo.log -p wa -k sudo_log_file\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n SUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g' -e 's|/|\\\\/|g')\n [ -n \"${SUDO_LOG_FILE}\" ] && auditctl -l | awk \"/^ *-w/ \\\n &&/\"${SUDO_LOG_FILE}\"/ \\\n &&/ +-p *wa/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\"\n}\n```\n\nVerify output matches:\n\n```bash\n-w /var/log/sudo.log -p wa -k sudo_log_file\n```"},{"uuid":"b64d5487-7fbe-5a45-af04-7737eb3bc4bb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.3_Ensure_events_that_modify_the_sudo_log_file_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure events that modify the sudo log file are collected","description":"**Note:** This recommendation requires that the sudo logfile is configured. See guidance provided in the recommendation \"Ensure sudo log file exists\"\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the sudo log file.\n\nExample:\n\n```bash\n# {\nSUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g')\n[ -n \"${SUDO_LOG_FILE}\" ] && printf \"\n-w ${SUDO_LOG_FILE} -p wa -k sudo_log_file\n\" >> /etc/audit/rules.d/50-sudo.rules || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\"\n}\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.3 Ensure events that modify the sudo log file are collected","description":"Monitor the `sudo` log file. If the system has been properly configured to disable the use of the `su` command and force all administrators to have to log in first and then use `sudo` to execute privileged commands, then all administrator commands will be logged to `/var/log/sudo.log` . Any time a command is executed, an audit event will be triggered as the `/var/log/sudo.log` file will be opened for write and the executed administration command will be written to the log."},{"uuid":"655e89f9-2096-5e17-b0fe-f9409ade2c52","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.4_Ensure_events_that_modify_date_and_time_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.4"}],"steps":[{"uuid":"329d4ad5-aa71-537b-898f-b26d29d65835","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.4_Ensure_events_that_modify_date_and_time_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:5"}],"title":"Audit for Ensure events that modify date and time information are collected","remarks":"Unexpected changes in system date and/or time could be a sign of malicious activity on the system.","description":"## Description\n\nCapture events where the system date and/or time has been modified. The parameters in this section are set to determine if the;\n\n- `adjtimex` - tune kernel clock\n- `settimeofday` - set time using `timeval` and `timezone` structures\n- `stime` - using seconds since 1/1/1970\n- `clock_settime` - allows for the setting of several internal clocks and timers\n\nsystem calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as \"time-change\".\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n awk '/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&/ -S/ \\\n &&(/adjtimex/ \\\n ||/settimeofday/ \\\n ||/clock_settime/ ) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n\n awk '/^ *-w/ \\\n &&/\\/etc\\/localtime/ \\\n &&/ +-p *wa/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n}\n```\n\nVerify output of matches:\n\n```bash\n-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change\n-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change\n-w /etc/localtime -p wa -k time-change\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n auditctl -l | awk '/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&/ -S/ \\\n &&(/adjtimex/ \\\n ||/settimeofday/ \\\n ||/clock_settime/ ) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n\n auditctl -l | awk '/^ *-w/ \\\n &&/\\/etc\\/localtime/ \\\n &&/ +-p *wa/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n}\n```\n\nVerify the output includes:\n\n```bash\n-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change\n-a always,exit -F arch=b32 -S settimeofday,adjtimex -F key=time-change\n-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change\n-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change\n-w /etc/localtime -p wa -k time-change\n```"},{"uuid":"03b960f8-a273-514d-a175-1cdf071aca93","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.4_Ensure_events_that_modify_date_and_time_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure events that modify date and time information are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify date and time information.\n\nExample:\n\n```bash\n# printf \"\n-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change\n-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change\n-w /etc/localtime -p wa -k time-change\n\" >> /etc/audit/rules.d/50-time-change.rules\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.4 Ensure events that modify date and time information are collected","description":"Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the;\n\n- `adjtimex` - tune kernel clock\n- `settimeofday` - set time using `timeval` and `timezone` structures\n- `stime` - using seconds since 1/1/1970\n- `clock_settime` - allows for the setting of several internal clocks and timers\n\nsystem calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as \"time-change\"."},{"uuid":"5b8f7971-db21-5ad7-a47d-9ce86d8ee2cc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.5_Ensure_events_that_modify_the_systems_network_environment_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.5"}],"steps":[{"uuid":"c6e02295-342a-5a78-8907-10aa076bee84","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.5_Ensure_events_that_modify_the_systems_network_environment_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:5"}],"title":"Audit for Ensure events that modify the system's network environment are collected","remarks":"Monitoring system events that change network environments, such as `sethostname` and `setdomainname`, helps identify unauthorized alterations to host and domain names, which could compromise security settings reliant on these names. Changes to `/etc/hosts` can signal unauthorized attempts to alter machine associations with IP addresses, potentially redirecting users and processes to unintended destinations. Surveillance of `/etc/issue` and `/etc/issue.net` is crucial to detect intruders inserting false information to deceive users. Monitoring `/etc/network/` reveals modifications to network interfaces or scripts that may jeopardize system availability or security. Additionally, tracking changes in the `/etc/netplan/` directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance","description":"## Description\n\nRecord changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:\n\n- `sethostname` - set the systems host name\n- `setdomainname` - set the systems domain name\n\nThe files being monitored are:\n\n- `/etc/issue` and `/etc/issue.net` - messages displayed pre-login\n- `/etc/hosts` - file containing host names and associated IP addresses\n- `/etc/networks` - symbolic names for networks\n- `/etc/network/` - directory containing network interface scripts and configurations files\n- `/etc/netplan/` - central location for YAML networking configurations files\n\n## Audit\n\n**On disk configuration**\n\nRun the following commands to check the on disk rules:\n\n```bash\n# awk '/^ *-a *always,exit/ \\\n&&/ -F *arch=b(32|64)/ \\\n&&/ -S/ \\\n&&(/sethostname/ \\\n ||/setdomainname/) \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n\n# awk '/^ *-w/ \\\n&&(/\\/etc\\/issue/ \\\n ||/\\/etc\\/issue.net/ \\\n ||/\\/etc\\/hosts/ \\\n ||/\\/etc\\/network/ \\\n ||/\\/etc\\/netplan/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale\n-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale\n-w /etc/issue -p wa -k system-locale\n-w /etc/issue.net -p wa -k system-locale\n-w /etc/hosts -p wa -k system-locale\n-w /etc/networks -p wa -k system-locale\n-w /etc/network -p wa -k system-locale\n-w /etc/netplan -p wa -k system-locale\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-a *always,exit/ \\\n&&/ -F *arch=b(32|64)/ \\\n&&/ -S/ \\\n&&(/sethostname/ \\\n ||/setdomainname/) \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n\n# auditctl -l | awk '/^ *-w/ \\\n&&(/\\/etc\\/issue/ \\\n ||/\\/etc\\/issue.net/ \\\n ||/\\/etc\\/hosts/ \\\n ||/\\/etc\\/network/ \\\n ||/\\/etc\\/netplan/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output includes:\n\n```bash\n-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale\n-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale\n-w /etc/issue -p wa -k system-locale\n-w /etc/issue.net -p wa -k system-locale\n-w /etc/hosts -p wa -k system-locale\n-w /etc/networks -p wa -k system-locale\n-w /etc/network -p wa -k system-locale\n-w /etc/netplan -p wa -k system-locale\n```"},{"uuid":"802a47b5-c7ba-5d06-82e0-9004ff9c9f7f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.5_Ensure_events_that_modify_the_systems_network_environment_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure events that modify the system's network environment are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's network environment.\n\nExample:\n\n```bash\n# printf \"\n-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale\n-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale\n-w /etc/issue -p wa -k system-locale\n-w /etc/issue.net -p wa -k system-locale\n-w /etc/hosts -p wa -k system-locale\n-w /etc/networks -p wa -k system-locale\n-w /etc/network/ -p wa -k system-locale\n-w /etc/netplan/ -p wa -k system-locale\n\" >> /etc/audit/rules.d/50-system_locale.rules\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.5 Ensure events that modify the system's network environment are collected","description":"Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:\n\n- `sethostname` - set the systems host name\n- `setdomainname` - set the systems domain name\n\nThe files being monitored are:\n\n- `/etc/issue` and `/etc/issue.net` - messages displayed pre-login\n- `/etc/hosts` - file containing host names and associated IP addresses\n- `/etc/networks` - symbolic names for networks\n- `/etc/network/` - directory containing network interface scripts and configurations files\n- `/etc/netplan/` - central location for YAML networking configurations files"},{"uuid":"29cd22ec-6b7e-55f9-962d-895a372d8de4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.6_Ensure_use_of_privileged_commands_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.6"}],"steps":[{"uuid":"87e632f6-06ce-5aaf-898a-9362bd9d6627","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.6_Ensure_use_of_privileged_commands_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3(1)"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure use of privileged commands are collected","remarks":"Execution of privileged commands by non-privileged users could be an indication of someone trying to gain unauthorized access to the system.","description":"## Description\n\nMonitor privileged programs, those that have the `setuid` and/or `setgid` bit set on execution, to determine if unprivileged users are running these commands.\n\n## Audit\n\n**On disk configuration**\n\nRun the following script to check on disk rules:\n\n```bash\n#!/usr/bin/env bash\n\n{\n for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\" | awk '{print $1}'); do\n for PRIVILEGED in $(find \"${PARTITION}\" -xdev -perm /6000 -type f); do\n grep -qr \"${PRIVILEGED}\" /etc/audit/rules.d && printf \"OK: '${PRIVILEGED}' found in auditing rules.\\n\" || printf \"Warning: '${PRIVILEGED}' not found in on disk configuration.\\n\"\n done\n done\n}\n```\n\nVerify that all output is `OK`.\n\n**Running configuration**\n\nRun the following script to check loaded rules:\n\n```bash\n#!/usr/bin/env bash\n\n{\n RUNNING=$(auditctl -l)\n [ -n \"${RUNNING}\" ] && for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\" | awk '{print $1}'); do\n for PRIVILEGED in $(find \"${PARTITION}\" -xdev -perm /6000 -type f); do\n printf -- \"${RUNNING}\" | grep -q \"${PRIVILEGED}\" && printf \"OK: '${PRIVILEGED}' found in auditing rules.\\n\" || printf \"Warning: '${PRIVILEGED}' not found in running configuration.\\n\"\n done\n done \\\n || printf \"ERROR: Variable 'RUNNING' is unset.\\n\"\n}\n```\n\nVerify that all output is `OK`.\n\n**Special mount points**\n\nIf there are any special mount points that are not visible by default from `findmnt` as per the above audit, said file systems would have to be manually audited."},{"uuid":"4e0c6df5-2f01-55bd-a9b7-6b8a34967679","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.6_Ensure_use_of_privileged_commands_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure use of privileged commands are collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor the use of privileged commands.\n\nExample script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n AUDIT_RULE_FILE=\"/etc/audit/rules.d/50-privileged.rules\"\n NEW_DATA=()\n for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\" | awk '{print $1}'); do\n readarray -t DATA =\"UID_MIN\" -F auid!=unset -k privileged\" }')\n for ENTRY in \"${DATA[@]}\"; do\n NEW_DATA+=(\"${ENTRY}\")\n done\n done\n readarray &> /dev/null -t OLD_DATA \"${AUDIT_RULE_FILE}\"\n}\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n**Special mount points**\n\nIf there are any special mount points that are not visible by default from just scanning `/`, change the `PARTITION` variable to the appropriate partition and re-run the remediation.\n\nImpact:\n\nBoth the audit and remediation section of this recommendation will traverse all mounted file systems that is not mounted with either `noexec` or `nosuid` mount options. If there are large file systems without these mount options, **such traversal will be significantly detrimental to the performance of the system.**\n\nBefore running either the audit or remediation section, inspect the output of the following command to determine exactly which file systems will be traversed:\n\n```bash\n# findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\"\n```\n\nTo exclude a particular file system due to adverse performance impacts, update the audit and remediation sections by adding a sufficiently unique string to the `grep` statement. The above command can be used to test the modified exclusions."}],"title":"6.2.3.6 Ensure use of privileged commands are collected","description":"Monitor privileged programs, those that have the `setuid` and/or `setgid` bit set on execution, to determine if unprivileged users are running these commands."},{"uuid":"1f752741-6551-5584-81cc-727d833b94db","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.7_Ensure_unsuccessful_file_access_attempts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.7"}],"steps":[{"uuid":"fe2e9b9a-abfb-560c-b738-be45e157acfa","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.7_Ensure_unsuccessful_file_access_attempts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:9"}],"title":"Audit for Ensure unsuccessful file access attempts are collected","remarks":"Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system.","description":"## Description\n\nMonitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:\n\n- creation - `creat`\n- opening - `open` , `openat`\n- truncation - `truncate` , `ftruncate`\n\nAn audit log record will only be written if all of the following criteria is met for the user when trying to access a file:\n\n- a non-privileged user (auid>=UID_MIN)\n- is not a Daemon event (auid=4294967295/unset/-1)\n- if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&(/ -F *exit=-EACCES/||/ -F *exit=-EPERM/) \\\n &&/ -S/ \\\n &&/creat/ \\\n &&/open/ \\\n &&/truncate/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output includes:\n\n```bash\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&(/ -F *exit=-EACCES/||/ -F *exit=-EPERM/) \\\n &&/ -S/ \\\n &&/creat/ \\\n &&/open/ \\\n &&/truncate/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output includes:\n\n```bash\n-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access\n-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access\n-a always,exit -F arch=b32 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access\n-a always,exit -F arch=b32 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access\n```"},{"uuid":"4d601306-d87c-5b69-bb80-2dc328647fe6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.7_Ensure_unsuccessful_file_access_attempts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure unsuccessful file access attempts are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor unsuccessful file access attempts.\n\nExample:\n\n```bash\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n\" >> /etc/audit/rules.d/50-access.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.7 Ensure unsuccessful file access attempts are collected","description":"Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:\n\n- creation - `creat`\n- opening - `open` , `openat`\n- truncation - `truncate` , `ftruncate`\n\nAn audit log record will only be written if all of the following criteria is met for the user when trying to access a file:\n\n- a non-privileged user (auid>=UID_MIN)\n- is not a Daemon event (auid=4294967295/unset/-1)\n- if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)"},{"uuid":"a02b2138-6371-58fd-b473-ce1d518211d5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.8_Ensure_events_that_modify_usergroup_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.8"}],"steps":[{"uuid":"95f96da3-48e1-5e19-8dc3-10379cad19dc","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.8_Ensure_events_that_modify_usergroup_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/8"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:8"}],"title":"Audit for Ensure events that modify user/group information are collected","remarks":"Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts.","description":"## Description\n\nRecord events affecting the modification of user or group information, including that of passwords and old passwords if in use.\n\n- `/etc/group` - system groups\n- `/etc/passwd` - system users\n- `/etc/gshadow` - encrypted password for each group\n- `/etc/shadow` - system user passwords\n- `/etc/security/opasswd` - storage of old passwords if the relevant PAM module is in use\n- `/etc/nsswitch.conf` - file configures how the system uses various databases and name resolution mechanisms\n- `/etc/pam.conf` - file determines the authentication services to be used, and the order in which the services are used.\n- `/etc/pam.d` - directory contains the PAM configuration files for each PAM-aware application.\n\nThe parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier \"identity\" in the audit log file.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-w/ \\\n&&(/\\/etc\\/group/ \\\n ||/\\/etc\\/passwd/ \\\n ||/\\/etc\\/gshadow/ \\\n ||/\\/etc\\/shadow/ \\\n ||/\\/etc\\/security\\/opasswd/ \\\n ||/\\/etc\\/nsswitch.conf/ \\\n ||/\\/etc\\/pam.conf/ \\\n ||/\\/etc\\/pam.d/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/nsswitch.conf -p wa -k identity\n-w /etc/pam.conf -p wa -k identity\n-w /etc/pam.d -p wa -k identity\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-w/ \\\n&&(/\\/etc\\/group/ \\\n ||/\\/etc\\/passwd/ \\\n ||/\\/etc\\/gshadow/ \\\n ||/\\/etc\\/shadow/ \\\n ||/\\/etc\\/security\\/opasswd/ \\\n ||/\\/etc\\/nsswitch.conf/ \\\n ||/\\/etc\\/pam.conf/ \\\n ||/\\/etc\\/pam.d/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/nsswitch.conf -p wa -k identity\n-w /etc/pam.conf -p wa -k identity\n-w /etc/pam.d -p wa -k identity\n```"},{"uuid":"7c54ecd2-b7b3-57f6-a7a7-08df37c80d38","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.8_Ensure_events_that_modify_usergroup_information_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure events that modify user/group information are collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify user/group information.\n\nExample:\n\n```bash\n# printf \"\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/nsswitch.conf -p wa -k identity\n-w /etc/pam.conf -p wa -k identity\n-w /etc/pam.d -p wa -k identity\n\" >> /etc/audit/rules.d/50-identity.rules\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.8 Ensure events that modify user/group information are collected","description":"Record events affecting the modification of user or group information, including that of passwords and old passwords if in use.\n\n- `/etc/group` - system groups\n- `/etc/passwd` - system users\n- `/etc/gshadow` - encrypted password for each group\n- `/etc/shadow` - system user passwords\n- `/etc/security/opasswd` - storage of old passwords if the relevant PAM module is in use\n- `/etc/nsswitch.conf` - file configures how the system uses various databases and name resolution mechanisms\n- `/etc/pam.conf` - file determines the authentication services to be used, and the order in which the services are used.\n- `/etc/pam.d` - directory contains the PAM configuration files for each PAM-aware application.\n\nThe parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier \"identity\" in the audit log file."},{"uuid":"57c69c7e-d4c1-52a4-ae4b-1798e25c918c","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.9_Ensure_discretionary_access_control_permission_modification_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.9"}],"steps":[{"uuid":"ae030169-f12a-53d9-bca7-9afcb789c848","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.9_Ensure_discretionary_access_control_permission_modification_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:5"}],"title":"Audit for Ensure discretionary access control permission modification events are collected","remarks":"Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation.","description":"## Description\n\nMonitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls effect the permissions, ownership and various attributes of files.\n\n- `chmod`\n- `fchmod`\n- `fchmodat`\n- `chown`\n- `fchown`\n- `fchownat`\n- `lchown`\n- `setxattr`\n- `lsetxattr`\n- `fsetxattr`\n- `removexattr`\n- `lremovexattr`\n- `fremovexattr`\n\nIn all cases, an audit record will only be written for non-system user ids and will ignore Daemon events. All audit records will be tagged with the identifier \"perm_mod.\"\n\n## Audit\n\n**Note:** Output showing all audited syscalls, e.g. (-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,chmod,fchmod,fchmodat,setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod) is also acceptable. These have been separated by function on the displayed output for clarity.\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -S/ \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&(/chmod/||/fchmod/||/fchmodat/ \\\n ||/chown/||/fchown/||/fchownat/||/lchown/ \\\n ||/setxattr/||/lsetxattr/||/fsetxattr/ \\\n ||/removexattr/||/lremovexattr/||/fremovexattr/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -S/ \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&(/chmod/||/fchmod/||/fchmodat/ \\\n ||/chown/||/fchown/||/fchownat/||/lchown/ \\\n ||/setxattr/||/lsetxattr/||/fsetxattr/ \\\n ||/removexattr/||/lremovexattr/||/fremovexattr/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod\n-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod\n-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod\n-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod\n-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod\n-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod\n```"},{"uuid":"e10a8acc-8be9-58ac-8899-fb3599850b0e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.9_Ensure_discretionary_access_control_permission_modification_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure discretionary access control permission modification events are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor discretionary access control permission modification events.\n\nExample:\n\n```bash\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n\" >> /etc/audit/rules.d/50-perm_mod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.9 Ensure discretionary access control permission modification events are collected","description":"Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls effect the permissions, ownership and various attributes of files.\n\n- `chmod`\n- `fchmod`\n- `fchmodat`\n- `chown`\n- `fchown`\n- `fchownat`\n- `lchown`\n- `setxattr`\n- `lsetxattr`\n- `fsetxattr`\n- `removexattr`\n- `lremovexattr`\n- `fremovexattr`\n\nIn all cases, an audit record will only be written for non-system user ids and will ignore Daemon events. All audit records will be tagged with the identifier \"perm_mod.\""},{"uuid":"c85919c2-6000-5aed-9765-e4fef8e945c0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.10_Ensure_successful_file_system_mounts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.10"}],"steps":[{"uuid":"985d56ad-7f3f-5d47-ba2e-68b2e86f5bf5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.10_Ensure_successful_file_system_mounts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure successful file system mounts are collected","remarks":"It is highly unusual for a non privileged user to `mount` file systems to the system. While tracking `mount` commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful `open`, `creat` and `truncate` system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document.","description":"## Description\n\nMonitor the use of the `mount` system call. The `mount` (and `umount` ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -S/ \\\n &&/mount/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k mounts\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -S/ \\\n &&/mount/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=-1 -F key=mounts\n-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=-1 -F key=mounts\n```"},{"uuid":"540deda0-0feb-5731-836a-e88ae072ca26","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.10_Ensure_successful_file_system_mounts_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure successful file system mounts are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful file system mounts.\n\nExample:\n\n```bash\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b32 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n-a always,exit -F arch=b64 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n\" >> /etc/audit/rules.d/50-mounts.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.10 Ensure successful file system mounts are collected","description":"Monitor the use of the `mount` system call. The `mount` (and `umount` ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user"},{"uuid":"189bc604-cc08-5aac-a22c-ae9fda7bf1b6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.11_Ensure_session_initiation_information_is_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.11"}],"steps":[{"uuid":"ac2003f6-cff5-57fa-bf28-b168b507f818","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.11_Ensure_session_initiation_information_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/13"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:9"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:13"}],"title":"Audit for Ensure session initiation information is collected","remarks":"Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).","description":"## Description\n\nMonitor session initiation events. The parameters in this section track changes to the files associated with session events.\n\n- `/var/run/utmp` - tracks all currently logged in users.\n- `/var/log/wtmp` - file tracks logins, logouts, shutdown, and reboot events.\n- `/var/log/btmp` - keeps track of failed login attempts and can be read by entering the command `/usr/bin/last -f /var/log/btmp`.\n\nAll audit records will be tagged with the identifier \"session.\"\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-w/ \\\n&&(/\\/var\\/run\\/utmp/ \\\n ||/\\/var\\/log\\/wtmp/ \\\n ||/\\/var\\/log\\/btmp/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-w/ \\\n&&(/\\/var\\/run\\/utmp/ \\\n ||/\\/var\\/log\\/wtmp/ \\\n ||/\\/var\\/log\\/btmp/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n```"},{"uuid":"8dd7301d-f28b-57fe-85f2-736fbce5eb01","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.11_Ensure_session_initiation_information_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure session initiation information is collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor session initiation information.\n\nExample:\n\n```bash\n# printf \"\n-w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n\" >> /etc/audit/rules.d/50-session.rules\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.11 Ensure session initiation information is collected","description":"Monitor session initiation events. The parameters in this section track changes to the files associated with session events.\n\n- `/var/run/utmp` - tracks all currently logged in users.\n- `/var/log/wtmp` - file tracks logins, logouts, shutdown, and reboot events.\n- `/var/log/btmp` - keeps track of failed login attempts and can be read by entering the command `/usr/bin/last -f /var/log/btmp`.\n\nAll audit records will be tagged with the identifier \"session.\""},{"uuid":"6734f57a-c84b-5417-8982-757e72041e65","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.12_Ensure_login_and_logout_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.12"}],"steps":[{"uuid":"ce67220e-0e4f-5a2b-9223-cf238c89f81b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.12_Ensure_login_and_logout_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/13"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:9"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:13"}],"title":"Audit for Ensure login and logout events are collected","remarks":"Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins.","description":"## Description\n\nMonitor login and logout events. The parameters below track changes to files associated with login/logout events.\n\n- `/var/log/lastlog` - maintain records of the last time a user successfully logged in.\n- `/var/run/faillock` - directory maintains records of login failures via the `pam_faillock` module.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-w/ \\\n&&(/\\/var\\/log\\/lastlog/ \\\n ||/\\/var\\/run\\/faillock/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock -p wa -k logins\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-w/ \\\n&&(/\\/var\\/log\\/lastlog/ \\\n ||/\\/var\\/run\\/faillock/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock -p wa -k logins\n```"},{"uuid":"e1b32906-6ab2-56f2-a2e2-168e328afe1d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.12_Ensure_login_and_logout_events_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure login and logout events are collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor login and logout events.\n\nExample:\n\n```bash\n# printf \"\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock -p wa -k logins\n\" >> /etc/audit/rules.d/50-login.rules\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.12 Ensure login and logout events are collected","description":"Monitor login and logout events. The parameters below track changes to files associated with login/logout events.\n\n- `/var/log/lastlog` - maintain records of the last time a user successfully logged in.\n- `/var/run/faillock` - directory maintains records of login failures via the `pam_faillock` module."},{"uuid":"04e8605b-d26f-534c-b7e3-f6cefbc4324e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.13_Ensure_file_deletion_events_by_users_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.13"}],"steps":[{"uuid":"7d31f9de-aeac-5b1f-ac76-3e722f00cc02","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.13_Ensure_file_deletion_events_by_users_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SC-7"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure file deletion events by users are collected","remarks":"Monitoring these calls from non-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered.","description":"## Description\n\nMonitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for:\n\n- `unlink` - remove a file\n- `unlinkat` - remove a file attribute\n- `rename` - rename a file\n- `renameat` rename a file attribute\nsystem calls and tags them with the identifier \"delete\".\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -S/ \\\n &&(/unlink/||/rename/||/unlinkat/||/renameat/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -k delete\n-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -k delete\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -S/ \\\n &&(/unlink/||/rename/||/unlinkat/||/renameat/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete\n-a always,exit -F arch=b32 -S unlink,rename,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete\n```"},{"uuid":"f445cca1-11e6-56b5-a519-e232832a2f53","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.13_Ensure_file_deletion_events_by_users_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure file deletion events by users are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor file deletion events by users.\n\nExample:\n\n```bash\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n\" >> /etc/audit/rules.d/50-delete.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.13 Ensure file deletion events by users are collected","description":"Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for:\n\n- `unlink` - remove a file\n- `unlinkat` - remove a file attribute\n- `rename` - rename a file\n- `renameat` rename a file attribute\nsystem calls and tags them with the identifier \"delete\"."},{"uuid":"7bbeff4b-a411-5364-a032-abed28fc3b14","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.14_Ensure_events_that_modify_the_systems_Mandatory_Access_Controls_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.14"}],"steps":[{"uuid":"ef9d1ec6-7656-5259-b16f-53daf0a0283a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.14_Ensure_events_that_modify_the_systems_Mandatory_Access_Controls_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/5/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:5:5"}],"title":"Audit for Ensure events that modify the system's Mandatory Access Controls are collected","remarks":"Changes to files in the `/etc/apparmor/` and `/etc/apparmor.d/` directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system.","description":"## Description\n\nMonitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the `/etc/apparmor/` and `/etc/apparmor.d/` directories.\n\n**Note:** If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# awk '/^ *-w/ \\\n&&(/\\/etc\\/apparmor/ \\\n ||/\\/etc\\/apparmor.d/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/apparmor/ -p wa -k MAC-policy\n-w /etc/apparmor.d/ -p wa -k MAC-policy\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# auditctl -l | awk '/^ *-w/ \\\n&&(/\\/etc\\/apparmor/ \\\n ||/\\/etc\\/apparmor.d/) \\\n&&/ +-p *wa/ \\\n&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n```\n\nVerify the output matches:\n\n```bash\n-w /etc/apparmor/ -p wa -k MAC-policy\n-w /etc/apparmor.d/ -p wa -k MAC-policy\n```"},{"uuid":"3bf8af32-016c-5635-965b-5ed2ddb22224","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.14_Ensure_events_that_modify_the_systems_Mandatory_Access_Controls_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure events that modify the system's Mandatory Access Controls are collected","description":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls.\n\nExample:\n\n```bash\n# printf \"\n-w /etc/apparmor/ -p wa -k MAC-policy\n-w /etc/apparmor.d/ -p wa -k MAC-policy\n\" >> /etc/audit/rules.d/50-MAC-policy.rules\n```\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.14 Ensure events that modify the system's Mandatory Access Controls are collected","description":"Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the `/etc/apparmor/` and `/etc/apparmor.d/` directories.\n\n**Note:** If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited."},{"uuid":"fc946e66-407a-56b1-9020-274126f282ff","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.15_Ensure_successful_and_unsuccessful_attempts_to_use_the_chcon_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.15"}],"steps":[{"uuid":"b55aca3f-bdf0-5ed3-8e12-03dc4c61a447","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.15_Ensure_successful_and_unsuccessful_attempts_to_use_the_chcon_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure successful and unsuccessful attempts to use the chcon command are collected","remarks":"The `chcon` command is used to change file security context. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","description":"## Description\n\nThe operating system must generate audit records for successful/unsuccessful uses of the `chcon` command.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/chcon/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/chcon/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -S all -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng\n```"},{"uuid":"9bb6e562-5c83-521a-9a58-0436a59314af","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.15_Ensure_successful_and_unsuccessful_attempts_to_use_the_chcon_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure successful and unsuccessful attempts to use the chcon command are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chcon` command.\n\nExample:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.15 Ensure successful and unsuccessful attempts to use the chcon command are collected","description":"The operating system must generate audit records for successful/unsuccessful uses of the `chcon` command."},{"uuid":"216f5a02-5aa5-5901-95e6-416ef0abb25f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.16_Ensure_successful_and_unsuccessful_attempts_to_use_the_setfacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.16"}],"steps":[{"uuid":"591a3776-2517-552e-9c0b-aae0a4d8fd2f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.16_Ensure_successful_and_unsuccessful_attempts_to_use_the_setfacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure successful and unsuccessful attempts to use the setfacl command are collected","remarks":"This utility sets Access Control Lists (ACLs) of files and directories. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","description":"## Description\n\nThe operating system must generate audit records for successful/unsuccessful uses of the `setfacl` command\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/setfacl/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/setfacl/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -S all -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng\n```"},{"uuid":"81e57b7a-827b-59d0-9284-8e6cb5a24e3a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.16_Ensure_successful_and_unsuccessful_attempts_to_use_the_setfacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure successful and unsuccessful attempts to use the setfacl command are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `setfacl` command.\n\nExample:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.16 Ensure successful and unsuccessful attempts to use the setfacl command are collected","description":"The operating system must generate audit records for successful/unsuccessful uses of the `setfacl` command"},{"uuid":"6141eae1-2358-5bfa-a682-963ee970d4c4","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.17_Ensure_successful_and_unsuccessful_attempts_to_use_the_chacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.17"}],"steps":[{"uuid":"6b7e6051-ff4c-5602-81e7-8cb1c42bc61e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.17_Ensure_successful_and_unsuccessful_attempts_to_use_the_chacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure successful and unsuccessful attempts to use the chacl command are collected","remarks":"`chacl` changes the ACL(s) for a file or directory. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","description":"## Description\n\nThe operating system must generate audit records for successful/unsuccessful uses of the `chacl` command.\n\n`chacl` is an IRIX-compatibility command, and is maintained for those users who are familiar with its use from either XFS or IRIX.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/chacl/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/chacl/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -S all -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=-1 -F key=perm_chng\n```"},{"uuid":"2b5d71dc-2b35-5eb6-b157-8b7e8cde157f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.17_Ensure_successful_and_unsuccessful_attempts_to_use_the_chacl_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure successful and unsuccessful attempts to use the chacl command are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chacl` command.\n\nExample:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.17 Ensure successful and unsuccessful attempts to use the chacl command are collected","description":"The operating system must generate audit records for successful/unsuccessful uses of the `chacl` command.\n\n`chacl` is an IRIX-compatibility command, and is maintained for those users who are familiar with its use from either XFS or IRIX."},{"uuid":"107869c8-0d22-5672-bc8e-4e2b237331b6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.18_Ensure_successful_and_unsuccessful_attempts_to_use_the_usermod_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.18"}],"steps":[{"uuid":"b4383639-a712-5726-b94f-d73ecc6dfa9f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.18_Ensure_successful_and_unsuccessful_attempts_to_use_the_usermod_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"SI-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure successful and unsuccessful attempts to use the usermod command are collected","remarks":"The `usermod` command modifies the system account files to reflect the changes that are specified on the command line. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","description":"## Description\n\nThe operating system must generate audit records for successful/unsuccessful uses of the `usermod` command.\n\n## Audit\n\n**On disk configuration**\n\nRun the following command to check the on disk rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/sbin\\/usermod/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k usermod\n```\n\n**Running configuration**\n\nRun the following command to check loaded rules:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/sbin\\/usermod/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -S all -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=-1 -F key=usermod\n```"},{"uuid":"3f5c1713-e6ea-57fd-a6a3-4a00500611d7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.18_Ensure_successful_and_unsuccessful_attempts_to_use_the_usermod_command_are_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure successful and unsuccessful attempts to use the usermod command are collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `usermod` command.\n\nExample:\n\n```bash\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k usermod\n\" >> /etc/audit/rules.d/50-usermod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.18 Ensure successful and unsuccessful attempts to use the usermod command are collected","description":"The operating system must generate audit records for successful/unsuccessful uses of the `usermod` command."},{"uuid":"8566a6e6-cd54-5d53-ad43-2b8a5df90f86","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.19_Ensure_kernel_module_loading_unloading_and_modification_is_collected"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.19"}],"steps":[{"uuid":"68996fb4-70c0-5014-bd1d-506af4e72bdb","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.19_Ensure_kernel_module_loading_unloading_and_modification_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"}],"title":"Audit for Ensure kernel module loading unloading and modification is collected","remarks":"Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system.","description":"## Description\n\nMonitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by `kmod` via symbolic links.\n\nThe following system calls control loading and unloading of modules:\n\n- `init_module` - load a module\n- `finit_module` - load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided)\n- `delete_module` - delete a module\n- `create_module` - create a loadable module entry\n- `query_module` - query the kernel for various bits pertaining to modules\n\nAny execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of `modules`.\n\n## Audit\n\n**On disk configuration**\n\nRun the following script to check the on disk rules:\n\n```bash\n#!/usr/bin/env bash\n\n{\n awk '/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F auid!=unset/||/ -F auid!=-1/||/ -F auid!=4294967295/) \\\n &&/ -S/ \\\n &&(/init_module/ \\\n ||/finit_module/ \\\n ||/delete_module/ \\\n ||/create_module/ \\\n ||/query_module/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)' /etc/audit/rules.d/*.rules\n\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/kmod/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" /etc/audit/rules.d/*.rules \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output matches:\n\n```bash\n-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=1000 -F auid!=unset -k kernel_modules\n-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k kernel_modules\n```\n\n**Running configuration**\n\nRun the following script to check loaded rules:\n\n```bash\n#!/usr/bin/env bash\n\n{\n auditctl -l | awk '/^ *-a *always,exit/ \\\n &&/ -F *arch=b(32|64)/ \\\n &&(/ -F auid!=unset/||/ -F auid!=-1/||/ -F auid!=4294967295/) \\\n &&/ -S/ \\\n &&(/init_module/ \\\n ||/finit_module/ \\\n ||/delete_module/ \\\n ||/create_module/ \\\n ||/query_module/) \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)'\n\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && auditctl -l | awk \"/^ *-a *always,exit/ \\\n &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) \\\n &&/ -F *auid>=${UID_MIN}/ \\\n &&/ -F *perm=x/ \\\n &&/ -F *path=\\/usr\\/bin\\/kmod/ \\\n &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)\" \\\n || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\nVerify the output includes:\n\n```bash\n-a always,exit -F arch=b64 -S create_module,init_module,delete_module,query_module,finit_module -F auid>=1000 -F auid!=-1 -F key=kernel_modules\n-a always,exit -S all -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=-1 -F key=kernel_modules\n```\n\n**Symlink audit**\n\nRun the following script to audit if the symlinks `kmod` accepts are indeed pointing at it:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_files=(\"/usr/sbin/lsmod\" \"/usr/sbin/rmmod\" \"/usr/sbin/insmod\" \"/usr/sbin/modinfo\" \"/usr/sbin/modprobe\" \"/usr/sbin/depmod\")\n for l_file in \"${a_files[@]}\"; do\n if [ \"$(readlink -f \"$l_file\")\" = \"$(readlink -f /bin/kmod)\" ]; then\n printf \"OK: \\\"$l_file\\\"\\n\"\n else\n printf \"Issue with symlink for file: \\\"$l_file\\\"\\n\"\n fi\n done\n}\n```\n\nVerify the output states `OK`. If there is a symlink pointing to a different location it should be investigated"},{"uuid":"756fc8b9-ef8d-5c31-b44b-ef62177c21a0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.19_Ensure_kernel_module_loading_unloading_and_modification_is_collected"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure kernel module loading unloading and modification is collected","description":"**Create audit rules**\n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor kernel module modification.\n\nExample:\n\n```bash\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n -a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n \" >> /etc/audit/rules.d/50-kernel_modules.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.19 Ensure kernel module loading unloading and modification is collected","description":"Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by `kmod` via symbolic links.\n\nThe following system calls control loading and unloading of modules:\n\n- `init_module` - load a module\n- `finit_module` - load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided)\n- `delete_module` - delete a module\n- `create_module` - create a loadable module entry\n- `query_module` - query the kernel for various bits pertaining to modules\n\nAny execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of `modules`."},{"uuid":"7c57d884-8e4c-57cc-9a6e-0b9dc2d8b2e0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.20_Ensure_the_audit_configuration_is_immutable"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.20"}],"steps":[{"uuid":"ab8f1a03-0653-550d-9c90-3eb395aea97c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.20_Ensure_the_audit_configuration_is_immutable"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-12"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure the audit configuration is immutable","remarks":"In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes.","description":"## Description\n\nSet system audit so that audit rules cannot be modified with `auditctl` . Setting the flag \"-e 2\" forces audit to be put in immutable mode. Audit changes can only be made on system reboot.\n\n**Note:** This setting will require the system to be rebooted to update the active `auditd` configuration settings.\n\n## Audit\n\nRun the following command and verify output matches:\n\n```bash\n# grep -Ph -- '^\\h*-e\\h+2\\b' /etc/audit/rules.d/*.rules | tail -1\n\n-e 2\n```"},{"uuid":"9d0ad9fb-c848-57fc-812c-8aa21cd635fe","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.20_Ensure_the_audit_configuration_is_immutable"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure the audit configuration is immutable","description":"Edit or create the file `/etc/audit/rules.d/99-finalize.rules` and add the line `-e 2` at the end of the file:\n\nExample:\n\n```bash\n# printf '\\n%s' \"-e 2\" >> /etc/audit/rules.d/99-finalize.rules\n```\n\n**Load audit rules**\n\nMerge and load the rules into active configuration:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```"}],"title":"6.2.3.20 Ensure the audit configuration is immutable","description":"Set system audit so that audit rules cannot be modified with `auditctl` . Setting the flag \"-e 2\" forces audit to be put in immutable mode. Audit changes can only be made on system reboot.\n\n**Note:** This setting will require the system to be rebooted to update the active `auditd` configuration settings."},{"uuid":"0c8bbe21-c833-5e5e-bef1-e2f126d35e36","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.3 Configure auditd Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.21_Ensure_the_running_and_on_disk_configuration_is_the_same"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.3.21"}],"steps":[{"uuid":"676b4646-25c6-544a-9ce9-536cc8d68593","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.21_Ensure_the_running_and_on_disk_configuration_is_the_same"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/6/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:6:3"}],"title":"Audit for Ensure the running and on disk configuration is the same","remarks":"Configuration differences between what is currently running and what is on disk could cause unexpected problems or may give a false impression of compliance requirements.","description":"## Description\n\nThe Audit system have both on disk and running configuration. It is possible for these configuration settings to differ.\n\n**Note:** Due to the limitations of `augenrules` and `auditctl`, it is not absolutely guaranteed that loading the rule sets via `augenrules --load` will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules.\n\n## Audit\n\n**Merged rule sets**\n\nEnsure that all rules in `/etc/audit/rules.d` have been merged into `/etc/audit/audit.rules`:\n\n```bash\n# augenrules --check\n\n/usr/sbin/augenrules: No change\n```\n\nShould there be any drift, run `augenrules --load` to merge and load all rules."},{"uuid":"f74ec6ba-4ab6-5863-9e00-e9ce0131b369","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.3.21_Ensure_the_running_and_on_disk_configuration_is_the_same"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure the running and on disk configuration is the same","description":"If the rules are not aligned across all three () areas, run the following command to merge and load all rules:\n\n```bash\n# augenrules --load\n```\n\nCheck if reboot is required.\n\n```bash\nif [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then echo \"Reboot required to load rules\"; fi\n```"}],"title":"6.2.3.21 Ensure the running and on disk configuration is the same","description":"The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ.\n\n**Note:** Due to the limitations of `augenrules` and `auditctl`, it is not absolutely guaranteed that loading the rule sets via `augenrules --load` will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules."},{"uuid":"7c8dbb35-5a8b-5702-bcd9-3385edd925f6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.1_Ensure_audit_log_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.1"}],"steps":[{"uuid":"daf9dc15-148c-57b0-a171-39586ccbbaf9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.1_Ensure_audit_log_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit log files mode is configured","remarks":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.","description":"## Description\n\nAudit log files contain information about the system and system activity.\n\n## Audit\n\nRun the following script to verify audit log files are mode `0640` or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_perm_mask=\"0137\"\n if [ -e \"/etc/audit/auditd.conf\" ]; then\n l_audit_log_directory=\"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n if [ -d \"$l_audit_log_directory\" ]; then\n l_maxperm=\"$(printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n a_files=()\n while IFS= read -r -d $'\\0' l_file; do\n [ -e \"$l_file\" ] && a_files+=(\"$l_file\")\n done 0 )); then\n for l_file in \"${a_files[@]}\"; do\n l_file_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - File: \\\"$l_file\\\" is mode: \\\"$l_file_mode\\\"\\n (should be mode: \\\"$l_maxperm\\\" or more restrictive)\\n\"\n done\n else\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - All files in \\\"$l_audit_log_directory\\\" are mode: \\\"$l_maxperm\\\" or more restrictive\"\n fi\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - Log file directory not set in \\\"/etc/audit/auditd.conf\\\" please set log file directory\"\n fi\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - File: \\\"/etc/audit/auditd.conf\\\" not found.\\n - ** Verify auditd is installed **\"\n fi\n}\n```"},{"uuid":"665539ac-d6ec-5383-9c55-dcd8a1c9fd7c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.1_Ensure_audit_log_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit log files mode is configured","description":"Run the following command to remove more permissive mode than `0640` from audit log files:\n\n```bash\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +\n```"}],"title":"6.2.4.1 Ensure audit log files mode is configured","description":"Audit log files contain information about the system and system activity."},{"uuid":"6b8ff50b-e1c3-57f5-81d1-8768e15cf1ac","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.2_Ensure_audit_log_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.2"}],"steps":[{"uuid":"9ec6677c-4448-5629-b9e3-c5c456ed67b3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.2_Ensure_audit_log_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit log files owner is configured","remarks":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.","description":"## Description\n\nAudit log files contain information about the system and system activity.\n\n## Audit\n\nRun the following script to verify audit log files are owned by the `root` user:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n if [ -e \"/etc/audit/auditd.conf\" ]; then\n l_audit_log_directory=\"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n if [ -d \"$l_audit_log_directory\" ]; then\n while IFS= read -r -d $'\\0' l_file; do\n l_output2=\"$l_output2\\n - File: \\\"$l_file\\\" is owned by user: \\\"$(stat -Lc '%U' \"$l_file\")\\\"\\n (should be owned by user: \\\"root\\\")\\n\"\n done < <(find \"$l_audit_log_directory\" -maxdepth 1 -type f ! -user root -print0)\n else\n l_output2=\"$l_output2\\n - Log file directory not set in \\\"/etc/audit/auditd.conf\\\" please set log file directory\"\n fi\n else\n l_output2=\"$l_output2\\n - File: \\\"/etc/audit/auditd.conf\\\" not found.\\n - ** Verify auditd is installed **\"\n fi\n if [ -z \"$l_output2\" ]; then\n l_output=\"$l_output\\n - All files in \\\"$l_audit_log_directory\\\" are owned by user: \\\"root\\\"\\n\"\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :$l_output\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :$l_output2\\n\"\n fi\n}\n```"},{"uuid":"76420fe6-56c2-5423-bb75-ce90685f9294","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.2_Ensure_audit_log_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit log files owner is configured","description":"Run the following command to configure the audit log files to be owned by the `root` user:\n\n```bash\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f ! -user root -exec chown root {} +\n```"}],"title":"6.2.4.2 Ensure audit log files owner is configured","description":"Audit log files contain information about the system and system activity."},{"uuid":"ea046dbb-c6da-560d-bf3f-b5b4453161a5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.3_Ensure_audit_log_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"owner"}],"steps":[{"uuid":"00adb87c-d98d-5ea8-bee3-eba7bd1fa19b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.3_Ensure_audit_log_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit log files group owner is configured","remarks":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.","description":"## Description\n\nAudit log files contain information about the system and system activity.\n\n## Audit\n\nRun the following command to verify `log_group` parameter is set to either `adm` or `root` in `/etc/audit/auditd.conf`:\n\n```bash\n# grep -Piws -- '^\\h*log_group\\h*=\\h*\\H+\\b' /etc/audit/auditd.conf | grep -Pvi -- '(adm)'\n```\n\nNothing should be returned\n\nUsing the path of the directory containing the audit logs, verify audit log files are owned by the \"root\" or \"adm\" group by running the following script:\n\n```bash\n#!/usr/bin/env bash\n\n{\n if [ -e /etc/audit/auditd.conf ]; then\n l_fpath=\"$(dirname \"$(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)\")\"\n find -L \"$l_fpath\" -not -path \"$l_fpath\"/lost+found -type f \\( ! -group root -a ! -group adm \\) -exec ls -l {} +\n fi\n}\n```\n\nNothing should be returned"},{"uuid":"ce55cc75-9899-5ddf-965e-a67635e580e6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.3_Ensure_audit_log_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit log files group owner is configured","description":"Run the following command to configure the audit log files to be group owned by `adm`:\n\n```bash\n# find $(dirname $(awk -F\"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \\( ! -group adm -a ! -group root \\) -exec chgrp adm {} +\n```\n\nRun the following command to set the `log_group` parameter in the audit configuration file to `log_group = adm`:\n\n```bash\n# sed -ri 's/^\\s*#?\\s*log_group\\s*=\\s*\\S+(\\s*#.*)?.*$/log_group = adm\\1/' /etc/audit/auditd.conf\n```\n\nRun the following command to restart the audit daemon to reload the configuration file:\n\n```bash\n# systemctl restart auditd\n```"}],"title":"owner Ensure audit log files group owner is configured","description":"Audit log files contain information about the system and system activity."},{"uuid":"4fcabcec-3525-5c2f-a3b5-8ee699acfa72","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.4_Ensure_the_audit_log_file_directory_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.4"}],"steps":[{"uuid":"6e4c0539-8a89-5b9e-a162-c1cc00d62d81","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.4_Ensure_the_audit_log_file_directory_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure the audit log file directory mode is configured","remarks":"Audit information includes all information including: audit records, audit settings and audit reports. This information is needed to successfully audit system activity. This information must be protected from unauthorized modification or deletion. If this information were to be compromised, forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.","description":"## Description\n\nThe audit log directory contains audit log files.\n\n## Audit\n\nRun the following script to verify the audit log directory is mode 0750 or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_perm_mask=\"0027\"\n if [ -e \"/etc/audit/auditd.conf\" ]; then\n l_audit_log_directory=\"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n if [ -d \"$l_audit_log_directory\" ]; then\n l_maxperm=\"$(printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n l_directory_mode=\"$(stat -Lc '%#a' \"$l_audit_log_directory\")\"\n if [ $(( $l_directory_mode & $l_perm_mask )) -gt 0 ]; then\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - Directory: \\\"$l_audit_log_directory\\\" is mode: \\\"$l_directory_mode\\\"\\n (should be mode: \\\"$l_maxperm\\\" or more restrictive)\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - Directory: \\\"$l_audit_log_directory\\\" is mode: \\\"$l_directory_mode\\\"\\n (should be mode: \\\"$l_maxperm\\\" or more restrictive)\\n\"\n fi \n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - Log file directory not set in \\\"/etc/audit/auditd.conf\\\" please set log file directory\"\n fi\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - File: \\\"/etc/audit/auditd.conf\\\" not found\\n - ** Verify auditd is installed **\"\n fi\n}\n```"},{"uuid":"e3bb3e53-a617-556f-aa8c-363c436c13b6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.4_Ensure_the_audit_log_file_directory_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure the audit log file directory mode is configured","description":"Run the following command to configure the audit log directory to have a mode of \"0750\" or less permissive:\n\n```bash\n# chmod g-w,o-rwx \"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n```"}],"title":"6.2.4.4 Ensure the audit log file directory mode is configured","description":"The audit log directory contains audit log files."},{"uuid":"3b27cb4f-34be-598e-a167-abf73a579c3f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.5_Ensure_audit_configuration_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.5"}],"steps":[{"uuid":"2a62b666-d6f4-5dd4-bc3c-65a774de9016","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.5_Ensure_audit_configuration_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit configuration files mode is configured","remarks":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident.","description":"## Description\n\nAudit configuration files control auditd and what events are audited.\n\n## Audit\n\nRun the following script to verify that the audit configuration files are mode `0640` or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_perm_mask=\"0137\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n while IFS= read -r -d $'\\0' l_fname; do\n l_mode=$(stat -Lc '%#a' \"$l_fname\")\n if [ $(( \"$l_mode\" & \"$l_perm_mask\" )) -gt 0 ]; then\n l_output2=\"$l_output2\\n - file: \\\"$l_fname\\\" is mode: \\\"$l_mode\\\" (should be mode: \\\"$l_maxperm\\\" or more restrictive)\"\n fi\n done < <(find /etc/audit/ -type f \\( -name \"*.conf\" -o -name '*.rules' \\) -print0)\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - All audit configuration files are mode: \\\"$l_maxperm\\\" or more restrictive\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n$l_output2\"\n fi\n}\n```"},{"uuid":"e748d365-1f0a-50b7-b043-0e2df9108804","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.5_Ensure_audit_configuration_files_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit configuration files mode is configured","description":"Run the following command to remove more permissive mode than `0640` from the audit configuration files:\n\n```bash\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) -exec chmod u-x,g-wx,o-rwx {} +\n```"}],"title":"6.2.4.5 Ensure audit configuration files mode is configured","description":"Audit configuration files control auditd and what events are audited."},{"uuid":"e6256b1b-1f0e-5251-b6dc-33abe4263364","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.6_Ensure_audit_configuration_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.6"}],"steps":[{"uuid":"5b80a6d0-e38e-526d-a4bb-72bceba30011","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.6_Ensure_audit_configuration_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit configuration files owner is configured","remarks":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident.","description":"## Description\n\nAudit configuration files control auditd and what events are audited.\n\n## Audit\n\nRun the following command to verify that the audit configuration files are owned by the root user:\n\n```bash\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -user root\n```\n\nNothing should be returned"},{"uuid":"6c0928c8-18d3-52d5-a78f-8946e7d3ccda","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.6_Ensure_audit_configuration_files_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit configuration files owner is configured","description":"Run the following command to change ownership to `root` user:\n\n```bash\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -user root -exec chown root {} +\n```"}],"title":"6.2.4.6 Ensure audit configuration files owner is configured","description":"Audit configuration files control auditd and what events are audited."},{"uuid":"71a5426c-b7c9-5a80-a15b-13cebe8fe9c6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.7_Ensure_audit_configuration_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"owner"}],"steps":[{"uuid":"cedd8200-800e-5141-bfe8-7a4ad2a708e6","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.7_Ensure_audit_configuration_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit configuration files group owner is configured","remarks":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident.","description":"## Description\n\nAudit configuration files control auditd and what events are audited.\n\n## Audit\n\nRun the following command to verify that the audit configuration files are owned by the group `root`:\n\n```bash\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -group root\n```\n\nNothing should be returned"},{"uuid":"1662b689-8a34-5c24-8b4d-d87b11851866","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.7_Ensure_audit_configuration_files_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit configuration files group owner is configured","description":"Run the following command to change group to `root`:\n\n```bash\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -group root -exec chgrp root {} +\n```"}],"title":"owner Ensure audit configuration files group owner is configured","description":"Audit configuration files control auditd and what events are audited."},{"uuid":"d29bf7ad-1c5b-53ad-b7d9-874351af210d","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.8_Ensure_audit_tools_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.8"}],"steps":[{"uuid":"13cec123-fe3e-5ca9-b899-cc05df4026ae","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.8_Ensure_audit_tools_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit tools mode is configured","remarks":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information.","description":"## Description\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n## Audit\n\nRun the following script to verify the audit tools are mode `0755` or more restrictive:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_perm_mask=\"0022\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_perm_mask )) )\"\n a_audit_tools=(\"/sbin/auditctl\" \"/sbin/aureport\" \"/sbin/ausearch\" \"/sbin/autrace\" \"/sbin/auditd\" \"/sbin/augenrules\")\n for l_audit_tool in \"${a_audit_tools[@]}\"; do\n l_mode=\"$(stat -Lc '%#a' \"$l_audit_tool\")\"\n if [ $(( \"$l_mode\" & \"$l_perm_mask\" )) -gt 0 ]; then\n l_output2=\"$l_output2\\n - Audit tool \\\"$l_audit_tool\\\" is mode: \\\"$l_mode\\\" and should be mode: \\\"$l_maxperm\\\" or more restrictive\"\n else\n l_output=\"$l_output\\n - Audit tool \\\"$l_audit_tool\\\" is correctly configured to mode: \\\"$l_mode\\\"\"\n fi\n done\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :$l_output\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :$l_output2\\n\"\n [ -n \"$l_output\" ] && echo -e \"\\n - * Correctly configured * :\\n$l_output\\n\"\n fi\n unset a_audit_tools\n}\n```"},{"uuid":"94a0b472-0156-5119-be4a-ec0ec91eba49","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.8_Ensure_audit_tools_mode_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit tools mode is configured","description":"Run the following command to remove more permissive mode from the audit tools:\n\n```bash\n# chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"}],"title":"6.2.4.8 Ensure audit tools mode is configured","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"uuid":"6dbe6a83-02b9-5200-8863-1248fc8d4f49","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.9_Ensure_audit_tools_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.2.4.9"}],"steps":[{"uuid":"61aa49f8-5b62-5b36-8076-091e4540e1f1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.9_Ensure_audit_tools_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit tools owner is configured","remarks":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information.","description":"## Description\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n## Audit\n\nRun the following command to verify the audit tools are owned by the `root` user:\n\n```bash\n# stat -Lc \"%n %U\" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules | awk '$2 != \"root\" {print}'\n```\n\nNothing should be returned"},{"uuid":"97bfe326-0982-53cb-809c-2da45919852f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.9_Ensure_audit_tools_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit tools owner is configured","description":"Run the following command to change the owner of the audit tools to the `root` user:\n\n```bash\n# chown root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"}],"title":"6.2.4.9 Ensure audit tools owner is configured","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"uuid":"518977d6-b515-52c3-9bfa-5de48bebac37","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.2 System Auditing > 6.2.4 Configure auditd File Access"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.10_Ensure_audit_tools_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"owner"}],"steps":[{"uuid":"9095a7a1-c43f-5a95-8077-d55429efa90d","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.10_Ensure_audit_tools_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure audit tools group owner is configured","remarks":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information.","description":"## Description\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n## Audit\n\nRun the following command to verify the audit tools are owned by the group `root`\n\n```bash\n# stat -Lc \"%n %G\" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules | awk '$2 != \"root\" {print}'\n```\n\nNothing should be returned"},{"uuid":"93777ce3-b5aa-5c64-902f-d7c9666806ea","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.2.4.10_Ensure_audit_tools_group_owner_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure audit tools group owner is configured","description":"Run the following command to change group ownership to the groop `root`:\n\n```bash\n# chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"}],"title":"owner Ensure audit tools group owner is configured","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"uuid":"528a8293-4eea-5f9f-b996-7cf8eb972a85","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.3 Configure Integrity Checking"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.1_Ensure_AIDE_is_installed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.3.1"}],"steps":[{"uuid":"688242b8-6f50-52f0-b933-657484d51d90","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.1_Ensure_AIDE_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/14"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:14"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:9"}],"title":"Audit for Ensure AIDE is installed","remarks":"By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries.","description":"## Description\n\nAIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system.\n\n## Audit\n\nRun the following command to verify `aide` is installed:\n\n```bash\n# dpkg-query -s aide &>/dev/null && echo \"aide is installed\"\n\naide is installed\n```\n\nRun the following command to verify `aide-common` is installed:\n\n```bash\n# dpkg-query -s aide-common &>/dev/null && echo \"aide-common is installed\"\n\naide-common is installed\n```"},{"uuid":"0101928f-5324-5c35-922d-67c9a5bb24de","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.1_Ensure_AIDE_is_installed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure AIDE is installed","description":"Install AIDE using the appropriate package manager or manual installation:\n\n```bash\n# apt install aide aide-common\n```\n\nConfigure AIDE as appropriate for your environment. Consult the AIDE documentation for options.\n\nRun the following commands to initialize AIDE:\n\n```bash\n# aideinit\n# mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db\n```"}],"title":"6.3.1 Ensure AIDE is installed","description":"AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system."},{"uuid":"925d82c7-e1c7-58ff-8f4d-3db55b2246c8","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.3 Configure Integrity Checking"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.2_Ensure_filesystem_integrity_is_regularly_checked"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.3.2"}],"steps":[{"uuid":"7c78307c-2c1c-5a28-a65d-3e8f00e48f1b","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.2_Ensure_filesystem_integrity_is_regularly_checked"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/9"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/8/subcontrol/5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AU-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:8:5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:9"}],"title":"Audit for Ensure filesystem integrity is regularly checked","remarks":"Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion.","description":"## Description\n\nPeriodic checking of the filesystem integrity is needed to detect changes to the filesystem.\n\n## Audit\n\nRun the following command:\n\n```bash\n# systemctl list-unit-files | awk '$1~/^dailyaidecheck\\.(timer|service)$/{print $1 \"\\t\" $2}'\n```\n\nExample output:\n\n```bash\ndailyaidecheck.service static\ndailyaidecheck.timer enabled\n```\n\nVerify `dailyaidecheck.timer` is `enabled` and `dailyaidecheck.service` is either `static` or `enabled`.\n\nRun the following command to verify `dailyaidecheck.timer` is `active`:\n\n```bash\n# systemctl is-active dailyaidecheck.timer\n\nactive\n```"},{"uuid":"52684ad2-c67b-5f72-b5b3-53fcabd09d75","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.2_Ensure_filesystem_integrity_is_regularly_checked"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure filesystem integrity is regularly checked","description":"Run the following command to unmask `dailyaidecheck.timer` and `dailyaidecheck.service`:\n\n```bash\n# systemctl unmask dailyaidecheck.timer dailyaidecheck.service\n```\n\nRun the following command to enable and start `dailyaidecheck.timer`:\n\n```bash\n# systemctl --now enable dailyaidecheck.timer\n```"}],"title":"6.3.2 Ensure filesystem integrity is regularly checked","description":"Periodic checking of the filesystem integrity is needed to detect changes to the filesystem."},{"uuid":"6dddd9aa-c084-5fc4-addf-c1b2ccccbfa0","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"Logging and Auditing"},{"ns":"https://cisecurity.org/ns","name":"group","value":"6 Logging and Auditing > 6.3 Configure Integrity Checking"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.3_Ensure_cryptographic_mechanisms_are_used_to_protect_the_integrity_of_audit_tools"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"6.3.3"}],"steps":[{"uuid":"d6e65f84-95fe-5c6c-826b-8971f286259f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.3_Ensure_cryptographic_mechanisms_are_used_to_protect_the_integrity_of_audit_tools"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"}],"title":"Audit for Ensure cryptographic mechanisms are used to protect the integrity of audit tools","remarks":"Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nAttackers may replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs.\n\nAudit tools should be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files.","description":"## Description\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n`aide.conf` is case-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line.\n\n`AIDE` uses the backslash character `\\` as escape character for '` `' (space), '@' and '' (backslash) (e.g. '\\ ' or '@'). To literally match a '' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\\\').\n\nThere are three types of lines in `aide.conf`:\n\n- The configuration options which are used to set configuration parameters and define groups.\n- (restricted) rules that are used to indicate which files are added to the database.\n- Macro lines define or undefine variables within the config file.\n\n**Note:** Lines beginning with `#` are ignored as comments.\n\n`@@include` - Include .\n\n- The content of the file is used as if it were inserted in this part of the config file.\n- The maximum depth of nested includes is 16.\n\n`@@include - [RULE_PREFIX] (added in AIDE v0.17)\n\n- Include all (regular) files found in matching regular expression (sub-directories are ignored).\n- The file are included in lexical sort order.\n- If `RULE_PREFIX` is set, all rules included by the statement are prefixed with given (added in AIDE v0.18). Prefixes from nested include statements are concatenated.\n- The content of the files is used as if it were inserted in this part of the config file.\n\n`@x_include`:\n\n- is identical to `@@include`, except that if a config file is executable is is run and the output is used as config.\n- If the executable file exits with status greater than zero or writes to stderr aide stops with an error.\n- For security reasons and each executable config file must be owned by the current user or root. They must not be group- or world-writable.\n- `@@x_include __` (added in AIDE v0.17):\n- `@@x_include [RULE_PREFIX] (added in AIDE v0.17)\n\n`@@x_include_setenv` (added in AIDE v0.17)\n\n- Adds the variable with the value to the environment used for config file execution.\n- Environment variable names are limited to alphanumeric characters (A-Za-z0-9) and the underscore '_' and must not begin with a digit.\n\n## Audit\n\nVerify that Advanced Intrusion Detection Environment (AIDE) is properly configured .\n\nRun the following script to verify:\n\n- AIDE is configured to use cryptographic mechanisms to protect the integrity of audit tools:\n- The following audit tool files include the options \"p, i, n, u, g, s, b, acl, xattrs and sha512\"\n\nauditctl\n- auditd\n- ausearch\n- aureport\n- autrace\n- augenrules\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output=() a_output2=() l_tool_dir=\"$(readlink -f /sbin)\"\n a_items=(\"p\" \"i\" \"n\" \"u\" \"g\" \"s\" \"b\" \"acl\" \"xattrs\" \"sha512\")\n l_aide_cmd=\"$(whereis aide | awk '{print $2}')\"\n a_audit_files=(\"auditctl\" \"auditd\" \"ausearch\" \"aureport\" \"autrace\" \"augenrules\")\n if [ -f \"$l_aide_cmd\" ] && command -v \"$l_aide_cmd\" &>/dev/null; then\n a_aide_conf_files=(\"$(find -L /etc -type f -name 'aide.conf')\")\n f_file_par_chk()\n {\n a_out2=()\n for l_item in \"${a_items[@]}\"; do\n ! grep -Psiq -- '(\\h+|\\+)'\"$l_item\"'(\\h+|\\+)' <<< \"$l_out\" && \\\n a_out2+=(\" - Missing the \\\"$l_item\\\" option\")\n done\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - Audit tool file: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - Audit tool file: \\\"$l_file\\\" includes:\" \" \\\"${a_items[*]}\\\"\")\n fi\n }\n for l_file in \"${a_audit_files[@]}\"; do\n if [ -f \"$l_tool_dir/$l_file\" ]; then\n l_out=\"$(\"$l_aide_cmd\" --config \"${a_aide_conf_files[@]}\" -p f:\"$l_tool_dir/$l_file\")\"\n f_file_par_chk\n else\n a_output+=(\" - Audit tool file \\\"$l_file\\\" doesn't exist\")\n fi\n done\n else\n a_output2+=(\" - The command \\\"aide\\\" was not found\" \" Please install AIDE\")\n fi\n if [ \"${#a_output2[@]}\" -le 0 ]; then\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** PASS **\" \"${a_output[@]}\" \"\"\n else\n printf '%s\\n' \"\" \"- Audit Result:\" \" ** FAIL **\" \" - Reason(s) for audit failure:\" \"${a_output2[@]}\"\n [ \"${#a_output[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"- Correctly set:\" \"${a_output[@]}\" \"\"\n fi\n}\n```\n\n**Note:** The script is written to read the \"winning\" configuration setting, to include any configuration settings in files included as part of the `@@x_include` setting."},{"uuid":"2364fb53-ca1a-5f6f-969e-e713dffd1fc7","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_6.3.3_Ensure_cryptographic_mechanisms_are_used_to_protect_the_integrity_of_audit_tools"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure cryptographic mechanisms are used to protect the integrity of audit tools","description":"Run the following command to determine the absolute path to the non-symlinked version on the audit tools:\n\n```bash\n# readlink -f /sbin\n```\n\nThe output will be either `/usr/sbin` **- OR -** `/sbin`. Ensure the correct path is used.\n\nEdit `/etc/aide/aide.conf` and add or update the following selection lines replacing `` with the correct path returned in the command above:\n\n```bash\n# Audit Tools \n/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 \n/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 \n/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512 \n/aureport p+i+n+u+g+s+b+acl+xattrs+sha512 \n/autrace p+i+n+u+g+s+b+acl+xattrs+sha512 \n/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n```\n\nExample\n\n```bash\n# printf '%s\\n' \"\" \"# Audit Tools\" \"$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/auditd) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/ausearch) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/aureport) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/autrace) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/augenrules) p+i+n+u+g+s+b+acl+xattrs+sha512\" >> /etc/aide/aide.conf\n```\n\n**Note: - IF -** `/etc/aide/aide.conf` includes a `@@x_include` statement:\n\n- and each executable config file must be owned by the current user or root\n- They must not be group or world-writable\n\nExample:\n\n```bash\n@@x_include /etc/aide.conf.d ^[a-zA-Z0-9_-]+$\n```"}],"title":"6.3.3 Ensure cryptographic mechanisms are used to protect the integrity of audit tools","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n`aide.conf` is case-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line.\n\n`AIDE` uses the backslash character `\\` as escape character for '` `' (space), '@' and '' (backslash) (e.g. '\\ ' or '@'). To literally match a '' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\\\').\n\nThere are three types of lines in `aide.conf`:\n\n- The configuration options which are used to set configuration parameters and define groups.\n- (restricted) rules that are used to indicate which files are added to the database.\n- Macro lines define or undefine variables within the config file.\n\n**Note:** Lines beginning with `#` are ignored as comments.\n\n`@@include` - Include .\n\n- The content of the file is used as if it were inserted in this part of the config file.\n- The maximum depth of nested includes is 16.\n\n`@@include - [RULE_PREFIX] (added in AIDE v0.17)\n\n- Include all (regular) files found in matching regular expression (sub-directories are ignored).\n- The file are included in lexical sort order.\n- If `RULE_PREFIX` is set, all rules included by the statement are prefixed with given (added in AIDE v0.18). Prefixes from nested include statements are concatenated.\n- The content of the files is used as if it were inserted in this part of the config file.\n\n`@x_include`:\n\n- is identical to `@@include`, except that if a config file is executable is is run and the output is used as config.\n- If the executable file exits with status greater than zero or writes to stderr aide stops with an error.\n- For security reasons and each executable config file must be owned by the current user or root. They must not be group- or world-writable.\n- `@@x_include __` (added in AIDE v0.17):\n- `@@x_include [RULE_PREFIX] (added in AIDE v0.17)\n\n`@@x_include_setenv` (added in AIDE v0.17)\n\n- Adds the variable with the value to the environment used for config file execution.\n- Environment variable names are limited to alphanumeric characters (A-Za-z0-9) and the underscore '_' and must not begin with a digit."},{"uuid":"5bb44aa4-c43a-5897-8b54-aeeae77f391f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.1_Ensure_permissions_on_etcpasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.1"}],"steps":[{"uuid":"5b78e583-7445-5d0d-bc93-f2b27c600ac3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.1_Ensure_permissions_on_etcpasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/passwd are configured","remarks":"It is critical to ensure that the `/etc/passwd` file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\nThe `/etc/passwd` file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate.\n\n## Audit\n\nRun the following command to verify `/etc/passwd` is mode 644 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/passwd\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"1377cacd-8b18-567a-ab4c-cc04badf3e78","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.1_Ensure_permissions_on_etcpasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/passwd are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd`:\n\n```bash\n# chmod u-x,go-wx /etc/passwd\n# chown root:root /etc/passwd\n```"}],"title":"7.1.1 Ensure permissions on /etc/passwd are configured","description":"The `/etc/passwd` file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate."},{"uuid":"53a8e1aa-2ad2-5574-9e6b-4e90d9a1d401","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.2_Ensure_permissions_on_etcpasswd-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.2"}],"steps":[{"uuid":"79e13634-3ade-529d-8f49-0e27ab437944","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.2_Ensure_permissions_on_etcpasswd-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/passwd- are configured","remarks":"It is critical to ensure that the `/etc/passwd-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\nThe `/etc/passwd-` file contains backup user account information.\n\n## Audit\n\nRun the following command to verify `/etc/passwd-` is mode 644 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: { %g/ %G)' /etc/passwd-\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: { 0/ root)\n```"},{"uuid":"295e57c9-3972-57e5-bcc7-422ed38aa3ee","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.2_Ensure_permissions_on_etcpasswd-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/passwd- are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd-`:\n\n```bash\n# chmod u-x,go-wx /etc/passwd-\n# chown root:root /etc/passwd-\n```"}],"title":"7.1.2 Ensure permissions on /etc/passwd- are configured","description":"The `/etc/passwd-` file contains backup user account information."},{"uuid":"55403e90-cc15-55d9-a392-db002ea6a7be","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.3_Ensure_permissions_on_etcgroup_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.3"}],"steps":[{"uuid":"65aa40b9-f173-5e28-858e-cc9ec7fcc1dd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.3_Ensure_permissions_on_etcgroup_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/group are configured","remarks":"The `/etc/group` file needs to be protected from unauthorized changes by non-privileged users, but needs to be readable as this information is used with many non-privileged programs.","description":"## Description\n\nThe `/etc/group` file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else.\n\n## Audit\n\nRun the following command to verify `/etc/group` is mode 644 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/group\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"cf1ddce4-82d0-57c8-80fd-7f9577f81655","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.3_Ensure_permissions_on_etcgroup_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/group are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group`:\n\n```bash\n# chmod u-x,go-wx /etc/group\n# chown root:root /etc/group\n```"}],"title":"7.1.3 Ensure permissions on /etc/group are configured","description":"The `/etc/group` file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else."},{"uuid":"436e26e9-27ef-57e3-99ac-578fac784309","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.4_Ensure_permissions_on_etcgroup-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.4"}],"steps":[{"uuid":"4bab022a-589a-5008-af28-1ac1e8509658","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.4_Ensure_permissions_on_etcgroup-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/group- are configured","remarks":"It is critical to ensure that the `/etc/group-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\nThe `/etc/group-` file contains a backup list of all the valid groups defined in the system.\n\n## Audit\n\nRun the following command to verify `/etc/group-` is mode 644 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/group-\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"3f32580c-d3c4-5d02-9821-0a91680227d4","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.4_Ensure_permissions_on_etcgroup-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/group- are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group-`:\n\n```bash\n# chmod u-x,go-wx /etc/group-\n# chown root:root /etc/group-\n```"}],"title":"7.1.4 Ensure permissions on /etc/group- are configured","description":"The `/etc/group-` file contains a backup list of all the valid groups defined in the system."},{"uuid":"c7aba024-363d-5796-a936-f0752059b7b5","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.5_Ensure_permissions_on_etcshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.5"}],"steps":[{"uuid":"6109bd4c-6133-5981-aaf5-3772e22295a8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.5_Ensure_permissions_on_etcshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/shadow are configured","remarks":"If attackers can gain read access to the `/etc/shadow` file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the `/etc/shadow` file (such as expiration) could also be useful to subvert the user accounts.","description":"## Description\n\nThe `/etc/shadow` file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information.\n\n## Audit\n\nRun the following command to verify `/etc/shadow` is mode 640 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root` or ({GID}/ shadow):\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/shadow\n```\n\nExample:\n\n```bash\nAccess: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)\n```"},{"uuid":"2cbc0115-3902-5309-9c94-ac07848fa4f3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.5_Ensure_permissions_on_etcshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/shadow are configured","description":"Run **one** of the following commands to set ownership of `/etc/shadow` to `root` and group to either `root` or `shadow`:\n\n```bash\n# chown root:shadow /etc/shadow\n -OR-\n# chown root:root /etc/shadow\n```\n\nRun the following command to remove excess permissions form `/etc/shadow`:\n\n```bash\n# chmod u-x,g-wx,o-rwx /etc/shadow\n```"}],"title":"7.1.5 Ensure permissions on /etc/shadow are configured","description":"The `/etc/shadow` file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."},{"uuid":"1147d9e2-59c9-5d7e-8355-31b5c6312fbc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.6_Ensure_permissions_on_etcshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.6"}],"steps":[{"uuid":"a2f0a5a9-35a4-52bb-9225-9971f8b644fe","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.6_Ensure_permissions_on_etcshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/shadow- are configured","remarks":"It is critical to ensure that the `/etc/shadow-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\nThe `/etc/shadow-` file is used to store backup information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information.\n\n## Audit\n\nRun the following command to verify `/etc/shadow-` is mode 640 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root` or `{GID}/shadow`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/shadow-\n```\n\nExample:\n\n```bash\nAccess: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)\n```"},{"uuid":"cf202a3d-4f32-5a04-bc7b-5eca51ed94cd","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.6_Ensure_permissions_on_etcshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/shadow- are configured","description":"Run **one** of the following commands to set ownership of `/etc/shadow-` to `root` and group to either `root` or `shadow`:\n\n```bash\n# chown root:shadow /etc/shadow-\n -OR-\n# chown root:root /etc/shadow-\n```\n\nRun the following command to remove excess permissions form `/etc/shadow-`:\n\n```bash\n# chmod u-x,g-wx,o-rwx /etc/shadow-\n```"}],"title":"7.1.6 Ensure permissions on /etc/shadow- are configured","description":"The `/etc/shadow-` file is used to store backup information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."},{"uuid":"15f83edb-b89e-502d-aa4e-228a19449afc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.7_Ensure_permissions_on_etcgshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.7"}],"steps":[{"uuid":"84d5b558-5052-5609-a212-da925fba1b8e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.7_Ensure_permissions_on_etcgshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/gshadow are configured","remarks":"If attackers can gain read access to the `/etc/gshadow` file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the `/etc/gshadow` file (such as group administrators) could also be useful to subvert the group.","description":"## Description\n\nThe `/etc/gshadow` file is used to store the information about groups that is critical to the security of those accounts, such as the hashed password and other security information.\n\n## Audit\n\nRun the following command to verify `/etc/gshadow` is mode 640 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root` or `{GID}/shadow:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/gshadow\n```\n\nExample:\n\n```bash\nAccess: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)\n```"},{"uuid":"6b294e71-22d5-512d-9915-dc40983db943","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.7_Ensure_permissions_on_etcgshadow_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/gshadow are configured","description":"Run **one** of the following commands to set ownership of `/etc/gshadow` to `root` and group to either `root` or `shadow`:\n\n```bash\n# chown root:shadow /etc/gshadow\n -OR-\n# chown root:root /etc/gshadow\n```\n\nRun the following command to remove excess permissions form `/etc/gshadow`:\n\n```bash\n# chmod u-x,g-wx,o-rwx /etc/gshadow\n```"}],"title":"7.1.7 Ensure permissions on /etc/gshadow are configured","description":"The `/etc/gshadow` file is used to store the information about groups that is critical to the security of those accounts, such as the hashed password and other security information."},{"uuid":"10195f71-dd55-575a-a899-d2726fbdb18f","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.8_Ensure_permissions_on_etcgshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.8"}],"steps":[{"uuid":"ac3f9387-6e60-5e85-b6b1-363abc468f9f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.8_Ensure_permissions_on_etcgshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/gshadow- are configured","remarks":"It is critical to ensure that the `/etc/gshadow-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\nThe `/etc/gshadow-` file is used to store backup information about groups that is critical to the security of those accounts, such as the hashed password and other security information.\n\n## Audit\n\nRun the following command to verify `/etc/gshadow-` is mode 640 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root` or `{GID}/shadow`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/gshadow-\n```\n\nExample:\n\n```bash\nAccess: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)\n```"},{"uuid":"d908b147-2bb2-551e-b136-4b1a44095e9f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.8_Ensure_permissions_on_etcgshadow-_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/gshadow- are configured","description":"Run **one** of the following commands to set ownership of `/etc/gshadow-` to `root` and group to either `root` or `shadow`:\n\n```bash\n# chown root:shadow /etc/gshadow-\n -OR-\n# chown root:root /etc/gshadow-\n```\n\nRun the following command to remove excess permissions form `/etc/gshadow-`:\n\n```bash\n# chmod u-x,g-wx,o-rwx /etc/gshadow-\n```"}],"title":"7.1.8 Ensure permissions on /etc/gshadow- are configured","description":"The `/etc/gshadow-` file is used to store backup information about groups that is critical to the security of those accounts, such as the hashed password and other security information."},{"uuid":"c7a76866-18cf-5eb3-9083-67829ca783fd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.9_Ensure_permissions_on_etcshells_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.9"}],"steps":[{"uuid":"7db3e420-43dc-5642-9a2b-041b616cfb4f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.9_Ensure_permissions_on_etcshells_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/shells are configured","remarks":"It is critical to ensure that the `/etc/shells` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\n`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs.\n\n## Audit\n\nRun the following command to verify `/etc/shells` is mode 644 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root`:\n\n```bash\n# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/shells\n\nAccess: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)\n```"},{"uuid":"b3bdbda5-1d8f-527f-a710-332ad7ed3798","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.9_Ensure_permissions_on_etcshells_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/shells are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/shells`:\n\n```bash\n# chmod u-x,go-wx /etc/shells\n# chown root:root /etc/shells\n```"}],"title":"7.1.9 Ensure permissions on /etc/shells are configured","description":"`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs."},{"uuid":"d774d26e-2a3c-5a40-981a-4fccf1793fc3","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.10_Ensure_permissions_on_etcsecurityopasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.10"}],"steps":[{"uuid":"af181851-a67c-5fde-b6aa-6f0743fafe0a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.10_Ensure_permissions_on_etcsecurityopasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure permissions on /etc/security/opasswd are configured","remarks":"It is critical to ensure that `/etc/security/opasswd` is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions.","description":"## Description\n\n`/etc/security/opasswd` and it's backup `/etc/security/opasswd.old` hold user's previous passwords if `pam_unix` or `pam_pwhistory` is in use on the system\n\n## Audit\n\nRun the following commands to verify `/etc/security/opasswd` and `/etc/security/opasswd.old` are mode 600 or more restrictive, `Uid` is `0/root` and `Gid` is `0/root` if they exist:\n\n```bash\n# [ -e \"/etc/security/opasswd\" ] && stat -Lc '%n Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/security/opasswd\n\n/etc/security/opasswd Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)\n -OR-\nNothing is returned\n```\n\n```bash\n# [ -e \"/etc/security/opasswd.old\" ] && stat -Lc '%n Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/security/opasswd.old\n\n/etc/security/opasswd.old Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)\n -OR-\nNothing is returned\n```"},{"uuid":"064b824d-2125-5675-bce5-f952cdb28369","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.10_Ensure_permissions_on_etcsecurityopasswd_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure permissions on /etc/security/opasswd are configured","description":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/security/opasswd` and `/etc/security/opasswd.old` is they exist:\n\n```bash\n# [ -e \"/etc/security/opasswd\" ] && chmod u-x,go-rwx /etc/security/opasswd\n# [ -e \"/etc/security/opasswd\" ] && chown root:root /etc/security/opasswd\n# [ -e \"/etc/security/opasswd.old\" ] && chmod u-x,go-rwx /etc/security/opasswd.old\n# [ -e \"/etc/security/opasswd.old\" ] && chown root:root /etc/security/opasswd.old\n```"}],"title":"7.1.10 Ensure permissions on /etc/security/opasswd are configured","description":"`/etc/security/opasswd` and it's backup `/etc/security/opasswd.old` hold user's previous passwords if `pam_unix` or `pam_pwhistory` is in use on the system"},{"uuid":"853824f5-4213-5a0b-bcee-89b116937e78","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.11_Ensure_world_writable_files_and_directories_are_secured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.11"}],"steps":[{"uuid":"7a4aa548-cce4-56a0-a8a5-1d81825c95e0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.11_Ensure_world_writable_files_and_directories_are_secured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure world writable files and directories are secured","remarks":"Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity.\n\nThis feature prevents the ability to delete or rename files in world writable directories (such as `/tmp` ) that are owned by another user.","description":"## Description\n\nWorld writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the `chmod(2)` man page for more information.\n\nSetting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.\n\n## Audit\n\nRun the following script to verify:\n\n- No world writable files exist\n- No world writable directories without the sticky bit exist\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n l_smask='01000'\n a_file=(); a_dir=() # Initialize arrays\n a_path=(! -path \"/run/user/*\" -a ! -path \"/proc/*\" -a ! -path \"*/containerd/*\" -a ! -path \"*/kubelet/pods/*\" -a ! -path \"*/kubelet/plugins/*\" -a ! -path \"/sys/*\" -a ! -path \"/snap/*\")\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n [ -f \"$l_file\" ] && a_file+=(\"$l_file\") # Add WR files\n if [ -d \"$l_file\" ]; then # Add directories w/o sticky bit\n l_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n [ ! $(( $l_mode & $l_smask )) -gt 0 ] && a_dir+=(\"$l_file\")\n fi\n fi\n done /dev/null)\n done 0 )); then\n l_output=\"$l_output\\n - No world writable files exist on the local filesystem.\"\n else\n l_output2=\"$l_output2\\n - There are \\\"$(printf '%s' \"${#a_file[@]}\")\\\" World writable files on the system.\\n - The following is a list of World writable files:\\n$(printf '%s\\n' \"${a_file[@]}\")\\n - end of list\\n\"\n fi\n if ! (( ${#a_dir[@]} > 0 )); then\n l_output=\"$l_output\\n - Sticky bit is set on world writable directories on the local filesystem.\"\n else\n l_output2=\"$l_output2\\n - There are \\\"$(printf '%s' \"${#a_dir[@]}\")\\\" World writable directories without the sticky bit on the system.\\n - The following is a list of World writable directories without the sticky bit:\\n$(printf '%s\\n' \"${a_dir[@]}\")\\n - end of list\\n\"\n fi\n unset a_path; unset a_arr; unset a_file; unset a_dir # Remove arrays\n # If l_output2 is empty, we pass\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\"\n [ -n \"$l_output\" ] && echo -e \"- * Correctly configured * :\\n$l_output\\n\"\n fi\n}\n```\n\n**Note:** On systems with a large number of files and/or directories, this audit may be a long running process"},{"uuid":"b2453b9b-db40-5a13-8726-b56b5739cb67","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.11_Ensure_world_writable_files_and_directories_are_secured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure world writable files and directories are secured","description":"- World Writable Files:\n\nIt is recommended that write access is removed from `other` with the command ( `chmod o-w ` ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file.\n\n- World Writable Directories:\n\nSet the sticky bit on all world writable directories with the command ( `chmod a+t ` )\n\nRun the following script to:\n\n- Remove other write permission from any world writable files\n- Add the sticky bit to all world writable directories\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_smask='01000'\n a_file=(); a_dir=() # Initialize arrays\n a_path=(! -path \"/run/user/*\" -a ! -path \"/proc/*\" -a ! -path \"*/containerd/*\" -a ! -path \"*/kubelet/pods/*\" -a ! -path \"*/kubelet/plugins/*\" -a ! -path \"/sys/*\" -a ! -path \"/snap/*\")\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n l_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n if [ -f \"$l_file\" ]; then # Remove excess permissions from WW files\n echo -e \" - File: \\\"$l_file\\\" is mode: \\\"$l_mode\\\"\\n - removing write permission on \\\"$l_file\\\" from \\\"other\\\"\"\n chmod o-w \"$l_file\"\n fi\n if [ -d \"$l_file\" ]; then # Add sticky bit\n if [ ! $(( $l_mode & $l_smask )) -gt 0 ]; then\n echo -e \" - Directory: \\\"$l_file\\\" is mode: \\\"$l_mode\\\" and doesn't have the sticky bit set\\n - Adding the sticky bit\"\n chmod a+t \"$l_file\"\n fi\n fi\n fi\n done /dev/null)\n done < <(findmnt -Dkerno fstype,target | awk '($1 !~ /^\\s*(nfs|proc|smb|vfat|iso9660|efivarfs|selinuxfs)/ && $2 !~ /^(\\/run\\/user\\/|\\/tmp|\\/var\\/tmp)/){print $2}') \n}\n```"}],"title":"7.1.11 Ensure world writable files and directories are secured","description":"World writable files are the least secure. Data in world-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the `chmod(2)` man page for more information.\n\nSetting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them."},{"uuid":"6794516b-777f-5591-a558-17850e518485","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.12_Ensure_no_files_or_directories_without_an_owner_and_a_group_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"exist"}],"steps":[{"uuid":"46b55699-a071-5c07-8dfb-78b0fc10cdf5","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.12_Ensure_no_files_or_directories_without_an_owner_and_a_group_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure no files or directories without an owner and a group exist","remarks":"A new user or group who is assigned a deleted user's user ID or group ID may then end up \"owning\" a deleted user or group's files, and thus have more access on the system than was intended.","description":"## Description\n\nAdministrators may delete users or groups from the system and neglect to remove all files and/or directories owned by those users or groups.\n\n## Audit\n\nRun the following script to verify no unowned or ungrouped files or directories exist:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n a_nouser=(); a_nogroup=() # Initialize arrays\n a_path=(! -path \"/run/user/*\" -a ! -path \"/proc/*\" -a ! -path \"*/containerd/*\" -a ! -path \"*/kubelet/pods/*\" -a ! -path \"*/kubelet/plugins/*\" -a ! -path \"/sys/fs/cgroup/memory/*\" -a ! -path \"/var/*/private/*\")\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n while IFS=: read -r l_user l_group; do\n [ \"$l_user\" = \"UNKNOWN\" ] && a_nouser+=(\"$l_file\")\n [ \"$l_group\" = \"UNKNOWN\" ] && a_nogroup+=(\"$l_file\")\n done /dev/null)\n done 0 )); then\n l_output=\"$l_output\\n - No files or directories without a owner exist on the local filesystem.\"\n else\n l_output2=\"$l_output2\\n - There are \\\"$(printf '%s' \"${#a_nouser[@]}\")\\\" unowned files or directories on the system.\\n - The following is a list of unowned files and/or directories:\\n$(printf '%s\\n' \"${a_nouser[@]}\")\\n - end of list\"\n fi\n if ! (( ${#a_nogroup[@]} > 0 )); then\n l_output=\"$l_output\\n - No files or directories without a group exist on the local filesystem.\"\n else\n l_output2=\"$l_output2\\n - There are \\\"$(printf '%s' \"${#a_nogroup[@]}\")\\\" ungrouped files or directories on the system.\\n - The following is a list of ungrouped files and/or directories:\\n$(printf '%s\\n' \"${a_nogroup[@]}\")\\n - end of list\"\n fi \n unset a_path; unset a_arr ; unset a_nouser; unset a_nogroup # Remove arrays\n if [ -z \"$l_output2\" ]; then # If l_output2 is empty, we pass\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\"\n [ -n \"$l_output\" ] && echo -e \"\\n- * Correctly configured * :\\n$l_output\\n\"\n fi\n}\n```\n\n**Note:** On systems with a large number of files and/or directories, this audit may be a long running process"},{"uuid":"72e617e1-be93-5c58-ac48-34ba9a047705","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.12_Ensure_no_files_or_directories_without_an_owner_and_a_group_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure no files or directories without an owner and a group exist","description":"Remove or set ownership and group ownership of these files and/or directories to an active user on the system as appropriate."}],"title":"exist Ensure no files or directories without an owner and a group exist","description":"Administrators may delete users or groups from the system and neglect to remove all files and/or directories owned by those users or groups."},{"uuid":"3025db18-3076-5c84-82c1-53f6ff784126","props":[{"name":"method","value":"EXAMINE"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.1 System File Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.13_Ensure_SUID_and_SGID_files_are_reviewed"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.1.13"}],"steps":[{"uuid":"2c868967-0744-5765-858b-802f890d2604","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.13_Ensure_SUID_and_SGID_files_are_reviewed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"AC-3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"MP-2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure SUID and SGID files are reviewed","remarks":"There are valid reasons for SUID and SGID programs, but it is important to identify and review such programs to ensure they are legitimate. Review the files returned by the action in the audit section and check to see if system binaries have a different checksum than what from the package. This is an indication that the binary may have been replaced.","description":"## Description\n\nThe owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SUID or SGID program is to enable users to perform functions (such as changing their password) that require root privileges.\n\n## Audit\n\nRun the following script to generate a list of SUID and SGID files:\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\"\n a_suid=(); a_sgid=() # initialize arrays\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n l_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n [ $(( $l_mode & 04000 )) -gt 0 ] && a_suid+=(\"$l_file\")\n [ $(( $l_mode & 02000 )) -gt 0 ] && a_sgid+=(\"$l_file\")\n fi\n done /dev/null)\n done 0 )); then\n l_output=\"$l_output\\n - No executable SUID files exist on the system\"\n else\n l_output2=\"$l_output2\\n - List of \\\"$(printf '%s' \"${#a_suid[@]}\")\\\" SUID executable files:\\n$(printf '%s\\n' \"${a_suid[@]}\")\\n - end of list -\\n\"\n fi\n if ! (( ${#a_sgid[@]} > 0 )); then\n l_output=\"$l_output\\n - No SGID files exist on the system\"\n else\n l_output2=\"$l_output2\\n - List of \\\"$(printf '%s' \"${#a_sgid[@]}\")\\\" SGID executable files:\\n$(printf '%s\\n' \"${a_sgid[@]}\")\\n - end of list -\\n\"\n fi\n [ -n \"$l_output2\" ] && l_output2=\"$l_output2\\n- Review the preceding list(s) of SUID and/or SGID files to\\n- ensure that no rogue programs have been introduced onto the system.\\n\" \n unset a_arr; unset a_suid; unset a_sgid # Remove arrays\n # If l_output2 is empty, Nothing to report\n if [ -z \"$l_output2\" ]; then\n echo -e \"\\n- Audit Result:\\n$l_output\\n\"\n else\n echo -e \"\\n- Audit Result:\\n$l_output2\\n\"\n [ -n \"$l_output\" ] && echo -e \"$l_output\\n\"\n fi\n}\n```\n\n**Note:** on systems with a large number of files, this may be a long running process"},{"uuid":"407aa0fe-b764-5231-a784-12e6b1d6e642","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"manual"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.1.13_Ensure_SUID_and_SGID_files_are_reviewed"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure SUID and SGID files are reviewed","description":"Ensure that no rogue SUID or SGID programs have been introduced into the system. Review the files returned by the action in the Audit section and confirm the integrity of these binaries."}],"title":"7.1.13 Ensure SUID and SGID files are reviewed","description":"The owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SUID or SGID program is to enable users to perform functions (such as changing their password) that require root privileges."},{"uuid":"4f12f77f-0dc7-54c1-9d84-31eb5784d2f6","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.1_Ensure_accounts_in_etcpasswd_use_shadowed_passwords"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.1"}],"steps":[{"uuid":"f54a685f-50b3-5381-88e3-834c1d9aff87","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.1_Ensure_accounts_in_etcpasswd_use_shadowed_passwords"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/16/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/11"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:11"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:16:4"}],"title":"Audit for Ensure accounts in /etc/passwd use shadowed passwords","remarks":"The `/etc/passwd` file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the `/etc/passwd` file must remain world readable. In spite of encoding the password with a randomly-generated one-way hash function, an attacker could still break the system if they got access to the `/etc/passwd` file. This can be mitigated by using shadowed passwords, thus moving the passwords in the `/etc/passwd` file to `/etc/shadow`. The `/etc/shadow` file is set so only root will be able to read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords with which to perform a dictionary attack.\n\n**Note:**\n\n- All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.\n- A user account with an empty second field in `/etc/passwd` allows the account to be logged into by providing only the username.","description":"## Description\n\nLocal accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, `/etc/shadow`, encrypted by a salted one-way hash. Accounts with a shadowed password have an `x` in the second field in `/etc/passwd`.\n\n## Audit\n\nRun the following command and verify that no output is returned:\n\n```bash\n# awk -F: '($2 != \"x\" ) { print \"User: \\\"\" $1 \"\\\" is not set to shadowed passwords \"}' /etc/passwd\n```"},{"uuid":"ea5ad9cf-c935-5b63-906b-991313d3fa0e","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.1_Ensure_accounts_in_etcpasswd_use_shadowed_passwords"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure accounts in /etc/passwd use shadowed passwords","description":"Run the following command to set accounts to use shadowed passwords and migrate passwords in `/etc/passwd` to `/etc/shadow`:\n\n```bash\n# pwconv\n```\n\nInvestigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off."}],"title":"7.2.1 Ensure accounts in /etc/passwd use shadowed passwords","description":"Local accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, `/etc/shadow`, encrypted by a salted one-way hash. Accounts with a shadowed password have an `x` in the second field in `/etc/passwd`."},{"uuid":"1e2a5ad9-506c-5f51-a7b0-edb595ebef61","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.2_Ensure_etcshadow_password_fields_are_not_empty"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.2"}],"steps":[{"uuid":"a1b18d9b-86fe-5153-9180-da452ecc3ee3","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.2_Ensure_etcshadow_password_fields_are_not_empty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/4/subcontrol/4"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/5/subcontrol/2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:5:2"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:4:4"}],"title":"Audit for Ensure /etc/shadow password fields are not empty","remarks":"All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.","description":"## Description\n\nAn account with an empty password field means that anybody may log in as that user without providing a password.\n\n## Audit\n\nRun the following command and verify that no output is returned:\n\n```bash\n# awk -F: '($2 == \"\" ) { print $1 \" does not have a password \"}' /etc/shadow\n```"},{"uuid":"32b5b96c-488b-51c3-a843-e0987f021d56","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.2_Ensure_etcshadow_password_fields_are_not_empty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure /etc/shadow password fields are not empty","description":"If any accounts in the `/etc/shadow` file do not have a password, run the following command to lock the account until it can be determined why it does not have a password:\n\n```bash\n# passwd -l\n```\n\nAlso, check to see if the account is logged in and investigate what it is being used for to determine if it needs to be forced off."}],"title":"7.2.2 Ensure /etc/shadow password fields are not empty","description":"An account with an empty password field means that anybody may log in as that user without providing a password."},{"uuid":"a16d353e-bff6-586d-9049-22e5a8ca5035","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.3_Ensure_all_groups_in_etcpasswd_exist_in_etcgroup"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.3"}],"steps":[{"uuid":"c095a6b4-5ebb-5b91-a110-effc3cf3f672","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.3_Ensure_all_groups_in_etcpasswd_exist_in_etcgroup"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:14:6"}],"title":"Audit for Ensure all groups in /etc/passwd exist in /etc/group","remarks":"Groups defined in the `/etc/passwd` file but not in the `/etc/group` file pose a threat to system security since group permissions are not properly managed.","description":"## Description\n\nOver time, system administration errors and changes can lead to groups being defined in `/etc/passwd` but not in `/etc/group` .\n\n## Audit\n\nRun the following script to verify all GIDs in `/etc/passwd` exist in `/etc/group`:\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_passwd_group_gid=(\"$(awk -F: '{print $4}' /etc/passwd | sort -u)\")\n a_group_gid=(\"$(awk -F: '{print $3}' /etc/group | sort -u)\")\n a_passwd_group_diff=(\"$(printf '%s\\n' \"${a_group_gid[@]}\" \"${a_passwd_group_gid[@]}\" | sort | uniq -u)\")\n while IFS= read -r l_gid; do\n awk -F: '($4 == '\"$l_gid\"') {print \" - User: \\\"\" $1 \"\\\" has GID: \\\"\" $4 \"\\\" which does not exist in /etc/group\" }' /etc/passwd\n done < <(printf '%s\\n' \"${a_passwd_group_gid[@]}\" \"${a_passwd_group_diff[@]}\" | sort | uniq -D | uniq)\n unset a_passwd_group_gid; unset a_group_gid; unset a_passwd_group_diff\n}\n```\n\nNothing should be returned"},{"uuid":"56cdd94f-5133-53e1-a6a6-f1b2ba7bd6c1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.3_Ensure_all_groups_in_etcpasswd_exist_in_etcgroup"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure all groups in /etc/passwd exist in /etc/group","description":"Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found."}],"title":"7.2.3 Ensure all groups in /etc/passwd exist in /etc/group","description":"Over time, system administration errors and changes can lead to groups being defined in `/etc/passwd` but not in `/etc/group` ."},{"uuid":"3809f16f-bbb5-5197-a939-4fb0c1a61041","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.4_Ensure_shadow_group_is_empty"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"is"}],"steps":[{"uuid":"5fb54ad6-2dfd-5ce2-ab98-61c407f61168","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.4_Ensure_shadow_group_is_empty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure shadow group is empty","remarks":"Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the `/etc/shadow` file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the `/etc/shadow` file (such as expiration) could also be useful to subvert additional user accounts.","description":"## Description\n\nThe shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group.\n\n## Audit\n\nRun the following commands and verify no results are returned:\n\n```bash\n# awk -F: '($1==\"shadow\") {print $NF}' /etc/group\n# awk -F: '($4 == '\"$(getent group shadow | awk -F: '{print $3}' | xargs)\"') {print \" - user: \\\"\" $1 \"\\\" primary group is the shadow group\"}' /etc/passwd\n```"},{"uuid":"17bd4d3f-85b4-5719-85b4-5f97a3135d9c","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.4_Ensure_shadow_group_is_empty"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure shadow group is empty","description":"Run the following command to remove all users from the shadow group\n\n```bash\n# sed -ri 's/(^shadow:[^:]*:[^:]*:)([^:]+$)/\\1/' /etc/group\n```\n\nChange the primary group of any users with shadow as their primary group.\n\n```bash\n# usermod -g\n```"}],"title":"is Ensure shadow group is empty","description":"The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group."},{"uuid":"434e4ceb-cbeb-5634-9aec-d72297dbe51e","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.5_Ensure_no_duplicate_UIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.5"}],"steps":[{"uuid":"1a1be620-eff7-50c2-9431-3a37449f01d0","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.5_Ensure_no_duplicate_UIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure no duplicate UIDs exist","remarks":"Users must be assigned unique UIDs for accountability and to ensure appropriate access protections.","description":"## Description\n\nAlthough the `useradd` program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the `/etc/passwd` file and change the UID field.\n\n## Audit\n\nRun the following script and verify no results are returned:\n\n```bash\n#!/usr/bin/env bash\n\n{\n while read -r l_count l_uid; do\n if [ \"$l_count\" -gt 1 ]; then\n echo -e \"Duplicate UID: \\\"$l_uid\\\" Users: \\\"$(awk -F: '($3 == n) { print $1 }' n=$l_uid /etc/passwd | xargs)\\\"\"\n fi\n done < <(cut -f3 -d\":\" /etc/passwd | sort -n | uniq -c)\n}\n```"},{"uuid":"d40ec8e4-8e56-5639-be06-56f8d2cdaa4a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.5_Ensure_no_duplicate_UIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure no duplicate UIDs exist","description":"Based on the results of the audit script, establish unique UIDs and review all files owned by the shared UIDs to determine which UID they are supposed to belong to."}],"title":"7.2.5 Ensure no duplicate UIDs exist","description":"Although the `useradd` program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the `/etc/passwd` file and change the UID field."},{"uuid":"ee4e0305-3e03-5a78-bbc0-84a6334b2c40","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.6_Ensure_no_duplicate_GIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.6"}],"steps":[{"uuid":"643850ad-e889-50ba-a2be-20d508f5a2ff","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.6_Ensure_no_duplicate_GIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure no duplicate GIDs exist","remarks":"User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections.","description":"## Description\n\nAlthough the `groupadd` program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the `/etc/group` file and change the GID field.\n\n## Audit\n\nRun the following script and verify no results are returned:\n\n```bash\n#!/usr/bin/env bash\n\n{\n while read -r l_count l_gid; do\n if [ \"$l_count\" -gt 1 ]; then\n echo -e \"Duplicate GID: \\\"$l_gid\\\" Groups: \\\"$(awk -F: '($3 == n) { print $1 }' n=$l_gid /etc/group | xargs)\\\"\"\n fi\n done < <(cut -f3 -d\":\" /etc/group | sort -n | uniq -c)\n}\n```"},{"uuid":"b151e004-b084-5e3b-993b-7ff9a8589bea","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.6_Ensure_no_duplicate_GIDs_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure no duplicate GIDs exist","description":"Based on the results of the audit script, establish unique GIDs and review all files owned by the shared GID to determine which group they are supposed to belong to."}],"title":"7.2.6 Ensure no duplicate GIDs exist","description":"Although the `groupadd` program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the `/etc/group` file and change the GID field."},{"uuid":"7860759d-3b5c-5aa8-b969-37a2263e40fd","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.7_Ensure_no_duplicate_user_names_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.7"}],"steps":[{"uuid":"9854c16d-2fab-5548-b3de-12c572261009","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.7_Ensure_no_duplicate_user_names_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure no duplicate user names exist","remarks":"If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in `/etc/passwd` . For example, if \"test4\" has a UID of 1000 and a subsequent \"test4\" entry has a UID of 2000, logging in as \"test4\" will use UID 1000. Effectively, the UID is shared, which is a security problem.","description":"## Description\n\nAlthough the `useradd` program will not let you create a duplicate user name, it is possible for an administrator to manually edit the `/etc/passwd` file and change the user name.\n\n## Audit\n\nRun the following script and verify no results are returned:\n\n```bash\n#!/usr/bin/env bash\n\n{\n while read -r l_count l_user; do\n if [ \"$l_count\" -gt 1 ]; then\n echo -e \"Duplicate User: \\\"$l_user\\\" Users: \\\"$(awk -F: '($1 == n) { print $1 }' n=$l_user /etc/passwd | xargs)\\\"\"\n fi\n done < <(cut -f1 -d\":\" /etc/group | sort -n | uniq -c)\n}\n```"},{"uuid":"e95c879f-33d1-5235-9260-7df1d3d49fb1","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.7_Ensure_no_duplicate_user_names_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure no duplicate user names exist","description":"Based on the results of the audit script, establish unique user names for the users. File ownerships will automatically reflect the change as long as the users have unique UIDs."}],"title":"7.2.7 Ensure no duplicate user names exist","description":"Although the `useradd` program will not let you create a duplicate user name, it is possible for an administrator to manually edit the `/etc/passwd` file and change the user name."},{"uuid":"c741713b-7362-5599-8978-0f29fe8340fc","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.8_Ensure_no_duplicate_group_names_exist"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"names"}],"steps":[{"uuid":"1e2c503c-44ae-5b17-9cb7-b36736cfb3e9","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.8_Ensure_no_duplicate_group_names_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"}],"title":"Audit for Ensure no duplicate group names exist","remarks":"If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in `/etc/group` . Effectively, the GID is shared, which is a security problem.","description":"## Description\n\nAlthough the `groupadd` program will not let you create a duplicate group name, it is possible for an administrator to manually edit the `/etc/group` file and change the group name.\n\n## Audit\n\nRun the following script and verify no results are returned:\n\n```bash\n#!/usr/bin/env bash\n\n{\n while read -r l_count l_group; do\n if [ \"$l_count\" -gt 1 ]; then\n echo -e \"Duplicate Group: \\\"$l_group\\\" Groups: \\\"$(awk -F: '($1 == n) { print $1 }' n=$l_group /etc/group | xargs)\\\"\"\n fi\n done < <(cut -f1 -d\":\" /etc/group | sort -n | uniq -c)\n}\n```"},{"uuid":"150f7418-8994-57a9-9f31-302b8fda5d0f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.8_Ensure_no_duplicate_group_names_exist"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure no duplicate group names exist","description":"Based on the results of the audit script, establish unique names for the user groups. File group ownerships will automatically reflect the change as long as the groups have unique GIDs."}],"title":"names Ensure no duplicate group names exist","description":"Although the `groupadd` program will not let you create a duplicate group name, it is possible for an administrator to manually edit the `/etc/group` file and change the group name."},{"uuid":"ac52d534-43a2-52c5-9c35-cb9d1c599450","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.9_Ensure_local_interactive_user_home_directories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.9"}],"steps":[{"uuid":"d05e82b7-0aa7-5c81-ad30-7b831b1fe73f","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.9_Ensure_local_interactive_user_home_directories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure local interactive user home directories are configured","remarks":"Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory. Group or world-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges. If the user's home directory does not exist or is unassigned, the user will be placed in \"/\" and will not be able to write any files or have local environment variables set.","description":"## Description\n\nThe user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in `/etc/passwd` without a home directory or with a home directory that does not actually exist.\n\n## Audit\n\nRun the following script to Ensure:\n\n- local interactive user home directories exist\n- Ensure local interactive users own their home directories\n- Ensure local interactive user home directories are mode 750 or more restrictive\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_heout2=\"\" l_hoout2=\"\" l_haout2=\"\"\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n unset a_uarr && a_uarr=() # Clear and initialize array\n while read -r l_epu l_eph; do # Populate array with users and user home location\n a_uarr+=(\"$l_epu $l_eph\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_uarr[@]}\" # Here if we want to look at number of users before proceeding \n [ \"$l_asize \" -gt \"10000\" ] && echo -e \"\\n ** INFO **\\n - \\\"$l_asize\\\" Local interactive users found on the system\\n - This may be a long running check\\n\"\n while read -r l_user l_home; do\n if [ -d \"$l_home\" ]; then\n l_mask='0027'\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n while read -r l_own l_mode; do\n [ \"$l_user\" != \"$l_own\" ] && l_hoout2=\"$l_hoout2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is owned by: \\\"$l_own\\\"\"\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n l_haout2=\"$l_haout2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is mode: \\\"$l_mode\\\" should be mode: \\\"$l_max\\\" or more restrictive\"\n fi\n done <<< \"$(stat -Lc '%U %#a' \"$l_home\")\"\n else\n l_heout2=\"$l_heout2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" Doesn't exist\"\n fi\n done <<< \"$(printf '%s\\n' \"${a_uarr[@]}\")\"\n [ -z \"$l_heout2\" ] && l_output=\"$l_output\\n - home directories exist\" || l_output2=\"$l_output2$l_heout2\"\n [ -z \"$l_hoout2\" ] && l_output=\"$l_output\\n - own their home directory\" || l_output2=\"$l_output2$l_hoout2\"\n [ -z \"$l_haout2\" ] && l_output=\"$l_output\\n - home directories are mode: \\\"$l_max\\\" or more restrictive\" || l_output2=\"$l_output2$l_haout2\"\n [ -n \"$l_output\" ] && l_output=\" - All local interactive users:$l_output\"\n if [ -z \"$l_output2\" ]; then # If l_output2 is empty, we pass\n echo -e \"\\n- Audit Result:\\n ** PASS **\\n - * Correctly configured * :\\n$l_output\"\n else\n echo -e \"\\n- Audit Result:\\n ** FAIL **\\n - * Reasons for audit failure * :\\n$l_output2\"\n [ -n \"$l_output\" ] && echo -e \"\\n- * Correctly configured * :\\n$l_output\"\n fi\n}\n```"},{"uuid":"446eab24-9dee-5eed-8bb7-1b1b8ee1872a","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.9_Ensure_local_interactive_user_home_directories_are_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure local interactive user home directories are configured","description":"If a local interactive users' home directory is undefined and/or doesn't exist, follow local site policy and perform one of the following:\n\n- Lock the user account\n- Remove the user from the system\n- create a directory for the user. If undefined, edit `/etc/passwd` and add the absolute path to the directory to the last field of the user.\n\nRun the following script to:\n\n- Remove excessive permissions from local interactive users home directories\n- Update the home directory's owner\n\n```bash\n#!/usr/bin/env bash\n\n{\n l_output2=\"\"\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n unset a_uarr && a_uarr=() # Clear and initialize array\n while read -r l_epu l_eph; do # Populate array with users and user home location\n a_uarr+=(\"$l_epu $l_eph\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_uarr[@]}\" # Here if we want to look at number of users before proceeding \n [ \"$l_asize \" -gt \"10000\" ] && echo -e \"\\n ** INFO **\\n - \\\"$l_asize\\\" Local interactive users found on the system\\n - This may be a long running process\\n\"\n while read -r l_user l_home; do\n if [ -d \"$l_home\" ]; then\n l_mask='0027'\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n while read -r l_own l_mode; do\n if [ \"$l_user\" != \"$l_own\" ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is owned by: \\\"$l_own\\\"\\n - changing ownership to: \\\"$l_user\\\"\\n\"\n chown \"$l_user\" \"$l_home\"\n fi\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is mode: \\\"$l_mode\\\" should be mode: \\\"$l_max\\\" or more restrictive\\n - removing excess permissions\\n\"\n chmod g-w,o-rwx \"$l_home\"\n fi\n done <<< \"$(stat -Lc '%U %#a' \"$l_home\")\"\n else\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" Doesn't exist\\n - Please create a home in accordance with local site policy\"\n fi\n done <<< \"$(printf '%s\\n' \"${a_uarr[@]}\")\"\n if [ -z \"$l_output2\" ]; then # If l_output2 is empty, we pass\n echo -e \" - No modification needed to local interactive users home directories\"\n else\n echo -e \"\\n$l_output2\"\n fi\n}\n```"}],"title":"7.2.9 Ensure local interactive user home directories are configured","description":"The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in `/etc/passwd` without a home directory or with a home directory that does not actually exist."},{"uuid":"993d6513-9c65-5587-9de4-6db93b3eb9d1","props":[{"name":"method","value":"TEST"},{"ns":"https://cisecurity.org/ns","name":"category","value":"System Maintenance"},{"ns":"https://cisecurity.org/ns","name":"group","value":"7 System Maintenance > 7.2 Local User and Group Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.10_Ensure_local_interactive_user_dot_files_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-number","value":"7.2.10"}],"steps":[{"uuid":"9b1117b4-0e4a-58ed-b69d-8e4d5dfc7353","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.10_Ensure_local_interactive_user_dot_files_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"audit"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v7.0/control/14/subcontrol/6"},{"ns":"https://cisecurity.org/ns","name":"cis-control-uri","value":"http://cisecurity.org/20-cc/v8.0/control/3/subcontrol/3"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-1"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-2"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-6"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"CM-7"},{"ns":"https://cisecurity.org/ns","name":"nist-control","value":"IA-5"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:8.0:3:3"},{"ns":"https://cisecurity.org/ns","name":"cis-safeguard-urn","value":"urn:cisecurity.org:controls:7.0:14:6"}],"title":"Audit for Ensure local interactive user dot files access is configured","remarks":"User configuration files with excessive or incorrect access may enable malicious users to steal or modify other users' data or to gain another user's system privileges.","description":"## Description\n\nWhile the system administrator can establish secure permissions for users' \"dot\" files, the users can easily override these.\n\n- `.forward` file specifies an email address to forward the user's mail to.\n- `.rhost` file provides the \"remote authentication\" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)\n- `.netrc` file contains data for logging into a remote host or passing authentication to an API.\n- `.bash_history` file keeps track of the user’s commands.\n\n## Audit\n\nRun the following script to verify local interactive user dot files:\n\n- Don't include `.forward`, `.rhost`, or `.netrc` files\n- Are mode 0644 or more restrictive\n- Are owned by the local interactive user\n- Are group owned by the user's primary group\n- `.bash_history` is mode 0600 or more restrictive\n\n**Note:** If a `.netrc` file is required, and follows local site policy, it should be mode `0600` or more restrictive.\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=()\n l_maxsize=\"1000\" # Maximum number of local interactive users before warning (Default 1,000)\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n a_user_and_home=() # Create array with local users and their home directories\n while read -r l_local_user l_local_user_home; do # Populate array with users and user home location\n [[ -n \"$l_local_user\" && -n \"$l_local_user_home\" ]] && a_user_and_home+=(\"$l_local_user:$l_local_user_home\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_user_and_home[@]}\" # Here if we want to look at number of users before proceeding \n [ \"${#a_user_and_home[@]}\" -gt \"$l_maxsize\" ] && printf '%s\\n' \"\" \" ** INFO **\" \\\n \" - \\\"$l_asize\\\" Local interactive users found on the system\" \\\n \" - This may be a long running check\" \"\"\n file_access_chk()\n {\n a_access_out=()\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n a_access_out+=(\" - File: \\\"$l_hdfile\\\" is mode: \\\"$l_mode\\\" and should be mode: \\\"$l_max\\\" or more restrictive\")\n fi\n if [[ ! \"$l_owner\" =~ ($l_user) ]]; then\n a_access_out+=(\" - File: \\\"$l_hdfile\\\" owned by: \\\"$l_owner\\\" and should be owned by \\\"${l_user//|/ or }\\\"\")\n fi\n if [[ ! \"$l_gowner\" =~ ($l_group) ]]; then\n a_access_out+=(\" - File: \\\"$l_hdfile\\\" group owned by: \\\"$l_gowner\\\" and should be group owned by \\\"${l_group//|/ or }\\\"\")\n fi\n }\n while IFS=: read -r l_user l_home; do\n a_dot_file=(); a_netrc=(); a_netrc_warn=(); a_bhout=(); a_hdirout=()\n if [ -d \"$l_home\" ]; then\n l_group=\"$(id -gn \"$l_user\" | xargs)\";l_group=\"${l_group// /|}\"\n while IFS= read -r -d $'\\0' l_hdfile; do\n while read -r l_mode l_owner l_gowner; do\n case \"$(basename \"$l_hdfile\")\" in\n .forward | .rhost )\n a_dot_file+=(\" - File: \\\"$l_hdfile\\\" exists\") ;;\n .netrc )\n l_mask='0177'; file_access_chk\n if [ \"${#a_access_out[@]}\" -gt 0 ]; then\n a_netrc+=(\"${a_access_out[@]}\")\n else\n a_netrc_warn+=(\" - File: \\\"$l_hdfile\\\" exists\")\n fi ;;\n .bash_history )\n l_mask='0177'; file_access_chk\n [ \"${#a_access_out[@]}\" -gt 0 ] && a_bhout+=(\"${a_access_out[@]}\") ;;\n * )\n l_mask='0133'; file_access_chk\n [ \"${#a_access_out[@]}\" -gt 0 ] && a_hdirout+=(\"${a_access_out[@]}\") ;;\n esac\n done < <(stat -Lc '%#a %U %G' \"$l_hdfile\")\n done < <(find \"$l_home\" -xdev -type f -name '.*' -print0)\n fi\n if [[ \"${#a_dot_file[@]}\" -gt 0 || \"${#a_netrc[@]}\" -gt 0 || \"${#a_bhout[@]}\" -gt 0 || \"${#a_hdirout[@]}\" -gt 0 ]]; then\n a_output2+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_dot_file[@]}\" \"${a_netrc[@]}\" \"${a_bhout[@]}\" \"${a_hdirout[@]}\")\n fi\n [ \"${#a_netrc_warn[@]}\" -gt 0 ] && a_output3+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_netrc_warn[@]}\")\n done <<< \"$(printf '%s\\n' \"${a_user_and_home[@]}\")\"\n if [ \"${#a_output2[@]}\" -le 0 ]; then # If l_output2 is empty, we pass\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \" ** WARNING **\" \"${a_output3[@]}\"\n printf '%s\\n' \"- Audit Result:\" \" ** PASS **\"\n else\n printf '%s\\n' \"- Audit Result:\" \" ** FAIL **\" \" - * Reasons for audit failure * :\" \"${a_output2[@]}\" \"\"\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \" ** WARNING **\" \"${a_output3[@]}\"\n fi\n}\n```"},{"uuid":"f916f1ac-a592-551f-add3-1adcdf898bd8","props":[{"ns":"https://cisecurity.org/ns","name":"assessment-status","value":"automated"},{"ns":"https://cisecurity.org/ns","name":"cis-rule-id","value":"xccdf_org.cisecurity.benchmarks_rule_7.2.10_Ensure_local_interactive_user_dot_files_access_is_configured"},{"ns":"https://cisecurity.org/ns","name":"step-type","value":"remediation"}],"title":"Remediation for Ensure local interactive user dot files access is configured","description":"Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy.\n\nThe following script will:\n\n- remove excessive permissions on `dot` files within interactive users' home directories\n- change ownership of `dot` files within interactive users' home directories to the user\n- change group ownership of `dot` files within interactive users' home directories to the user's primary group\n- list `.forward` and `.rhost` files to be investigated and manually deleted\n\n```bash\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=()\n l_maxsize=\"1000\" # Maximum number of local interactive users before warning (Default 1,000)\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n a_user_and_home=() # Create array with local users and their home directories\n while read -r l_local_user l_local_user_home; do # Populate array with users and user home location\n [[ -n \"$l_local_user\" && -n \"$l_local_user_home\" ]] && a_user_and_home+=(\"$l_local_user:$l_local_user_home\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_user_and_home[@]}\" # Here if we want to look at number of users before proceeding \n [ \"${#a_user_and_home[@]}\" -gt \"$l_maxsize\" ] && printf '%s\\n' \"\" \" ** INFO **\" \\\n \" - \\\"$l_asize\\\" Local interactive users found on the system\" \\\n \" - This may be a long running check\" \"\"\n file_access_fix()\n {\n a_access_out=()\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" is mode: \\\"$l_mode\\\" and should be mode: \\\"$l_max\\\" or more restrictive\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be mode: \\\"$l_max\\\" or more restrictive\"\n chmod \"$l_change\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_owner\" =~ ($l_user) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" owned by: \\\"$l_owner\\\" and should be owned by \\\"${l_user//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be owned by \\\"${l_user//|/ or }\\\"\"\n chown \"$l_user\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_gowner\" =~ ($l_group) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" group owned by: \\\"$l_gowner\\\" and should be group owned by \\\"${l_group//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be group owned by \\\"${l_group//|/ or }\\\"\"\n chgrp \"$l_group\" \"$l_hdfile\"\n fi\n }\n while IFS=: read -r l_user l_home; do\n a_dot_file=(); a_netrc=(); a_netrc_warn=(); a_bhout=(); a_hdirout=()\n if [ -d \"$l_home\" ]; then\n l_group=\"$(id -gn \"$l_user\" | xargs)\";l_group=\"${l_group// /|}\"\n while IFS= read -r -d $'\\0' l_hdfile; do\n while read -r l_mode l_owner l_gowner; do\n case \"$(basename \"$l_hdfile\")\" in\n .forward | .rhost )\n a_dot_file+=(\" - File: \\\"$l_hdfile\\\" exists\" \" Please review and manually delete this file\") ;;\n .netrc )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix\n a_netrc_warn+=(\" - File: \\\"$l_hdfile\\\" exists\") ;;\n .bash_history )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix ;;\n * )\n l_mask='0133'; l_change=\"u-x,go-wx\"; file_access_fix ;;\n esac\n done < <(stat -Lc '%#a %U %G' \"$l_hdfile\")\n done < <(find \"$l_home\" -xdev -type f -name '.*' -print0)\n fi\n [ \"${#a_dot_file[@]}\" -gt 0 ] && a_output2+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_dot_file[@]}\")\n [ \"${#a_netrc_warn[@]}\" -gt 0 ] && a_output3+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_netrc_warn[@]}\")\n done <<< \"$(printf '%s\\n' \"${a_user_and_home[@]}\")\"\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" ** WARNING **\" \"${a_output3[@]}\" \"\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\"\n}\n```"}],"title":"7.2.10 Ensure local interactive user dot files access is configured","description":"While the system administrator can establish secure permissions for users' \"dot\" files, the users can easily override these.\n\n- `.forward` file specifies an email address to forward the user's mail to.\n- `.rhost` file provides the \"remote authentication\" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)\n- `.netrc` file contains data for logging into a remote host or passing authentication to an API.\n- `.bash_history` file keeps track of the user’s commands."}]},"reviewed-controls":{"control-selections":[{"props":[{"ns":"https://cisecurity.org/ns","name":"framework","value":"CIS Controls v8.0"},{"ns":"https://cisecurity.org/ns","name":"resolution-status","value":"synthetic-ids"}],"description":"CIS Controls v8.0 derived from benchmark cc8:controlURI paths. Provide a CIS Controls v8 OSCAL catalog via --cis-catalog-v8 for authoritative control-id resolution.","include-controls":[{"control-id":"cis-3.3"},{"control-id":"cis-3.10"},{"control-id":"cis-3.11"},{"control-id":"cis-3.14"},{"control-id":"cis-4.1"},{"control-id":"cis-4.3"},{"control-id":"cis-4.4"},{"control-id":"cis-4.5"},{"control-id":"cis-4.8"},{"control-id":"cis-5.2"},{"control-id":"cis-5.4"},{"control-id":"cis-6.2"},{"control-id":"cis-7.3"},{"control-id":"cis-7.4"},{"control-id":"cis-8.2"},{"control-id":"cis-8.3"},{"control-id":"cis-8.4"},{"control-id":"cis-8.5"},{"control-id":"cis-8.9"},{"control-id":"cis-10.3"},{"control-id":"cis-10.5"},{"control-id":"cis-14.6"}]},{"props":[{"ns":"https://cisecurity.org/ns","name":"framework","value":"CIS Controls v7.0"},{"ns":"https://cisecurity.org/ns","name":"resolution-status","value":"synthetic-ids"}],"description":"CIS Controls v7.0 derived from benchmark cc7:controlURI paths. Provide a CIS Controls v7 OSCAL catalog via --cis-catalog-v7 for authoritative control-id resolution.","include-controls":[{"control-id":"cis-2.6"},{"control-id":"cis-3.4"},{"control-id":"cis-3.5"},{"control-id":"cis-4.3"},{"control-id":"cis-4.4"},{"control-id":"cis-4.8"},{"control-id":"cis-4.9"},{"control-id":"cis-5.1"},{"control-id":"cis-5.5"},{"control-id":"cis-6.1"},{"control-id":"cis-6.2"},{"control-id":"cis-6.3"},{"control-id":"cis-6.4"},{"control-id":"cis-6.5"},{"control-id":"cis-8.3"},{"control-id":"cis-8.5"},{"control-id":"cis-9.2"},{"control-id":"cis-9.4"},{"control-id":"cis-13.7"},{"control-id":"cis-14.4"},{"control-id":"cis-14.6"},{"control-id":"cis-14.9"},{"control-id":"cis-15.4"},{"control-id":"cis-15.5"},{"control-id":"cis-16.4"},{"control-id":"cis-16.5"},{"control-id":"cis-16.7"},{"control-id":"cis-16.11"},{"control-id":"cis-16.13"}]},{"props":[{"ns":"https://cisecurity.org/ns","name":"framework","value":"NIST SP 800-53 Rev. 5"}],"description":"NIST SP 800-53 Rev. 5 controls mapped from benchmark idents.","include-controls":[{"control-id":"ac-2.5"},{"control-id":"ac-3"},{"control-id":"ac-6"},{"control-id":"ac-11"},{"control-id":"au-2"},{"control-id":"au-3"},{"control-id":"au-3.1"},{"control-id":"au-4"},{"control-id":"au-6"},{"control-id":"au-7"},{"control-id":"au-8"},{"control-id":"au-12"},{"control-id":"ca-9"},{"control-id":"cm-1"},{"control-id":"cm-2"},{"control-id":"cm-3"},{"control-id":"cm-6"},{"control-id":"cm-7"},{"control-id":"cm-11"},{"control-id":"ia-5"},{"control-id":"ia-5.1"},{"control-id":"mp-2"},{"control-id":"mp-7"},{"control-id":"sc-7"},{"control-id":"sc-8"},{"control-id":"si-2"},{"control-id":"si-3"},{"control-id":"si-4"},{"control-id":"si-5"}]}]},"assessment-subjects":[{"type":"component","description":"Target system under assessment.","include-all":{}}],"assessment-assets":{"assessment-platforms":[{"uuid":"c7b379d1-58cc-505b-b290-f678b43c7e75","title":"CIS Benchmark Assessment Platform","remarks":"Platform used to assess CIS benchmark controls."}]},"tasks":[{"type":"milestone","uuid":"66b30f48-2b1c-5ca9-8752-a61ad5a97a02","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1_Initial_Setup"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"be6f6bf5-711d-5118-83c5-d89cba418ab9","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1_Filesystem"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"f3c9b476-d1d3-5d43-9962-37ad3987d8db","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.1_Configure_Filesystem_Kernel_Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"1.1.1 Configure Filesystem Kernel Modules","description":"Several uncommon filesystem types are supported under Linux. Removing support for unneeded filesystem types reduces the local attack surface of the system. If a filesystem type is not needed it should be disabled. Native Linux file systems are designed to ensure that built-in security controls function as expected. Non-native filesystems can lead to unexpected consequences to both the security and functionality of the system and should be used with caution. Many filesystems are created for niche use cases and are not maintained and supported as the operating systems are updated and patched. Users of non-native filesystems should ensure that there is attention and ongoing support for them, especially in light of frequent operating system changes.\n\nStandard network connectivity and Internet access to cloud storage may make the use of non-standard filesystem formats to directly attach heterogeneous devices much less attractive.\n\n**Note**: This should not be considered a comprehensive list of filesystems. You may wish to consider additions to those listed here for your environment. For the current available file system modules on the system see `/usr/lib/modules/$(uname -r)/kernel/fs`\n\n**Start up scripts**\n\nKernel modules loaded directly via `insmod` will ignore what is configured in the relevant `/etc/modprobe.d/*.conf` files. If modules are still being loaded after a reboot whilst having the correctly configured `blacklist` and `install` command, check for `insmod` entries in start up scripts such as `.bashrc`.\n\nYou may also want to check `/lib/modprobe.d/`. Please note that this directory should not be used for user defined module loading. Ensure that all such entries resides in `/etc/modprobe.d/*.conf` files.\n\n**Return values**\n\nUsing `/bin/false` as the command in disabling a particular module serves two purposes; to convey the meaning of the entry to the user and cause a non-zero return value. The latter can be tested for in scripts. Please note that `insmod` will ignore what is configured in the relevant `/etc/modprobe.d/*.conf` files. The preferred way to load modules is with `modprobe`.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f297e734-e36d-5233-82ae-b20545acc315"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3883fd5f-7390-5103-ad00-e3a17a2ad1ec"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"654d5ff2-2136-5ec2-b7af-c14cd1899a07"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a14cdd87-d71f-5c9b-9990-52289d75b119"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b0f75797-dbce-582b-b03d-87911cc67812"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"818ddede-a02a-592e-b3ab-8aa8eb73ce38"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c73c17d1-8bfc-5844-b34d-b64bb0ffa627"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f1a08cb5-c34d-5c64-b3d3-45485bb1e195"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5dc10df5-9873-5faf-b378-676047ae6685"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"acb2abee-cfe1-52d5-9a96-e522e3619516"}]},{"type":"milestone","uuid":"7fa2e9b2-2cef-5852-8bde-6507d8fef2cf","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2_Configure_Filesystem_Partitions"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"tasks":[{"type":"milestone","uuid":"f3030433-61cb-5547-89e8-f0953421038a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.1_Configure_tmp"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.1 Configure /tmp","description":"The `/tmp` directory is a world-writable directory used to store data used by the system and user applications for a short period of time. This data should have no expectation of surviving a reboot, as this directory is intended to be emptied after each reboot.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ad698a90-9fc8-5d7a-b458-bb654f354e64"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f5304ad3-9f34-5cb2-9317-4981d13c5e78"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0579851b-5bbc-56e3-a929-46b859a66fdc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b4355757-b187-5b55-9164-b09cf38b12ae"}]},{"type":"milestone","uuid":"be54d837-c7e8-52e5-85e7-2c2d88d2c15e","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.2_Configure_devshm"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.2 Configure /dev/shm","description":"The `/dev/shm` directory is a world-writable directory that can function as shared memory that facilitates inter process communication (IPC)","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8f62e24e-2614-5159-ade5-44e23b2539be"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"75ea7c86-0133-50d2-abba-26823610476c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b1e6fa92-af6a-565f-98c3-957811b7e057"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0a0a3115-9bc6-5548-bbcb-64604e68784c"}]},{"type":"milestone","uuid":"96f757ce-9ff8-5211-84a6-68bbfc6d0a70","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.3_Configure_home"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.3 Configure /home","description":"Please note that home directories can be mounted anywhere and are not necessarily restricted to `/home`, nor restricted to a single location, nor is the name restricted in any way.\n\nFinding user home directories can be done by looking in `/etc/passwd`, looking over the mounted file systems with `mount` or querying the relevant database with `getent`.\n\n```bash\nfor user in $(awk -F ':' '{print $1}' /etc/passwd); do echo \"${user} - $(sudo getent passwd ${user} | awk -F ':' '{print $NF}')\"; done\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"da06952e-50ce-5af9-9918-1415047f0367"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6241884c-a015-53df-b689-36a9919d714d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"74e78db6-a7a1-5daa-89e9-826f76424e81"}]},{"type":"milestone","uuid":"44a19917-eb14-5bfb-9ea9-8ec06dd95bdb","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.4_Configure_var"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.4 Configure /var","description":"The `/var` directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world-writable.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1cb67d21-b700-590d-afdd-9ff5b1f29f77"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9f93a4b0-27e7-5a3b-976d-e2ee8c66995f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d316eb9c-bc7b-56ca-95b4-eef58d314de6"}]},{"type":"milestone","uuid":"c539ac4f-f6db-5a95-bd1c-99d88992796b","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.5_Configure_vartmp"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.5"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.5 Configure /var/tmp","description":"The `/var/tmp` directory is a world-writable directory used for temporary storage by all users and some applications. Temporary files residing in `/var/tmp` are to be preserved between reboots.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e9e1cd44-b52e-5374-857f-e6d8e94ac9a0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"55d88a49-8986-51f4-b0c8-d526f6a6412c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4a9be362-bee5-57cc-8e0e-209193916c27"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"098a0d10-e1fa-518e-9e22-f6289d989101"}]},{"type":"milestone","uuid":"1b0aa75c-5ca7-50f6-904c-6f1a1c621a9a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.6_Configure_varlog"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.6"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.6 Configure /var/log","description":"The `/var/log` directory is used by system services to store log data.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ee271c85-43a4-5f50-952a-3ae688e589d4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0354448f-6154-587e-ad4b-4d4fd0ef7f8b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"acbb25de-07d2-561d-8ab2-c84625e74931"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e6860aab-adf9-532b-823c-9f18dfd16115"}]},{"type":"milestone","uuid":"082cec96-4c5b-55b8-99ab-97ec34ba5934","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.1.2.7_Configure_varlogaudit"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.1.2.7"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"1.1.2.7 Configure /var/log/audit","description":"The auditing daemon, `auditd`, stores log data in the `/var/log/audit` directory.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5664f154-d298-5c79-b8da-8b4d297e57c1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b532c3b9-291b-59d8-b706-a191b671241d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"293bc7a7-e630-54dd-8913-f7b7903eb13a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9bcbd4ec-0768-5382-b8a6-b0a7183fe7ad"}]}],"title":"1.1.2 Configure Filesystem Partitions","description":"Directories that are used for system-wide functions can be further protected by placing them on separate partitions. This provides protection for resource exhaustion and enables the use of mounting options that are applicable to the directory's intended use. Users' data can be stored on separate partitions and have stricter mount options. A user partition is a filesystem that has been established for use by the users and does not contain software for system operations.\n\nThe recommendations in this section are easier to perform during initial system installation. If the system is already installed, it is recommended that a full backup be performed before repartitioning the system.\n\n**Note:**\n\n**-IF-** you are repartitioning a system that has already been installed (This may require the system to be in single-user mode):\n\n- Mount the new partition to a temporary mountpoint e.g. `mount /dev/sda2 /mnt`\n- Copy data from the original partition to the new partition. e.g. `cp -a /var/tmp/* /mnt`\n- Verify that all data is present on the new partition. e.g. `ls -la /mnt`\n- Unmount the new partition. e.g. `umount /mnt`\n- Remove the data from the original directory that was in the old partition. e.g. `rm -Rf /var/tmp/*` Otherwise it will still consume space in the old partition that will be masked when the new filesystem is mounted.\n- Mount the new partition to the desired mountpoint. e.g. `mount /dev/sda2 /var/tmp`\n- Update `/etc/fstab` with the new mountpoint. e.g. `/dev/sda2 /var/tmp xfs defaults,rw,nosuid,nodev,noexec,relatime 0 0`"}],"title":"1.1 Filesystem","description":"The file system is generally a built-in layer used to handle the data management of the storage."},{"type":"milestone","uuid":"e8afee28-34e0-5f8e-9393-fa414faf27ac","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.2_Package_Management"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"658afd99-796d-5dfa-bf51-9b78b03f973c","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.2.1_Configure_Package_Repositories"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.2.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"1.2.1 Configure Package Repositories","description":"Patch management procedures may vary widely between enterprises. Large enterprises may choose to install a local updates server that can be used in place of their distributions servers, whereas a single deployment of a system may prefer to get updates directly. Updates can be performed automatically or manually, depending on the site's policy for patch management. Organizations may prefer to test patches against their environment on a non-production system before rolling out to production.\n\nOutdated software is vulnerable to cyber criminals and hackers. Software updates help reduce the risk to your organization. The release of software update notes often reveals the patched exploitable entry points to the public. Public knowledge of these exploits can leave your organization more vulnerable to malicious actors attempting to gain access to your system's data.\n\n**Note:** Creation of an appropriate patch management policy is left to the organization.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ea2c8c25-bfff-5415-b29f-1b62f707ec4a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cdae1991-2faf-54c5-b4f2-63f0b1b7afc0"}]},{"type":"milestone","uuid":"43232c85-783b-5ccf-8468-e73efa202353","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.2.2_Configure_Package_Updates"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.2.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"1.2.2 Configure Package Updates","description":"1.2.2 Configure Package Updates","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3ad4c68e-c0f3-506f-936d-8f1404b7633b"}]}],"title":"1.2 Package Management","description":"Patch management procedures may vary widely between enterprises. Large enterprises may choose to install a local updates server that can be used in place of their distributions servers, whereas a single deployment of a system may prefer to get updates directly. Updates can be performed automatically or manually, depending on the site's policy for patch management. Organizations may prefer to test patches against their environment on a non-production system before rolling out to production.\n\nOutdated software is vulnerable to cyber criminals and hackers. Software updates help reduce the risk to your organization. The release of software update notes often reveals the patched exploitable entry points to the public. Public knowledge of these exploits can make your organization more vulnerable to malicious actors attempting to gain entry to your system's data.\n\nSoftware updates often offer new and improved features and speed enhancements.\n\nFor the purpose of this benchmark, the requirement is to ensure that a patch management process is defined and maintained, the specifics of which are left to the organization."},{"type":"milestone","uuid":"61f7db06-9b84-591c-a398-fc3269ec48ee","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.3_Mandatory_Access_Control"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"bb8446dd-4a2c-54a7-ab6f-7923967a251c","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.3.1_Configure_AppArmor"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.3.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"1.3.1 Configure AppArmor","description":"AppArmor provides a Mandatory Access Control (MAC) system that greatly augments the default Discretionary Access Control (DAC) model. Under AppArmor MAC rules are applied by file paths instead of by security contexts as in other MAC systems. As such it does not require support in the filesystem and can be applied to network mounted filesystems for example. AppArmor security policies define what system resources applications can access and what privileges they can do so with. This automatically limits the damage that the software can do to files accessible by the calling user. The user does not need to take any action to gain this benefit. For an action to occur, both the traditional DAC permissions must be satisfied as well as the AppArmor MAC rules. The action will not be allowed if either one of these models does not permit the action. In this way, AppArmor rules can only make a system's permissions more restrictive and secure.\n\n**References:**\n\n- AppArmor Documentation: http://wiki.apparmor.net/index.php/Documentation\n- Ubuntu AppArmor Documentation: https://help.ubuntu.com/community/AppArmor\n- SUSE AppArmor Documentation: https://www.suse.com/documentation/apparmor/","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9ee278d6-553e-5bc9-8298-8c251060a728"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"293ad609-7036-53ca-99e5-95ff43bbdc37"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"dc364849-b4af-581c-b939-40a980821684"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b54ffd76-b548-57d4-af35-da78a042b257"}]}],"title":"1.3 Mandatory Access Control","description":"Mandatory Access Control (MAC) provides an additional layer of access restrictions to processes on top of the base Discretionary Access Controls. By restricting how processes can access files and resources on a system the potential impact from vulnerabilities in the processes can be reduced.\n\n**Impact:** Mandatory Access Control limits the capabilities of applications and daemons on a system, while this can prevent unauthorized access the configuration of MAC can be complex and difficult to implement correctly preventing legitimate access from occurring."},{"type":"milestone","uuid":"e28e8b1c-5e5f-5cc1-b993-65c44b28fd17","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.4_Configure_Bootloader"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"1.4 Configure Bootloader","description":"The recommendations in this section focus on securing the bootloader and settings involved in the boot process directly.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0fa7d625-cc5c-56f5-b814-08c1f775085c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"032b3810-a9e2-590d-baf4-7497f6323344"}]},{"type":"milestone","uuid":"0b7dca8c-8419-59b1-9be0-5a4b23df676b","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.5_Configure_Additional_Process_Hardening"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.5"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"1.5 Configure Additional Process Hardening","description":"1.5 Configure Additional Process Hardening","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7db4ab92-97cf-5b6e-86fc-ee531bf958c0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e0815aa6-cb31-5b24-b570-0761552f8e85"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a9741177-054f-5ab5-ab57-b5686658fee6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2bceb27f-69f5-5a2a-a8a6-87d66c6b91a0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"db71fb97-08b7-51b0-ac20-5f5f7cb4a918"}]},{"type":"milestone","uuid":"35f86c29-9f16-592c-bb48-29e4cd7a0682","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.6_Configure_Command_Line_Warning_Banners"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.6"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"1.6 Configure Command Line Warning Banners","description":"Presenting a warning message prior to the normal user login may assist in the prosecution of trespassers on the computer system. Changing some of these login banners also has the side effect of hiding OS version information and other detailed system information from attackers attempting to target specific exploits at a system.\n\nGuidelines published by the US Department of Defense require that warning messages include at least the name of the organization that owns the system, the fact that the system is subject to monitoring and that such monitoring is in compliance with local statutes, and that use of the system implies consent to such monitoring. It is important that the organization's legal counsel review the content of all messages before any system modifications are made, as these warning messages are inherently site-specific. More information (including citations of relevant case law) can be found at http://www.justice.gov/criminal/cybercrime/\n\nThe `/etc/motd`, `/etc/issue`, and `/etc/issue.net` files govern warning banners for standard command line logins for both local and remote users.\n\n**Note:** The text provided in the remediation actions for these items is intended as an example only. Please edit to include the specific text for your organization as approved by your legal department.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"464861a0-608c-5b8c-80ad-b0d79aadc836"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"68a0885b-f75f-507a-add3-2aff22657823"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"375f994c-2d02-5c2e-bb97-4ed74b1034f8"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"74ee21fd-e8de-5c38-b21c-e5c766c08e13"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2c51eec9-16e5-5bce-9c06-8135a7838851"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3ea6e5d8-bd28-55c7-9519-2761cdc4906f"}]},{"type":"milestone","uuid":"5c3f3a4c-5079-5abb-9ae3-929cd889691b","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_1.7_Configure_GNOME_Display_Manager"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"1.7"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"1.7 Configure GNOME Display Manager","description":"The GNOME Display Manager (GDM) is a program that manages graphical display servers and handles graphical user logins.\n\nThis subsection requires user profiles to already exist on the system. A profile is a list of configuration databases.\n\nSample profile:\n\n```bash\nuser-db:user\nsystem-db:local\nsystem-db:site\n```\n\nConfiguring a single user and multiple system databases allows for layering of preferences. Settings from the user database file take precedence over the settings in the local database file, and the local database file in turn takes precedence over the site database file.\n\n**Note:**\n\n- **- IF -** GDM is not installed on the system, this section can be skipped\n- The Remediation Procedure commands in this section **MUST** be done from a command window on a graphical desktop or an error will be returned.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a708dac1-7928-50ed-9e9a-d9566dc71a53"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"30826985-517c-50bb-b3f4-e14301360369"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"97ef1a9a-18bc-5e94-a701-6bf55cb8ae5f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3b3c1ba1-1808-5f43-8598-2b7ee71386d6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ff3758fb-369d-56c4-b705-6232c42cf567"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"bce75eb5-1e09-5c5e-a43b-2607d36e2dd9"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0d2be8aa-14cc-56d1-8b0a-0dde634e5db1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b1ef1cc3-6345-5d12-882e-c7b703e795c5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b367e0aa-5bf3-5bb6-a6ec-4f175e90d0ac"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"eb0d2c27-a5fa-56fb-9c2f-3b261dcd5272"}]}],"title":"1 Initial Setup","description":"Items in this section are advised for all systems but may be difficult or require extensive preparation after the initial setup of the system."},{"type":"milestone","uuid":"b7f890d9-07a4-5c15-9662-ac6298d13f4f","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2_Services"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"b3129586-e464-57b8-bad0-b17023526d98","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.1_Configure_Server_Services"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"2.1 Configure Server Services","description":"This section describes services that are installed on systems that specifically need to run these services. If any of these services are not required, it is recommended that the package be removed.\n\n**- IF -** the package is required for a dependency:\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy\n- Stop and mask the service and/or socket to reduce the potential attack surface\n\nThe following commands can be used to stop and mask the service and socket:\n\n```bash\n# systemctl stop .socket .service\n# systemctl mask .socket .service\n```\n\n**Note:** This should not be considered a comprehensive list of services not required for normal system operation. You may wish to consider additions to those listed here for your environment","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f9bac567-2f98-5050-9219-3d5e36874cea"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0c682a0e-e75b-585b-91a5-9320c6afb315"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b962f059-56c2-5d2b-a424-70fc7410622c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e39d0dc4-c7ff-54d2-8fba-57fde6ed45bd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ac3b85dd-78e8-53b0-9077-2461a2cb9cf4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e4f92df3-841e-5a1a-9393-acf0ca33b55e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6399b67a-7f3e-5a02-a3c1-ae3191ac1b38"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"971a3544-5339-5cb8-87c2-e6acfdb12b3d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6f06a46c-a909-5805-87a3-3151963edab8"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"edea0f6d-2d44-522f-b555-64306a633bb0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1796774e-24a0-5de1-88b7-a3df2e7f67f9"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"32883d03-ccf9-5aca-b684-01c20ba232cd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6d6d8560-d6b0-5351-8344-2abb61e684bc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3932ed95-5e6b-5936-aca8-76a6c764733d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8ee5e381-a7b8-56a4-a707-0100c25c232f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"80f2392d-5867-5dad-8cc8-906644270f5d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4bb74c9f-8dae-53ec-aad8-a499d5d204a7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0f9c8f09-7911-544b-ba13-77e55d1181ae"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"be1703e9-4962-5d26-9d50-173de416c319"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0442f8ea-f0ab-5f16-afc3-5211e3421ab3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"fc4d557c-78bd-574d-96a5-4148b59529cc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a07d3652-82fa-543b-bd7d-08a24e1cf3f5"}]},{"type":"milestone","uuid":"29262a47-ddac-5a5d-8849-24214f2763d0","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.2_Configure_Client_Services"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"2.2 Configure Client Services","description":"A number of insecure services exist. While disabling the servers prevents a local attack against these services, it is advised to remove their clients unless they are required.\n\n**Note:** This should not be considered a comprehensive list of insecure service clients. You may wish to consider additions to those listed here for your environment.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5a8379de-96c0-5c58-9dd7-f1b41ee9eed0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"83476335-c971-5c17-8c2d-1f585d0ba138"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"66b992e3-f4a8-5dfc-87a1-e9f49738a4b1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ba3ae9ad-0fc7-5153-91ff-7e6a06cfe875"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5f0039e6-7b51-540f-a9a5-87c2b7368100"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"769ee2f6-02db-557c-9c1a-b9ed6f4238da"}]},{"type":"milestone","uuid":"80a119c1-3ed8-52cd-a005-bcf9ef6374fa","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.3_Configure_Time_Synchronization"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"6a76ba2c-35ca-548f-8613-0a8d75a46730","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.3.1_Ensure_time_synchronization_is_in_use"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.3.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"2.3.1 Ensure time synchronization is in use","description":"It is recommended that physical systems and virtual guests lacking direct access to the physical host's clock be configured to synchronize their time using a service such as `systemd-timesyncd`, or `chrony`.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"665a4c1b-33b6-50c8-8e81-3cf43dfc839a"}]},{"type":"milestone","uuid":"ddf0d334-3981-5850-94ed-9a90d8892192","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.3.2_Configure_systemd-timesyncd"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.3.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"2.3.2 Configure systemd-timesyncd","description":"`systemd-timesyncd` is a daemon that has been added for synchronizing the system clock across the network. It implements an SNTP client. In contrast to NTP implementations such as chrony or the NTP reference server this only implements a client side, and does not bother with the full NTP complexity, focusing only on querying time from one remote server and synchronizing the local clock to it. The daemon runs with minimal privileges, and has been hooked up with networkd to only operate when network connectivity is available. The daemon saves the current clock to disk every time a new NTP sync has been acquired, and uses this to possibly correct the system clock early at bootup, in order to accommodate for systems that lack an RTC such as the Raspberry Pi and embedded devices, and make sure that time monotonically progresses on these systems, even if it is not always correct. To make use of this daemon a new system user and group \"systemd-timesync\" needs to be created on installation of systemd.\n\nThe default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults. Initially, the main configuration file in /etc/systemd/ contains commented out entries showing the defaults as a guide to the administrator. Local overrides can be created by editing this file or by creating drop-ins, as described below. Using drop-ins for local configuration is recommended over modifications to the main configuration file.\n\nIn addition to the \"main\" configuration file, drop-in configuration snippets are read from `/usr/lib/systemd/*.conf.d/`, `/usr/local/lib/systemd/*.conf.d/`, and `/etc/systemd/*.conf.d/`. Those drop-ins have higher precedence and override the main configuration file. Files in the *.conf.d/ configuration subdirectories are sorted by their filename in lexicographic order, regardless of in which of the subdirectories they reside. When multiple files specify the same option, for options which accept just a single value, the entry in the file sorted last takes precedence, and for options which accept a list of values, entries are collected as they occur in the sorted files.\n\nWhen packages need to customize the configuration, they can install drop-ins under /usr/. Files in /etc/ are reserved for the local administrator, who may use this logic to override the configuration files installed by vendor packages. Drop-ins have to be used to override package drop-ins, since the main configuration file has lower precedence. It is recommended to prefix all filenames in those subdirectories with a two-digit number and a dash, to simplify the ordering of the files.\n\nTo disable a configuration file supplied by the vendor, the recommended way is to place a symlink to /dev/null in the configuration directory in /etc/, with the same filename as the vendor configuration file.\n\n**Note:**\n\n- The recommendations in this section only apply if `timesyncd` is in use on the system\n- The `systemd-timesyncd` service specifically implements only SNTP.\n\nThis minimalistic service will set the system clock for large offsets or slowly adjust it for smaller deltas\n- More complex use cases are not covered by `systemd-timesyncd`\n\n- **If `chrony` is used, `systemd-timesyncd` should be stopped and masked, and this section skipped**\n- **One, and only one, time synchronization method should be in use on the system**","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5687ff19-53d9-5cf5-b186-dd74f2c9c80b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b06e09f1-1b93-59c5-b992-2bbd28e4f08e"}]},{"type":"milestone","uuid":"b3b378e9-b5a3-5dac-b71a-c6ab7ba56fdb","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.3.3_Configure_chrony"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.3.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"2.3.3 Configure chrony","description":"`chrony` is a daemon which implements the Network Time Protocol (NTP) and is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate.\n\n`chrony` can be configured to be a client and/or a server.\n\nMore information on `chrony` can be found at: http://chrony.tuxfamily.org/.\n\n**Note:**\n\n- If `systemd-timesyncd` is being used, `chrony` should be removed and this section skipped\n- Only one time synchronization method should be in use on the system","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"228d0415-1391-524c-aa3a-815eb79c2fc6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"93e2d6b7-f8ef-5b43-85fb-5f0c0fa072fd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4507cd76-7a71-5873-a045-7abe11d03297"}]}],"title":"2.3 Configure Time Synchronization","description":"It is recommended that systems be configured to synchronize their time using a service such as `systemd-timesyncd`, or `chrony`.\n\nVirtual systems may be configured to receive their time synchronization from their host system.\n\nThe host system must be configured to synchronize its time from an authoritative source to be considered compliant with this section.\n\nAny \"physical\" clock present on a system should be synchronized from an authoritative time source.\n\n**Only one time synchronization method should be in use on the system**\n\n**Notes:** Only the section related to the time synchronization method in use on the system should be followed, all other time synchronization recommendations should be skipped"},{"type":"milestone","uuid":"144ac61b-31e6-5635-8532-2af2f8e8216a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.4_Job_Schedulers"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"9de1290b-1728-5bea-ab71-0ce60f686c5a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.4.1_Configure_cron"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.4.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"2.4.1 Configure cron","description":"`cron` is a time based job scheduler\n\n**- IF -** `cron` is not installed on the system, this sub section can be skipped\n\n**Note:** Other methods such as `systemd timers` exist for scheduling jobs. If another method is used `cron` should may be removed. The alternate method should be secured in accordance with local site policy","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"24e35835-53db-529f-8dad-f21fa8c3f4b2"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b4ec7446-07c6-5284-8021-ff718e2524e6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c61ff831-d579-5af7-b70d-aae19635e203"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f05a0bce-af8d-5ca9-a7c0-57716babbced"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d47496e4-3e32-541e-9d1e-4b86e0f4baed"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f048b00f-7697-5686-b26c-47baa3fb2963"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2b97e19f-9bd6-59c6-8f05-81972f4574e0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5104e873-2458-511d-87f3-c9429d8fd6d0"}]},{"type":"milestone","uuid":"1a37cb54-667e-520b-8ced-3813eb1cab2c","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_2.4.2_Configure_at"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"2.4.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"2.4.2 Configure at","description":"`at` is a command-line utility used to schedule a job for later execution\n\n**Note:** if `at` is not installed on the system, this section can be skipped","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cf141e8b-f62d-5e7a-a4b7-c7962b668fb7"}]}],"title":"2.4 Job Schedulers","description":"A job scheduler is used to execute jobs, commands, or shell scripts, at fixed times, dates, or intervals"}],"title":"2 Services","description":"While applying system updates and patches helps correct known vulnerabilities, one of the best ways to protect the system against as yet unreported vulnerabilities is to disable all services that are not required for normal system operation. This prevents the exploitation of vulnerabilities discovered at a later date. If a service is not enabled, it cannot be exploited. The actions in this section of the document provide guidance on some services which can be safely disabled and under which circumstances, greatly reducing the number of possible threats to the resulting system. Additionally, some services which should remain enabled but with secure configuration are covered as well as insecure service clients."},{"type":"milestone","uuid":"440eb7c9-4e0c-52f8-8d3c-734826b95bf4","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_3_Network"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"20fba2c1-9713-5dfc-8cb5-cead096b400f","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_3.1_Configure_Network_Devices"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"3.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"3.1 Configure Network Devices","description":"To reduce the attack surface of a system, unused devices should be disabled.\n\n**Note:** This should not be considered a comprehensive list, you may wish to consider additions to those listed here for your environment.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"418cd513-06c2-5768-a218-4cdb5464834c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3ef3bf18-df30-5dda-8694-9f7eff61945c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b502b3ae-6adf-591b-86d8-6129c664c064"}]},{"type":"milestone","uuid":"87d3685e-8798-525b-8894-fa1fa12ac6b8","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_3.2_Configure_Network_Kernel_Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"3.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"3.2 Configure Network Kernel Modules","description":"The Linux kernel modules support several network protocols that are not commonly used. If these protocols are not needed, it is recommended that they be disabled in the kernel.\n\n**Note:** This should not be considered a comprehensive list of uncommon network protocols, you may wish to consider additions to those listed here for your environment.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ace6dbc8-4bc9-5eb0-b4d6-295efcb0d8c0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"88f03ccc-83f6-5fed-a98a-aaa6410c9db7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"be369f0c-f8f2-5bda-a927-e7f106c30274"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"887e7757-ca76-59e7-9759-7bafaa982504"}]},{"type":"milestone","uuid":"73bbb2bb-4d26-50e4-8b66-9321ec37571a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_3.3_Configure_Network_Kernel_Parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"3.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"3.3 Configure Network Kernel Parameters","description":"The following network parameters are intended for use on both host only and router systems. A system acts as a router if it has at least two interfaces and is configured to perform routing functions.\n\n**Note:**\n\n- sysctl settings are defined through files in `/usr/local/lib`, `/usr/lib/`, `/lib/`, `/run/`, and `/etc/`\n- Files are typically placed in the `sysctl.d` directory within the parent directory\n- The paths where sysctl preload files usually exist\n\n`/run/sysctl.d/*.conf`\n- `/etc/sysctl.d/*.conf`\n- `/usr/local/lib/sysctl.d/*.conf`\n- `/usr/lib/sysctl.d/*.conf`\n- `/lib/sysctl.d/*.conf`\n- `/etc/sysctl.conf`\n\n- Files must have the \"`.conf`\" extension\n- Vendors settings usually live in `/usr/lib/` or `/usr/local/lib/`\n- To override a whole file, create a new file with the same name in `/etc/sysctl.d/` and put new settings there.\n- To override only specific settings, add a file with a lexically later name in `/etc/sysctl.d/` and put new settings there.\n- The command `/usr/lib/systemd/systemd-sysctl --cat-config` produces output containing The system's loaded kernel parameters and the files they're configured in:\n\nEntries listed latter in the file take precedence over the same settings listed earlier in the file\n- Files containing kernel parameters that are over-ridden by other files with the same name will not be listed\n- On systems running UncomplicatedFirewall, the kernel parameters may be set or over-written. This will not be visible in the output of the command\n\n- On systems with Uncomplicated Firewall, additional settings may be configured in `/etc/ufw/sysctl.conf`\n\nThe settings in `/etc/ufw/sysctl.conf` will override settings other settings and **will not** be visible in the output of the `/usr/lib/systemd/systemd-sysctl --cat-config` command\n- This behavior can be changed by updating the `IPT_SYSCTL` parameter in `/etc/default/ufw`\n\nThe system's loaded kernel parameters and the files they're configured in can be viewed by running the following command:\n\n```bash\n# /usr/lib/systemd/systemd-sysctl --cat-config\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4fb55874-2389-5feb-a6c7-0cc02eef31b0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2c0a40b7-14d7-55d3-b015-df0ded2c5097"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9262f405-08e2-553b-8135-7a2342f5cabe"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"252d357e-3d36-5db5-a0f5-738b29de5d3b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"691e54a5-f997-5584-927b-e2c34b02faf7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d0b2e49c-0f8a-5f09-8426-9fc60c2e3225"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"eecce373-1ddf-5a3b-98f7-a32c665d39cd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c40e4ca6-9f83-5916-bb6a-c0ef6400daf3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"89b1db5f-c6ef-5bb1-805b-abc11f66a6a7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d659b2cd-315e-598e-8af9-54bd31da7616"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c409b512-f029-5757-a273-e9d5e2c92b6b"}]}],"title":"3 Network","description":"This section provides guidance on for securing the network configuration of the system"},{"type":"milestone","uuid":"40d77e25-4d18-564c-a156-082755cc8d89","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4_Host_Based_Firewall"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"7ce8d404-c8bd-580b-a72b-076aa4f5199b","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.1_Configure_a_single_firewall_utility"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"4.1 Configure a single firewall utility","description":"Only one method should be used to configure a firewall on the system. Use of more than one method could produce unexpected results.\n\nThis section ensures that only one firewall is in use on the system and provides guidance to the subsequent subsection that should be followed for a single firewall utility configuration.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0a987f1f-f84b-5d04-b196-8b75bcd7f907"}]},{"type":"milestone","uuid":"9188b386-8afb-5259-93ca-387c6c7101fa","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.2_Configure_UncomplicatedFirewall"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"4.2 Configure UncomplicatedFirewall","description":"**If nftables or iptables are being used in your environment, please follow the guidance in their respective section and pass-over the guidance in this section.**\n\nUncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n- Uses a command-line interface consisting of a small number of simple commands\n- Uses iptables for configuration\n- Rules are processed until first matching rule. The first matching rule will be applied.\n\n**Notes:**\n\n- Configuration of a live system's firewall directly over a remote connection will often result in being locked out\n- Rules should be ordered so that `ALLOW` rules come before `DENY` rules.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"536df640-944f-55e5-9e19-5afa140db799"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"76db6eaf-1768-5c9f-a59e-5595ff2c57f2"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"543a6490-d5c2-5f2f-979f-817ac8c0bd38"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"29ea6962-14c8-59af-ba26-69242a9bbec1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cb773ca1-bbdf-5cd2-a587-8b11cf5b7d50"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b0692699-fbbd-5307-9fef-6a1c710310b4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"024b4c0e-6f38-51bd-97aa-6e87741e2363"}]},{"type":"milestone","uuid":"5e91c816-191a-57c1-8b83-73aec76842ef","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.3_Configure_nftables"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"4.3 Configure nftables","description":"**If Uncomplicated Firewall (UFW) or iptables are being used in your environment, please follow the guidance in their respective section and pass-over the guidance in this section.**\n\n`nftables` is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The biggest change with the successor `nftables` is its simplicity. With iptables, we have to configure every single rule and use the syntax which can be compared with normal commands. With `nftables`, the simpler syntax, much like BPF (Berkely Packet Filter) means shorter lines and less repetition. Support for `nftables` should also be compiled into the kernel, together with the related `nftables` modules. Please ensure that your kernel supports nf_tables before choosing this option.\n\n**Notes:**\n\n- This section broadly assumes starting with an empty `nftables` firewall ruleset (established by flushing the rules with nft flush ruleset).\n- Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot.\n- Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.\n\nThe following script will implement the firewall rules of this section and open port 22(ssh) from anywhere. Opening the ports for port 22(ssh) needs to be updated in accordance with local site policy. **Allow port 22(ssh) needs to be updated to only allow systems requiring ssh connectivity to connect, as per site policy**.\n\nSave the script below as `/etc/nftables.rules`\n\n```bash\n#!/sbin/nft -f\n\n# This nftables.rules config should be saved as /etc/nftables.rules\n# flush nftables rulesset\nflush ruleset\n# Load nftables ruleset\n# nftables config with inet table named filter\ntable inet filter {\n # Base chain for input hook named input (Filters inbound network packets)\n chain input {\n type filter hook input priority 0; policy drop;\n\n # Ensure loopback traffic is configured\n iif \"lo\" accept\n ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop\n # If IPv6 is enabled on the system ensure IPv6 loopback traffic is configured\n ip6 saddr ::1 counter packets 0 bytes 0 drop\n\n # Ensure established connections are configured\n ip protocol tcp ct state established accept\n ip protocol udp ct state established accept\n \n # Accept port 22(SSH) traffic from anywhere\n tcp dport ssh accept\n }\n\n # Base chain for hook forward named forward (Filters forwarded network packets)\n chain forward {\n type filter hook forward priority 0; policy drop;\n }\n\n # Base chain for hook output named output (Filters outbount network packets)\n chain output {\n type filter hook output priority 0; policy drop;\n # Ensure outbound and established connections are configured\n ip protocol tcp ct state established,related,new accept\n ip protocol udp ct state established,related,new accept\n }\n}\n```\n\nRun the following command to load the file into nftables\n\n```bash\n# nft -f /etc/nftables.rules\n```\n\nAll changes in the nftables subsections are temporary.\n\nTo make these changes permanent:\n\nRun the following command to create the nftables.rules file\n\n```bash\nnft list ruleset > /etc/nftables.rules\n```\n\nAdd the following line to `/etc/nftables.conf`\n\n```bash\ninclude \"/etc/nftables.rules\"\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"50f305d4-0f9b-552a-bdd5-abba47d04f84"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ac0ebbb8-6411-558c-9f6f-7dd574965578"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f84c56f2-b1f7-598e-b483-576f3d999d69"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a81efa8f-474b-5fc8-8f92-56b2c7df41d9"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d111f4fb-8b7f-5a8a-95dd-4b979a52bf81"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"24f7b473-20ea-5358-af1e-3876496a3a47"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e7eceaef-6757-5c7f-a150-578b2ea1dec3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4921e94f-fb13-57e2-8285-2b439846bfc5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"75fed75f-6308-5720-bc87-ca6a1b6df110"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"050ba166-a211-5485-a650-6b82bb6d968e"}]},{"type":"milestone","uuid":"e1f1a53b-ce41-5e99-b241-4ff56e8d7c5e","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.4_Configure_iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"f2e7d402-d56c-5f20-ad6c-cd2df7918642","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.4.1_Configure_iptables_software"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.4.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"4.4.1 Configure iptables software","description":"This section provides guidance for installing, enabling, removing, and disabling software packages necessary for using IPTables as the method for configuring and maintaining a Host Based Firewall on the system.\n\n**Note:** Using more than one method to configure and maintain a Host Based Firewall can cause unexpected results. If Uncomplicated Firewall (UFW) or NFTables are being used for configuration and maintenance, this section should be skipped and the guidance in their respective section followed.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"580365be-2769-541d-af35-9fa614d5a16d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f98019cb-0009-517a-81f6-5c15cebc5ba3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"643c075c-d845-5668-a87e-7b68cb2f72b5"}]},{"type":"milestone","uuid":"c64ddf6a-6c7d-5e24-857d-128da89df358","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.4.2_Configure_IPv4_iptables"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.4.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"4.4.2 Configure IPv4 iptables","description":"`iptables` is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.\n\nEach chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a 'target', which may be a jump to a user-defined chain in the same table.\n\n**Note:** This section broadly assumes starting with an empty `iptables` firewall ruleset (established by flushing the rules with `iptables -F`). Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot. Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot. The following script will implement the firewall rules of this section and open port 22(ssh) from anywhere:\n\n```bash\n#!/bin/bash\n\n# Flush IPtables rules\niptables -F\n\n# Ensure default deny firewall policy\niptables -P INPUT DROP\niptables -P OUTPUT DROP\niptables -P FORWARD DROP\n\n# Ensure loopback traffic is configured\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\niptables -A INPUT -s 127.0.0.0/8 -j DROP\n\n# Ensure outbound and established connections are configured\niptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\niptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n\n# Open inbound ssh(tcp port 22) connections\niptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"dcddc300-7105-511c-a60f-ca05482af265"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c179417b-7838-5298-a698-9778b9fb1980"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"fe9a702e-9645-5256-add9-1b667be8934c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5a3a89e3-2a45-502f-bcfb-6840a2de6241"}]},{"type":"milestone","uuid":"4dde3538-0425-57ee-a59d-d6492fb608fc","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_4.4.3_Configure_IPv6__ip6tables"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"4.4.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"4.4.3 Configure IPv6 ip6tables","description":"Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.\nEach chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a `target', which may be a jump to a user-defined chain in the same table.\n\nIf IPv6 in enabled on the system, the ip6tables should be configured.\n\n**Note:** This section broadly assumes starting with an empty ip6tables firewall ruleset (established by flushing the rules with ip6tables -F). Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot. Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.\n\nThe following script will implement the firewall rules of this section and open port 22(ssh) from anywhere:\n\n```bash\n#!/bin/bash\n\n# Flush ip6tables rules\nip6tables -F\n\n# Ensure default deny firewall policy\nip6tables -P INPUT DROP\nip6tables -P OUTPUT DROP\nip6tables -P FORWARD DROP\n\n# Ensure loopback traffic is configured\nip6tables -A INPUT -i lo -j ACCEPT\nip6tables -A OUTPUT -o lo -j ACCEPT\nip6tables -A INPUT -s ::1 -j DROP\n\n# Ensure outbound and established connections are configured\nip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\nip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\nip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\nip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n\n# Open inbound ssh(tcp port 22) connections\nip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"10914118-f25b-51e8-9b07-63cd72e13570"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f05e3dc3-dd7a-5801-b19a-6c3048a8f20b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7fab1843-10f5-512d-8013-5354c1f3a4df"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"36265d47-6aca-529b-a0eb-9abacb8008c4"}]}],"title":"4.4 Configure iptables","description":"**If Uncomplicated Firewall (UFW) or nftables are being used in your environment, please follow the guidance in their respective section and pass-over the guidance in this section.**\n\nIPtables is an application that allows a system administrator to configure the IPv4 and IPv6 tables, chains and rules provided by the Linux kernel firewall. While several methods of configuration exist this section is intended only to ensure the resulting IPtables rules are in place, not how they are configured. If IPv6 is in use in your environment, similar settings should be applied to the IP6tables as well.\n\n**Note:**\n\n- Configuration of a live system's firewall directly over a remote connection will often result in being locked out.\n- `iptables` is being phased out, and support for `iptables` will be reduced over time. It is recommended to transition towards either `nftables` or `ufw` as the default firewall management tool."}],"title":"4 Host Based Firewall","description":"A firewall is a set of rules. When a data packet moves into or out of a protected network space, its contents (in particular, information about its origin, target, and the protocol it plans to use) are tested against the firewall rules to see if it should be allowed through\n\nTo provide a Host Based Firewall, the Linux kernel includes support for:\n\n- `Netfilter` - A set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack. Includes the ip_tables, ip6_tables, arp_tables, and ebtables kernel modules. These modules are some of the significant parts of the Netfilter hook system.\n- `nftables` - A subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. nftables is supposed to replace certain parts of Netfilter, while keeping and reusing most of it. nftables utilizes the building blocks of the Netfilter infrastructure, such as the existing hooks into the networking stack, connection tracking system, userspace queueing component, and logging subsystem. **Is available in Linux kernels 3.13 and newer**.\n\nIn order to configure firewall rules for Netfilter or nftables, a firewall utility needs to be installed. Guidance has been included for the following firewall utilities:\n\n- UncomplicatedFirewall (`ufw`) - Provides firewall features by acting as a front-end for the Linux kernel's netfilter framework via the iptables backend. `ufw` supports both IPv4 and IPv6 networks\n- `nftables` - Includes the nft utility for configuration of the nftables subsystem of the Linux kernel\n- `iptables` - Includes the iptables, ip6tables, arptables and ebtables utilities for configuration Netfilter and the ip_tables, ip6_tables, arp_tables, and ebtables kernel modules.\n\n**Notes:**\n\n- Only **one** method should be used to configure a firewall on the system. Use of more than one method could produce unexpected results\n- This section is intended only to ensure the resulting firewall rules are in place, not how they are configured"},{"type":"milestone","uuid":"fbc1d25f-898a-50ee-a679-22bc72cae5f1","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5_Access_Control"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"3498513f-c841-5abb-85f0-a021c33974b6","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.1_Configure_SSH_Server"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"5.1 Configure SSH Server","description":"Secure Shell (SSH) is a secure, encrypted replacement for common login services such as `telnet`, `ftp`, `rlogin`, `rsh`, and `rcp`. It is strongly recommended that sites abandon older clear-text login protocols and use SSH to prevent session hijacking and sniffing of sensitive data off the network.\n\nThe recommendations in this section only apply if the SSH daemon is installed on the system, **if remote access is not required the SSH daemon can be removed and this section skipped**.\n\n`sshd_config`:\n\n- The openSSH daemon configuration directives, `Include` and `Match`, may cause the audits in this section's recommendations to report incorrectly. It is recommended that these options only be used if they're needed and fully understood. If these options are configured in accordance with local site policy, they should be accounted for when following the recommendations in this section.\n- The default `Include` location is the `/etc/ssh/sshd_config.d` directory. This default has been accounted for in this section. If a file has an additional `Include` that isn't this default location, the files should be reviewed to verify that the recommended setting is not being over-ridden.\n- The audits of the running configuration in this section are run in the context of the root user, the local host name, and the local host's IP address. If a `Match` block exists that matches one of these criteria, the output of the audit will be from the match block. The respective matched criteria should be replaced with a non-matching substitution.\n- `Include`:\n\nInclude the specified configuration file(s).\n- Multiple pathnames may be specified and each pathname may contain glob(7) wildcards that will be expanded and processed in lexical order.\n- Files without absolute paths are assumed to be in `/etc/ssh/`.\n- An Include directive may appear inside a Match block to perform conditional inclusion.\n\n- `Match`:\n\nIntroduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.\n- The arguments to Match are one or more criteria-pattern pairs or the single token All which matches all criteria. The available criteria are User, Group, Host, LocalAddress, LocalPort, and Address.\n- The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh_config(5).\n- The patterns in an Address criteria may additionally contain addresses to match in CIDR address/masklen format, such as `192.0.2.0/24` or `2001:db8::/32`. Note that the mask length provided must be consistent with the address - it is an error to specify a mask length that is too long for the address or one with bits set in this host portion of the address. For example, `192.0.2.0/33` and `192.0.2.0/8`, respectively.\n- Only a subset of keywords may be used on the lines following a Match keyword. Available keywords are available in the ssh_config man page.\n\n- Once all configuration changes have been made to `/etc/ssh/sshd_config` or any included configuration files, the `sshd` configuration must be reloaded\n\nCommand to re-load the SSH daemon configuration:\n\n```bash\n# systemctl reload-or-restart sshd\n```\n\n`sshd` command:\n\n- `-T` - Extended test mode. Check the validity of the configuration file, output the effective configuration to stdout and then exit. Optionally, Match rules may be applied by specifying the connection parameters using one or more `-C` options.\n- `-C` - connection_spec. Specify the connection parameters to use for the -T extended test mode. If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma-separated list. The keywords are `addr`, `user`, `host`, `laddr`, `lport`, and `rdomain` and correspond to source address, user, resolved source host name, local address, local port number and routing domain respectively.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c95b9b9c-2204-5a1c-8c80-3dd21025f28a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9a8ace36-0081-5740-9072-bb42841e9d2c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2cd6148c-97e1-5c12-8519-9fc2ad73dd0f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"be22d935-86b1-53f5-8149-2bb9ebd2a02d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3695776a-b3ec-51ee-800d-edde1e448bad"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"35382b86-0e98-5ab0-887e-c159b0661800"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8603629f-da14-567c-92bf-37b9b27f20ba"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e876879a-cd91-52a1-a1da-35ee9ed90475"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"acecf283-289d-5e82-a88b-9e6038019d43"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cede5810-2983-55cf-9714-65f6e28887bc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a863b2b9-7adf-5a35-83a4-b5e9c9a985cc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f328e566-af01-5e3d-9198-542666c40a61"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7ac712c5-9358-53c6-bebc-606a1bbba90e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ec3ba7ee-9cbd-500c-b877-85672a529f91"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"84884773-6dda-5871-aad1-5a66c248b1f3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6c716ede-1980-55af-b709-383c37d65dc5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"58374661-7410-51a1-9bc7-d9eae050aeb1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"105e4055-ae94-52e9-abba-f4a889c45798"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a08cba50-5982-548f-840f-744137d089cd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b29b7aab-9aba-588c-9820-b14583177c71"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ef4066b6-a3d5-5089-b85f-661fd458a030"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3a65ee4b-51cc-5d55-a970-036855587841"}]},{"type":"milestone","uuid":"82e4ae47-5c59-52a5-bd7b-f2d1177f1c68","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.2_Configure_privilege_escalation"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"5.2 Configure privilege escalation","description":"There are various tools which allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.\n\n**sudo**\n\nsudo documentation\n\nThe invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy.\n\n`sudo` supports a plug-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug-ins to work seamlessly with the `sudo` front end. The default security policy is `sudoers`, which is configured via the file `/etc/sudoers` and any entries in `/etc/sudoers.d`.\n\n**pkexec**\n\npkexec documentation\n\n`pkexec` allows an authorized user to execute PROGRAM as another user. If username is not specified, then the program will be executed as the administrative super user, `root`.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7511af01-9a25-59a9-85d8-ee73f439b77b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4c194ba9-8c29-5e09-af21-c4bb0b189a48"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9a36445b-fee2-5d49-be82-caa87b3ea93d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d2b8c195-9bf8-57b8-8a0a-83234f920aa4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"95810d0c-7283-5fbb-9bc4-13bd9dd2d0a3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d9ef5df3-a781-5186-a3b4-5b090a2df012"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3e1ebdf0-1520-5571-adf2-d3eb1c0373a7"}]},{"type":"milestone","uuid":"46f562e0-33a4-561e-94fd-6fccae264455","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3_Pluggable_Authentication_Modules"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"83eec72a-bc56-53eb-8879-692a9c2ae4c7","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.1_Configure_PAM_software_packages"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"5.3.1 Configure PAM software packages","description":"Updated versions of PAM include additional functionality","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4fda5948-183d-5aaa-a40f-4f07a272e5e8"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a0824196-2ffb-59be-b45c-d0026e543d7e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f3248672-2e19-57d7-aee5-69c995a50b3b"}]},{"type":"milestone","uuid":"7abde080-73c4-5241-b841-8dd74e13b2a9","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.2_Configure_pam-auth-update_profiles"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"5.3.2 Configure pam-auth-update profiles","description":"`pam-auth-update` is a utility that permits configuring the central authentication policy for the system using pre-defined profiles as supplied by PAM module packages.\n\nProfiles - Shipped in the `/usr/share/pam-configs/` directory specify the modules, with options, to enable; the preferred ordering with respect to other profiles; and whether a profile should be enabled by default. Packages providing PAM modules register their profiles at install time by calling pam-auth-update --package.\n\nSelection of profiles is done using the standard `debconf` interface. The profile selection question will be asked at `medium` priority when packages are added or removed, so no user interaction is required by default. Users may invoke `pam-auth-update` directly to change their authentication configuration.\n\nThe `pam-auth-update` script makes every effort to respect local changes to `/etc/pam.d/common-*.` Local modifications to the list of module options will be preserved, and additions of modules within the managed portion of the stack will cause pam-auth-update to treat the config files as locally modified and not make further changes to the config files unless given the `--force` option.\n\nIf the user specifies that `pam-auth-update` should override local configuration changes, the locally-modified files will be saved in /etc/pam.d/ with a suffix of `.pam-old`.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"45d62c9c-bb8c-558c-acd0-cdd472f1e2d6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"926d045d-1176-55eb-83fe-c32b514fb245"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f28b97fb-e0d6-5cea-b28d-9485e62b9423"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b3c1c7d4-8cb5-523d-bc9a-98929c35cb8b"}]},{"type":"milestone","uuid":"1067dd37-c4a7-5745-8233-5f27574a2be3","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.3_Configure_PAM_Arguments"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"tasks":[{"type":"milestone","uuid":"4d25e1e1-1679-5a49-af17-805d40e8bdad","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.3.1_Configure_pam_faillock_module"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.3.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"5.3.3.1 Configure pam_faillock module","description":"`pam_faillock.so` provides a way to configure the default settings for locking the user after multiple failed authentication attempts.\n\nOptions:\n\n- `` - The directory where the user files with the failure records are kept. The default is /var/run/faillock. Note: These files will disappear after reboot on systems configured with directory /var/run/faillock mounted on virtual memory.\n- `audit` - Will log the user name into the system log if the user is not found.\n- `silent` - Don't print informative messages to the user. Please note that when this option is not used there will be difference in the authentication behavior for users which exist on the system and non-existing users.\n- `no_log_info` - Don't log informative messages via syslog(3).\n- `local_users_only` - Only track failed user authentications attempts for local users in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. The faillock(8) command will also no longer track user failed authentication attempts. Enabling this option will prevent a double-lockout scenario where a user is locked out locally and in the centralized mechanism.\n- `nodelay` - Don't enforce a delay after authentication failures.\n- `deny=` - Deny access if the number of consecutive authentication failures for this user during the recent interval exceeds . The default is 3.\n- `fail_interval=n` - The length of the interval during which the consecutive authentication failures must happen for the user account lock out is n seconds. The default is 900 (15 minutes).\n- `unlock_time=n` - The access will be re-enabled after n seconds after the lock out. The value 0 has the same meaning as value never - the access will not be re-enabled without resetting the faillock entries by the faillock(8) command. The default is 600 (10 minutes). Note that the default directory that pam_faillock uses is usually cleared on system boot so the access will be also re-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option. Also note that it is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers.\n- `even_deny_root` - Root account can become locked as well as regular accounts.\n- `root_unlock_time=n` - This option implies even_deny_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock_time option.\n- `admin_group=name` - If a group name is specified with this option, members of the group will be handled by this module the same as the root account (the options even_deny_root and root_unlock_time will apply to them. By default the option is not set.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6d5eb2cc-e72c-516c-8f29-c0e1848c648c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b283ebcf-912d-5034-8d2c-71389db7ccfe"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2fa73b76-b095-5412-aef9-15203e424e07"}]},{"type":"milestone","uuid":"a5f34535-b29d-52f7-9720-f5d2d23d6879","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.3.2_Configure_pam_pwquality_module"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.3.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"5.3.3.2 Configure pam_pwquality module","description":"The `pam_pwquality.so` module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more.\n\nThese checks are configurable by either:\n\n- use of the module arguments\n- modifying the `/etc/security/pwquality.conf` configuration file\n- creating a `.conf` file in the `/etc/security/pwquality.conf.d/` directory.\n\n**Note:** The module arguments override the settings in the `/etc/security/pwquality.conf` configuration file. Settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory.\n\nThe possible options in the file are:\n\n- `difok` - Number of characters in the new password that must not be present in the old password. (default 1). The special value of 0 disables all checks of similarity of the new password with the old password except the new password being exactly the same as the old one.\n- `minlen` - Minimum acceptable size for the new password (plus one if credits are not disabled which is the default). (See pam_pwquality(8).) Cannot be set to lower value than 6. (default 8)\n- `dcredit` - The maximum credit for having digits in the new password. If less than 0 it is the minimum number of digits in the new password. (default 0)\n- `ucredit` - The maximum credit for having uppercase characters in the new password. If less than 0 it is the minimum number of uppercase characters in the new password. (default 0)\n- `lcredit` - The maximum credit for having lowercase characters in the new password. If less than 0 it is the minimum number of lowercase characters in the new password. (default 0)\n- `ocredit` - The maximum credit for having other characters in the new password. If less than 0 it is the minimum number of other characters in the new password. (default 0)\n- `minclass` - The minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others). (default 0)\n- `maxrepeat` - The maximum number of allowed same consecutive characters in the new password. The check is disabled if the value is 0. (default 0)\n- `maxsequence` - The maximum length of monotonic character sequences in the new password. Examples of such sequence are '12345' or 'fedcb'. Note that most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password. The check is disabled if the value is 0. (default 0)\n- `maxclassrepeat` - The maximum number of allowed consecutive characters of the same class in the new password. The check is disabled if the value is 0. (default 0)\n- `gecoscheck` - If nonzero, check whether the words longer than 3 characters from the GECOS field of the user's passwd(5) entry are contained in the new password. The check is disabled if the value is 0. (default 0)\n- `dictcheck` - If nonzero, check whether the password (with possible modifications) matches a word in a dictionary. Currently the dictionary check is performed\nusing the cracklib library. (default 1)\n- `usercheck=` - If nonzero, check whether the password (with possible modifications) contains the user name in some form. It is not performed for user names\nshorter than 3 characters. (default 1)\n- `usersubstr=` - If greater than 3 (due to the minimum length in usercheck), check whether the password contains a substring of at least N length in some form.\n(default 0)\n- `enforcing=` - If nonzero, reject the password if it fails the checks, otherwise only print the warning. This setting applies only to the pam_pwquality module\nand possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1). (default 1)\n- `badwords` - Space separated list of words that must not be contained in the password. These are additional words to the cracklib dictionary check. This setting can be also used by applications to emulate the gecos check for user accounts that are not created yet.\n- `dictpath` - Path to the cracklib dictionaries. Default is to use the cracklib default.\n- `retry=` - Prompt user at most N times before returning with error. The default is 1.\n- `enforce_for_root` - The module will return error on failed check even if the user changing the password is root. This option is off by default which means that just the message about the failed check is printed but root can change the password anyway. Note that root is not asked for an old password so the checks that compare the old and new password are not performed.\n- `local_users_only` - The module will not test the password quality for users that are not present in the /etc/passwd file. The module still asks for the password so the following modules in the stack can use the use_authtok option. This option is off by default.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1d9d45b7-e918-56b2-9fce-0c1d0197a247"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e87ab7f1-e4c6-5cfd-b934-9dfbcd356681"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e8896ed3-ac04-5082-88dc-5fe758e5668d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2e0669db-62e8-550c-abdd-4f5b97617ba7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a8c875e4-a8ac-5ada-93ca-ece4ced896f2"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"30cb493d-884e-5bc1-a092-3b50edd16870"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a2b51651-c787-5556-b3bd-9a5f404d5065"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ce8af1c9-566a-5fb3-8c7e-a83c2a442b1d"}]},{"type":"milestone","uuid":"636c8018-90ec-5138-b5b6-23d228c19ce6","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.3.3_Configure_pam_pwhistory_module"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.3.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"5.3.3.3 Configure pam_pwhistory module","description":"`pam_pwhistory` - PAM module to remember last passwords\n\n`pam_history.so` module - This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.\n\nThis module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with `NIS` or `LDAP`, since the old passwords are stored on the local machine and are not available on another machine for password history checking.\n\nOptions:\n\n- `debug` - Turns on debugging via syslog(3).\n- `use_authtok` - When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the example of the stacking of the `pam_passwdqc module` documented below).\n- `enforce_for_root` - If this option is set, the check is enforced for root, too.\n- `remember=` - The last passwords for each user are saved. The default is `10`. Value of `0` makes the module to keep the existing contents of the opasswd file unchanged.\n- `retry=` - Prompt user at most times before returning with error. The default is `1`.\n- `authtok_type=` - See pam_get_authtok(3) for more details.\n\nExamples:\n\n```bash\nAn example password section would be:\n\n #%PAM-1.0\n password required pam_pwhistory.so\n password required pam_unix.so use_authtok\n\nIn combination with pam_passwdqc:\n\n #%PAM-1.0\n password required pam_passwdqc.so config=/etc/passwdqc.conf\n password required pam_pwhistory.so use_authtok\n password required pam_unix.so use_authtok\n```","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8bd1f390-820c-5f12-baa1-32a272180747"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"80bb2cc7-f0d9-55c5-892c-503f130e1bc6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"da7ec04e-885f-55a0-bca4-33a779bad54e"}]},{"type":"milestone","uuid":"1d9a8188-e6b0-5a72-b374-c2df243bea8c","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.3.3.4_Configure_pam_unix_module"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.3.3.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"5.3.3.4 Configure pam_unix module","description":"The `pam_unix.so` module is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the `/etc/passwd` and the `/etc/shadow` file as well if shadow is enabled.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"72740713-efb7-5dc4-bf2d-9499f569e0ad"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b3a1d4b8-c0d4-567d-925e-258b26b5898d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c095b8d8-ca07-5cf4-9853-d5dfcb63c26d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"64a1fe59-2ab9-5007-b100-e817f126bf70"}]}],"title":"5.3.3 Configure PAM Arguments","description":"Pluggable Authentication Modules (PAM) uses arguments to pass information to a pluggable module during authentication for a particular module type. These arguments allow the PAM configuration files for particular programs to use a common PAM module but in different ways.\n\nInvalid arguments are ignored and do not otherwise affect the success or failure of the PAM module. When an invalid argument is passed, an error is usually written to `/var/log/messages` file. However, since the reporting method is controlled by the PAM module, the module must be written correctly to log the error to this file.\n\n**Note:** If custom PAM files are being used, for this section's remediation, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped"}],"title":"5.3 Pluggable Authentication Modules","description":"5.3 Pluggable Authentication Modules"},{"type":"milestone","uuid":"7484b87f-69c2-5ab1-8258-9e0bc6b5017a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.4_User_Accounts_and_Environment"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"e19f7e99-bed6-53f9-94c7-a85b9005143f","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.4.1_Configure_shadow_password_suite_parameters"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.4.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"5.4.1 Configure shadow password suite parameters","description":"While a majority of the password control parameters have been moved to PAM, some parameters are still available through the shadow password suite. Any changes made to `/etc/login.defs `will only be applied if the `usermod `command is used. If user IDs are added a different way, use the `chage `command to effect changes to individual user IDs.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d30efac0-5449-59f2-8c16-a254eae58333"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"9f0b1347-21e1-54f7-9def-870627a3d98f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8ff0227b-6e05-5722-9351-6d786201a733"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b73cdd9c-4df5-537d-9efe-5a7391f647a6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"04f86ced-1cff-5ca9-9f70-dbacf2a8527e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5e4c739a-4ad6-5405-98ae-4fb63a37a43e"}]},{"type":"milestone","uuid":"28254210-b92f-5896-95b3-4f81f13aa6d4","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.4.2_Configure_root_and_system_accounts_and_environment"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.4.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"5.4.2 Configure root and system accounts and environment","description":"5.4.2 Configure root and system accounts and environment","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a5894ddc-6f82-5a32-95c6-3a0a288a7ac7"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"758f0b06-7390-5e95-b7d5-c1123ce6db57"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"57110c66-435e-5860-bb4b-a8d019b1de1a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"63f740eb-f146-5c94-a6a9-cd25429b5775"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"17386ef6-a6b0-50aa-a43b-0e32e2989466"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cac6d1be-88df-5825-b75f-89e64122575a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4d902eab-aaa2-5030-8779-ee6920fc04f1"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"64b73089-4fa4-5420-8d58-365d971b6fc8"}]},{"type":"milestone","uuid":"06ec9469-11af-505c-9343-e05d6d125207","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_5.4.3_Configure_user_default_environment"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"5.4.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"5.4.3 Configure user default environment","description":"5.4.3 Configure user default environment","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cb34742f-1b27-55c4-82d0-e9124295cf57"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f577403b-4288-5d3d-a65a-4d931459cf17"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c6879c3d-932e-51b8-afe6-253c0f8434ab"}]}],"title":"5.4 User Accounts and Environment","description":"This section provides guidance on setting up secure defaults for system and user accounts and their environment."}],"title":"5 Access Control","description":"5 Access Control"},{"type":"milestone","uuid":"cb1eb948-27ec-5190-bc10-5ef9b9335151","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6_Logging_and_Auditing"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"941ab1a4-1686-5e12-a010-7b3b28a00697","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1_System_Logging"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"a975fbf2-49eb-5b64-ae50-97c3a83ffeeb","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.1_Configure_systemd-journald_service"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.1.1 Configure systemd-journald service","description":"`systemd-journald` is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources:\n\n- Kernel log messages, via kmsg\n- Simple system log messages, via the libc syslog call\n- Structured system log messages via the native Journal API\n- Standard output and standard error of service units\n- Audit records, originating from the kernel audit subsystem\n\nThe daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way. See systemd.journal-fields man page for more information about the collected metadata.\n\nThe journal service stores log data either persistently below `/var/log/journal` or in a volatile way below `/run/log/journal/`. By default, log data is stored persistently if `/var/log/journal/` exists during boot, with an implicit fallback to volatile storage. Use `Storage=` in `journald.conf` to configure where log data is placed, independently of the existence of `/var/log/journal/`.\n\nOn systems where `/var/log/journal/` does not exist but where persistent logging is desired, and the default `journald.conf` is used, it is sufficient to create the directory and ensure it has the correct access modes and ownership.\n\n**Note:** `systemd-journald.service` must be configured appropriately for either `journald` **- OR -** `rsyslog` to operate effectively.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d95a7d7d-bcd5-54e9-a691-3e630ef06852"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"14c39c0e-2b90-52ec-b429-56c9c23c55ee"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"53801d05-4592-59f8-b409-9871439b959d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4b03b64e-6eff-5842-80d0-da1a3776c199"}]},{"type":"milestone","uuid":"85f56c23-781f-5823-9e4a-3f4cb9329c93","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.2_Configure_journald"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"tasks":[{"type":"milestone","uuid":"424fcdec-7c8a-5755-b14e-4533148140db","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.2_Configure_journald"},{"ns":"https://cisecurity.org/ns","name":"synthetic","value":"true"}],"title":"6.1.2 General","description":"Requirements that apply directly to 'Configure journald' rather than to one of its sub-groups.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"01956a85-a953-51dc-873d-b90c1365a97a"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7db33784-4a14-5102-97f0-db394cf6ad91"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f33ef7ed-963e-5538-b93c-a10c8e537038"}]},{"type":"milestone","uuid":"c5d233db-4b85-5341-a13c-f0b7551b3207","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.2.1_Configure_systemd-journal-remote"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1.2.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"3"}],"title":"6.1.2.1 Configure systemd-journal-remote","description":"The `systemd-journal-remote` package includes `systemd-journal-upload`.\n\n`systemd-journal-upload` will upload journal entries to the URL specified with --url=. This program reads journal entries from one or more journal files, similarly to journalctl.\n\n`systemd-journal-upload` transfers the raw content of journal file and uses HTTP as a transport protocol.\n\n`systemd-journal-upload.service` is a system service that uses `systemd-journal-upload` to upload journal entries to a server. It uses the configuration in `journal-upload.conf`.\n\n**Note:**\n\n- **- IF -** `rsyslog` is in use this subsection can be skipped.\n- `systemd-journal-remote` package is part of the `universe` component, this may impact support and update frequency which should be considered when assessing organizational risk.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"f18c6236-90c1-5fc8-abb2-2b36926d07fd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4eaf9a6f-7880-5ba2-ba46-8ec866e03d67"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ab1a0335-5402-56c1-aff5-a579d6d15c1e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0546fff2-b6f2-5d60-a9bd-0744e8c790bf"}]}],"title":"6.1.2 Configure journald","description":"Included in the systemd suite is a journaling service called systemd-journald.service for the collection and storage of logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources such as:\n\nClassic RFC3164 BSD syslog via the /dev/log socket\nSTDOUT/STDERR of programs via StandardOutput=journal + StandardError=journal in service files (both of which are default settings)\nKernel log messages via the /dev/kmsg device node\nAudit records via the kernel’s audit subsystem\nStructured log messages via journald’s native protocol\nAny changes made to the systemd-journald configuration will require a re-start of systemd-journald\n\n**Note:**\n\n**- IF -** `rsyslog` will be used for remote logging on the system this subsection can be skipped"},{"type":"milestone","uuid":"0ef5c0c4-8d0a-5e84-b8e3-d333c0802417","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.3_Configure_rsyslog"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.1.3 Configure rsyslog","description":"The `rsyslog` software package may be used instead of the default `journald` logging mechanism.\n\nRsyslog has evolved over several decades. For this reason it supports three different configuration formats (“languages”):\n\n- `basic` - previously known as the `sysklogd` format, this is the format best used to express basic things, such as where the statement fits on a single line.\n\nIt stems back to the original syslog.conf format, in use now for several decades.\n- The most common use case is matching on facility/severity and writing matching messages to a log file.\n\n- `advanced` - previously known as the `RainerScript` format, this format was first available in rsyslog v6 and is the current, best and most precise format for non-trivial use cases where more than one line is needed.\n\nPrior to v7, there was a performance impact when using this format that encouraged use of the basic format for best results. Current versions of rsyslog do not suffer from this (historical) performance impact.\n- This new style format is specifically targeted towards more advanced use cases like forwarding to remote hosts that might be partially offline.\n\n- `obsolete legacy` - previously known simply as the `legacy` format, this format is exactly what its name implies: it is obsolete and should not be used when writing new configurations. It was created in the early days (up to rsyslog version 5) where we expected that rsyslog would extend sysklogd just mildly. Consequently, it was primarily aimed at small additions to the original sysklogd format.\n\nPractice has shown that it was notoriously hard to use for more advanced use cases, and thus we replaced it with the advanced format.\n- In essence, everything that needs to be written on a single line that starts with a dollar sign is legacy format. Users of this format are encouraged to migrate to the basic or advanced formats.\n\n**Note:** This section only applies if `rsyslog` is the chosen method for client side logging. Do not apply this section if `journald` is used.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"682ea6e8-6cdd-5731-bfd6-a4ce4fec2812"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0f5b1c26-8867-5d45-9c5b-f065e011286d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a16bcca8-debe-5783-b9dd-d9d37fda0122"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5df94309-dd33-5f43-9451-4a9315170941"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b4bbdb56-6984-5850-accc-ae0b68bef66e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"2e860bcb-b6e0-5f95-9a32-c6ec3bd722eb"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"cd1d8024-8f7b-5b46-aa3e-9b74c9f8e2f0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"bc4c8753-ba9b-56f4-bcfe-6a97c0deca33"}]},{"type":"milestone","uuid":"e30a0c93-53a6-59d8-b765-c15482f76f7a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.1.4_Configure_Logfiles"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.1.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.1.4 Configure Logfiles","description":"6.1.4 Configure Logfiles","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b552e8fa-7f16-5a71-b254-54b221ba53b5"}]}],"title":"6.1 System Logging","description":"Logging services should be configured to prevent information leaks and to aggregate logs on a remote server so that they can be reviewed in the event of a system compromise. A centralized log server provides a single point of entry for further analysis, monitoring and filtering.\n\n**Security principals for logging**\n\n- Ensure transport layer security is implemented between the client and the log server.\n- Ensure that logs are rotated as per the environment requirements.\n- Ensure all locally generated logs have the appropriate permissions.\n- Ensure all security logs are sent to a remote log server.\n- Ensure the required events are logged.\n\n**What is covered**\n\nThis section will cover the minimum best practices for the usage of **either** `rsyslog` **- OR -** `journald`. The recommendations are written such that each is wholly independent of each other and **only one is implemented**.\n\n- If your organization makes use of an enterprise wide logging system completely outside of `rsyslog` or `journald`, then the following recommendations do not directly apply. However, the principals of the recommendations should be followed regardless of what solution is implemented. If the enterprise solution incorporates either of these tools, careful consideration should be given to the following recommendations to determine exactly what applies.\n- Should your organization make use of both `rsyslog` and `journald`, take care how the recommendations may or may not apply to you.\n\n**What is not covered**\n\n- Enterprise logging systems not utilizing `rsyslog` or `journald`. As logging is very situational and dependent on the local environment, not everything can be covered here.\n- Transport layer security should be applied to all remote logging functionality. Both `rsyslog` and `journald` supports secure transport and should be configured as such.\n- The log server. There are a multitude of reasons for a centralized log server (and keeping a short period logging on the local system), but the log server is out of scope for these recommendations."},{"type":"milestone","uuid":"5f2c0910-64fd-5561-b3c6-ff2abb160764","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.2_System_Auditing"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"tasks":[{"type":"milestone","uuid":"816395e0-4e06-5559-ad2c-66dd67e6d1e7","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.2.1_Configure_auditd_Service"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.2.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.2.1 Configure auditd Service","description":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e871ab34-b967-5686-bec6-762a4a587b7d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"10cb17c1-4e7d-50ec-adea-ce6c8661360b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"abdf9acd-4a10-5f4a-b69a-981bd52b369b"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"baea3dac-e558-5167-906f-fc8e2c4828d3"}]},{"type":"milestone","uuid":"d8eaa06f-8e25-57fb-a115-94b53efa6f17","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.2.2_Configure_Data_Retention"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.2.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.2.2 Configure Data Retention","description":"When auditing, it is important to carefully configure the storage requirements for audit logs. By default, auditd will max out the log files at 5MB and retain only 4 copies of them. Older versions will be deleted. It is possible on a system that the 20 MBs of audit logs may fill up the system causing loss of audit data. While the recommendations here provide guidance, check your site policy for audit storage requirements.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"dec9b679-cb94-54bf-80e8-070ecde391d4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"705fcf23-48c2-5d54-9b95-a45aa816adda"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"37694047-e15e-5ea8-a0cf-0cc72321a4a5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"b0317911-dd06-5ab3-aff4-18dc5ae9d64d"}]},{"type":"milestone","uuid":"1ad2e0ef-5be8-5de5-9bea-af5bdd97b00a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.2.3_Configure_auditd_Rules"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.2.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.2.3 Configure auditd Rules","description":"The Audit system operates on a set of rules that define what is to be captured in the log files.\n\nThe following types of Audit rules can be specified:\n\n- Control rules: Allow the Audit system's behavior and some of its configuration to be modified.\n- File system rules: Allow the auditing of access to a particular file or a directory. (Also known as file watches)\n- System call rules: Allow logging of system calls that any specified program makes.\n\nAudit rules can be set:\n\n- on the command line using the auditctl utility. Note that these rules are not persistent across reboots.\n- in a file ending in `.rules` in the `/etc/audit/rules.d/` directory.\n\n**Note:** The Linux Benchmarks are written and tested against x86_64 processor architecture. If you are running a different processor type, please review and update the audit rules for the processor architecture of the system","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e023c2a2-888e-50c6-88f0-65b39ee3e4f4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"fe078acc-fe32-551d-bcdd-428c4e79bb35"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"719d8a19-a3b7-5311-a029-75a739e2ea45"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"655e89f9-2096-5e17-b0fe-f9409ade2c52"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5b8f7971-db21-5ad7-a47d-9ce86d8ee2cc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"29cd22ec-6b7e-55f9-962d-895a372d8de4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1f752741-6551-5584-81cc-727d833b94db"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a02b2138-6371-58fd-b473-ce1d518211d5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"57c69c7e-d4c1-52a4-ae4b-1798e25c918c"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c85919c2-6000-5aed-9765-e4fef8e945c0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"189bc604-cc08-5aac-a22c-ae9fda7bf1b6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6734f57a-c84b-5417-8982-757e72041e65"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"04e8605b-d26f-534c-b7e3-f6cefbc4324e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7bbeff4b-a411-5364-a032-abed28fc3b14"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"fc946e66-407a-56b1-9020-274126f282ff"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"216f5a02-5aa5-5901-95e6-416ef0abb25f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6141eae1-2358-5bfa-a682-963ee970d4c4"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"107869c8-0d22-5672-bc8e-4e2b237331b6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"8566a6e6-cd54-5d53-ad43-2b8a5df90f86"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7c57d884-8e4c-57cc-9a6e-0b9dc2d8b2e0"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"0c8bbe21-c833-5e5e-bef1-e2f126d35e36"}]},{"type":"milestone","uuid":"272b09cc-6c7d-509c-bcae-d2f402450a0a","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.2.4_Configure_auditd_File_Access"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.2.4"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"2"}],"title":"6.2.4 Configure auditd File Access","description":"Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7c8dbb35-5a8b-5702-bcd9-3385edd925f6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6b8ff50b-e1c3-57f5-81d1-8768e15cf1ac"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ea046dbb-c6da-560d-bf3f-b5b4453161a5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4fcabcec-3525-5c2f-a3b5-8ee699acfa72"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3b27cb4f-34be-598e-a167-abf73a579c3f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"e6256b1b-1f0e-5251-b6dc-33abe4263364"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"71a5426c-b7c9-5a80-a15b-13cebe8fe9c6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d29bf7ad-1c5b-53ad-b7d9-874351af210d"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6dbe6a83-02b9-5200-8863-1248fc8d4f49"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"518977d6-b515-52c3-9bfa-5de48bebac37"}]}],"title":"6.2 System Auditing","description":"The Linux Auditing System operates on a set of rules that collects certain types of system activity to facilitate incident investigation, detect unauthorized access or modification of data. By default events will be logged to `/var/log/audit/audit.log`, which can be configured in `/etc/audit/auditd.conf`.\n\nThe following types of audit rules can be specified:\n\n- Control rules: Configuration of the auditing system.\n- File system rules: Allow the auditing of access to a particular file or a directory. Also known as file watches.\n- System call rules: Allow logging of system calls that any specified program makes.\n\nAudit rules can be set:\n\n- On the command line using the `auditctl` utility. These rules are not persistent across reboots.\n- In `/etc/audit/audit.rules`. These rules have to be merged and loaded before they are active.\n\n**Notes:**\n\n- For 64 bit systems that have `arch` as a rule parameter, you will need two rules: one for 64 bit and one for 32 bit systems calls.\n- If the auditing system is configured to be locked (`-e 2`), a system reboot will be required in order to load any changes.\n- Key names are optional on the rules and will not be used as a compliance auditing. The usage of key names is highly recommended as it facilitates organization and searching, as such, all remediation steps will have key names supplied.\n- It is best practice to store the rules, in number prepended files, in `/etc/audit/rules.d/`. Rules must end in a `.rules` suffix. This then requires the use of `augenrules` to merge all the rules into `/etc/audit/audit.rules` based on their their alphabetical (lexical) sort order. All benchmark recommendations follow this best practice for remediation, specifically using the prefix of `50` which is centre weighed if all rule sets make use of the number prepending naming convention.\n- Your system may have been customized to change the default `UID_MIN`. All samples output uses `1000`, but this value will not be used in compliance auditing. To confirm the `UID_MIN` for your system, run the following command: `awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs`\n\n**Normalization**\n\nThe Audit system normalizes some entries, so when you look at the sample output keep in mind that:\n\n- With regards to users whose login UID is not set, the values `-1` / `unset` / `4294967295` are equivalent and normalized to `-1`.\n- When comparing field types and both sides of the comparison is valid fields types, such as`euid!=uid`, then the auditing system may normalize such that the output is `uid!=euid`.\n- Some parts of the rule may be rearranged whilst others are dependant on previous syntax. For example, the following two statements are the same:\n\n```bash\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation\n```\n\nand\n\n```bash\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n```\n\n**Capacity planning**\n\nThe recommendations in this section implement auditing policies that not only produces large quantities of logged data, but may also negatively impact system performance. Capacity planning is critical in order not to adversely impact production environments.\n\n- Disk space. If a significantly large set of events are captured, additional on system or off system storage may need to be allocated. If the logs are not sent to a remote log server, ensure that log rotation is implemented else the disk will fill up and the system will halt. Even when logs are sent to a log server, ensure sufficient disk space to allow caching of logs in the case of temporary network outages.\n- Disk IO. It is not just the amount of data collected that should be considered, but the rate at which logs are generated.\n- CPU overhead. System call rules might incur considerable CPU overhead. Test the systems open/close syscalls per second with and without the rules to gauge the impact of the rules."},{"type":"milestone","uuid":"c16ac8cc-568d-5041-a96a-3c2e116b50d5","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_6.3_Configure_Integrity_Checking"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"6.3"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"6.3 Configure Integrity Checking","description":"AIDE is a file integrity checking tool, similar in nature to Tripwire. While it cannot prevent intrusions, it can detect unauthorized changes to configuration files by alerting when the files are changed. When setting up AIDE, decide internally what the site policy will be concerning integrity checking. Review the AIDE quick start guide and AIDE documentation before proceeding.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"528a8293-4eea-5f9f-b996-7cf8eb972a85"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"925d82c7-e1c7-58ff-8f4d-3db55b2246c8"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6dddd9aa-c084-5fc4-addf-c1b2ccccbfa0"}]}],"title":"6 Logging and Auditing","description":"The items in this section describe how to configure logging, log monitoring, and auditing, using tools included in most distributions.\n\nIt is recommended that `rsyslog `be used for logging (with `logwatch `providing summarization) and `auditd` be used for auditing (with `aureport `providing summarization) to automatically monitor logs for intrusion attempts and other suspicious system behavior.\n\nIn addition to the local log files created by the steps in this section, it is also recommended that sites collect copies of their system logs on a secure, centralized log server via an encrypted connection. Not only does centralized logging help sites correlate events that may be occurring on multiple systems, but having a second copy of the system log information may be critical after a system compromise where the attacker has modified the local log files on the affected system(s). If a log correlation system is deployed, configure it to process the logs described in this section.\n\nBecause it is often necessary to correlate log information from many different systems (particularly after a security incident) it is recommended that the time be synchronized among systems and devices connected to the local network. The standard Internet protocol for time synchronization is the Network Time Protocol (NTP), which is supported by most network-ready devices. Reference manual page for more information on configuring chrony.\n\nIt is important that all logs described in this section be monitored on a regular basis and correlated to determine trends. A seemingly innocuous entry in one log could be more significant when compared to an entry in another log.\n\n**Note on log file permissions:** There really isn't a \"one size fits all\" solution to the permissions on log files. Many sites utilize group permissions so that administrators who are in a defined security group, such as \"wheel\" do not have to elevate privileges to root in order to read log files. Also, if a third party log aggregation tool is used, it may need to have group permissions to read the log files, which is preferable to having it run setuid to root. Therefore, there are two remediation and audit steps for log file permissions. One is for systems that do not have a secured group method implemented that only permits root to read the log files (`root:root 600`). The other is for sites that do have such a setup and are designated as `root:securegrp 640 `where `securegrp` is the defined security group (in some cases `wheel`)."},{"type":"milestone","uuid":"d1ccfb3b-1c00-5006-87ae-8cd418b2e38d","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_7_System_Maintenance"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"7"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"0"}],"tasks":[{"type":"milestone","uuid":"ce32940a-0101-5078-9ab8-600b5525dbe9","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_7.1_System_File_Permissions"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"7.1"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"7.1 System File Permissions","description":"This section provides guidance on securing aspects of system files and directories.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"5bb44aa4-c43a-5897-8b54-aeeae77f391f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"53a8e1aa-2ad2-5574-9e6b-4e90d9a1d401"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"55403e90-cc15-55d9-a392-db002ea6a7be"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"436e26e9-27ef-57e3-99ac-578fac784309"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c7aba024-363d-5796-a936-f0752059b7b5"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1147d9e2-59c9-5d7e-8355-31b5c6312fbc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"15f83edb-b89e-502d-aa4e-228a19449afc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"10195f71-dd55-575a-a899-d2726fbdb18f"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c7a76866-18cf-5eb3-9083-67829ca783fd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"d774d26e-2a3c-5a40-981a-4fccf1793fc3"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"853824f5-4213-5a0b-bcee-89b116937e78"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"6794516b-777f-5591-a558-17850e518485"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3025db18-3076-5c84-82c1-53f6ff784126"}]},{"type":"milestone","uuid":"383e93e9-24e4-54ee-ada6-7759febbb086","props":[{"ns":"https://cisecurity.org/ns","name":"cis-group-id","value":"xccdf_org.cisecurity.benchmarks_group_7.2_Local_User_and_Group_Settings"},{"ns":"https://cisecurity.org/ns","name":"cis-group-number","value":"7.2"},{"ns":"https://cisecurity.org/ns","name":"cis-group-depth","value":"1"}],"title":"7.2 Local User and Group Settings","description":"This section provides guidance on securing aspects of the local users and groups.\n\n**Note:** The recommendations in this section check local users and groups. Any users or groups from other sources such as LDAP will not be audited. In a domain environment similar checks should be performed against domain users and groups.","associated-activities":[{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"4f12f77f-0dc7-54c1-9d84-31eb5784d2f6"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"1e2a5ad9-506c-5f51-a7b0-edb595ebef61"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"a16d353e-bff6-586d-9049-22e5a8ca5035"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"3809f16f-bbb5-5197-a939-4fb0c1a61041"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"434e4ceb-cbeb-5634-9aec-d72297dbe51e"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ee4e0305-3e03-5a78-bbc0-84a6334b2c40"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"7860759d-3b5c-5aa8-b969-37a2263e40fd"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"c741713b-7362-5599-8978-0f29fe8340fc"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"ac52d534-43a2-52c5-9c35-cb9d1c599450"},{"subjects":[{"type":"component","description":"Target system component under assessment.","include-all":{}}],"activity-uuid":"993d6513-9c65-5587-9de4-6db93b3eb9d1"}]}],"title":"7 System Maintenance","description":"Recommendations in this section are intended as maintenance and are intended to be checked on a frequent basis to ensure system stability. Many recommendations do not have quick remediations and require investigation into the cause and best fix available and may indicate an attempted breach of system security."}]}}