{"catalog":{"uuid":"e459578c-4a1c-407a-b7be-2690ab4f5baa","metadata":{"links":[{"href":"#9651ee78-952a-494b-901c-f6371566978f"},{"href":"#7d3206a6-70b5-460e-bc0f-7d7b645d64ad"},{"href":"#7b42ae75-f609-4be2-a7d5-f185b1f3f855"},{"href":"#db0f7cba-8a05-4672-98f9-2f6342a37386"},{"href":"#0509c93b-8c94-4243-bea8-f922719bb772"},{"href":"#c19fcbb6-4d2b-4b19-aa66-fed4b24b52f4"}],"props":[{"ns":"https://cisecurity.org/ns/oscal","name":"benchmark-version","value":"1.0.0"},{"ns":"https://cisecurity.org/ns/oscal","name":"publish-date","value":"2026-03-16"},{"name":"keywords","value":"benchmark, assessment"}],"title":"CIS Ubuntu Linux 24.04 LTS Benchmark","remarks":"This document provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 24.04 LTS systems running on x86\\_64 platforms.\n\nThis guide was developed and tested against Ubuntu Linux 24.04 LTS\n\nThe guidance within broadly assumes that operations are being performed as the `root` user, and executed under the default Bash version for the applicable distribution. Operations performed using `sudo` instead of the `root` user, or executed under another shell, may produce unexpected results, or fail to make the intended changes to the system. Non\\-root users may not be able to access certain areas of the system, especially after remediation has been performed. It is advisable to verify `root` users path integrity and the integrity of any programs being run prior to execution of commands and scripts included in this benchmark.\n\nThe default prompt for the `root` user is `#`, and as such all sample commands will have `#` as an additional indication that it is to be executed as `root`.\n\nTo obtain the latest version of this guide, please visit http://workbench.cisecurity.org. If you have questions, comments, or have identified ways to improve this guide, please write us at mailto:feedback@cisecurity.org.","version":"1.0.0","document-ids":[{"scheme":"http://oscal.io/oscal/identifier/content-uuid","identifier":"3478ea6b-71e8-4a0c-82ac-735f62c8e96f"}],"last-modified":"2026-03-20T16:11:09Z","oscal-version":"1.1.3"},"groups":[{"id":"cisb-ubnt24.04lts","title":"Recommendations","groups":[{"id":"cisb-ubnt24.04lts-001_grp","parts":[{"id":"cisb-ubnt24.04lts-001_ovrvw","name":"overview","prose":"Items in this section are advised for all systems but may be difficult or require extensive preparation after the initial setup of the system."}],"props":[{"name":"label","value":"1"}],"title":"Initial Setup","groups":[{"id":"cisb-ubnt24.04lts-001.001_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001_ovrvw","name":"overview","prose":"The file system is generally a built\\-in layer used to handle the data management of the storage."}],"props":[{"name":"label","value":"1.1"}],"title":"Filesystem","groups":[{"id":"cisb-ubnt24.04lts-001.001.001_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.001_ovrvw","name":"overview","prose":"Several uncommon filesystem types are supported under Linux. Removing support for unneeded filesystem types reduces the local attack surface of the system. If a filesystem type is not needed it should be disabled. Native Linux file systems are designed to ensure that built\\-in security controls function as expected. Non\\-native filesystems can lead to unexpected consequences to both the security and functionality of the system and should be used with caution. Many filesystems are created for niche use cases and are not maintained and supported as the operating systems are updated and patched. Users of non\\-native filesystems should ensure that there is attention and ongoing support for them, especially in light of frequent operating system changes.\n\nStandard network connectivity and Internet access to cloud storage may make the use of non\\-standard filesystem formats to directly attach heterogeneous devices much less attractive.\n\n**Note**: This should not be considered a comprehensive list of filesystems. You may wish to consider additions to those listed here for your environment. For the current available file system modules on the system see `/usr/lib/modules/$(uname -r)/kernel/fs`\n\n**Start up scripts**\n\nKernel modules loaded directly via `insmod` will ignore what is configured in the relevant `/etc/modprobe.d/*.conf` files. If modules are still being loaded after a reboot whilst having the correctly configured `blacklist` and `install` command, check for `insmod` entries in start up scripts such as `.bashrc`.\n\nYou may also want to check `/lib/modprobe.d/`. Please note that this directory should not be used for user defined module loading. Ensure that all such entries resides in `/etc/modprobe.d/*.conf` files.\n\n**Return values**\n\nUsing `/bin/false` as the command in disabling a particular module serves two purposes; to convey the meaning of the entry to the user and cause a non\\-zero return value. The latter can be tested for in scripts. Please note that `insmod` will ignore what is configured in the relevant `/etc/modprobe.d/*.conf` files. The preferred way to load modules is with `modprobe`."}],"props":[{"name":"label","value":"1.1.1"}],"title":"Configure Filesystem Kernel Modules","controls":[{"id":"cisb-ubnt24.04lts-001.001.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `cramfs` filesystem type is a compressed read\\-only Linux filesystem embedded in small footprint systems. A `cramfs` image can be used without having to first decompress the image."},{"id":"cisb-ubnt24.04lts-001.001.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `cramfs` module: \n\n**\\- IF \\-** the `cramfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install cramfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist cramfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r cramfs 2>/dev/null; rmmod cramfs 2>/dev/null` to remove `cramfs` from the kernel\n\n**\\- IF \\-** the `cramfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"cramfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `cramfs` module: \n\n**\\- IF \\-** the `cramfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install cramfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist cramfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r cramfs 2>/dev/null; rmmod cramfs 2>/dev/null` to remove `cramfs` from the kernel\n\n**\\- IF \\-** the `cramfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"cramfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"STIG Finding ID: V-230498"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.1_Ensure_cramfs_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure cramfs kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `freevxfs` filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP\\-UX operating systems."},{"id":"cisb-ubnt24.04lts-001.001.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `freevxfs` module: \n\n**\\- IF \\-** the `freevxfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install freevxfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist freevxfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r freevxfs 2>/dev/null; rmmod freevxfs 2>/dev/null` to remove `freevxfs` from the kernel\n\n**\\- IF \\-** the `freevxfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"freevxfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `freevxfs` module: \n\n**\\- IF \\-** the `freevxfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install freevxfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist freevxfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r freevxfs 2>/dev/null; rmmod freevxfs 2>/dev/null` to remove `freevxfs` from the kernel\n\n**\\- IF \\-** the `freevxfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"freevxfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.2_Ensure_freevxfs_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure freevxfs kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `hfs` filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems."},{"id":"cisb-ubnt24.04lts-001.001.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `hfs` module: \n\n**\\- IF \\-** the `hfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install hfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfs 2>/dev/null; rmmod hfs 2>/dev/null` to remove `hfs` from the kernel\n\n**\\- IF \\-** the `hfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `hfs` module: \n\n**\\- IF \\-** the `hfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install hfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfs 2>/dev/null; rmmod hfs 2>/dev/null` to remove `hfs` from the kernel\n\n**\\- IF \\-** the `hfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.3_Ensure_hfs_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure hfs kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `hfsplus` filesystem type is a hierarchical filesystem designed to replace `hfs` that allows you to mount Mac OS filesystems."},{"id":"cisb-ubnt24.04lts-001.001.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `hfsplus` module: \n\n**\\- IF \\-** the `hfsplus` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install hfsplus /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfsplus` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfsplus 2>/dev/null; rmmod hfsplus 2>/dev/null` to remove `hfsplus` from the kernel\n\n**\\- IF \\-** the `hfsplus` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfsplus\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `hfsplus` module: \n\n**\\- IF \\-** the `hfsplus` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install hfsplus /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist hfsplus` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r hfsplus 2>/dev/null; rmmod hfsplus 2>/dev/null` to remove `hfsplus` from the kernel\n\n**\\- IF \\-** the `hfsplus` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"hfsplus\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.4_Ensure_hfsplus_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure hfsplus kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `jffs2` (journaling flash filesystem 2) filesystem type is a log\\-structured filesystem used in flash memory devices."},{"id":"cisb-ubnt24.04lts-001.001.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `jffs2` module: \n\n**\\- IF \\-** the `jffs2` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install jffs2 /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist jffs2` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r jffs2 2>/dev/null; rmmod jffs2 2>/dev/null` to remove `jffs2` from the kernel\n\n**\\- IF \\-** the `jffs2` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"jffs2\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `jffs2` module: \n\n**\\- IF \\-** the `jffs2` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install jffs2 /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist jffs2` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r jffs2 2>/dev/null; rmmod jffs2 2>/dev/null` to remove `jffs2` from the kernel\n\n**\\- IF \\-** the `jffs2` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"jffs2\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.5_Ensure_jffs2_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure jffs2 kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.006_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`overlayfs` is a Linux filesystem that layers multiple filesystems to create a single unified view which allows a user to \"merge\" several mount points into a unified filesystem."},{"id":"cisb-ubnt24.04lts-001.001.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `overlayfs` has known CVE's: CVE\\-2023\\-32629, CVE\\-2023\\-2640, CVE\\-2023\\-0386. Disabling the `overlayfs` reduces the local attack surface by removing support for unnecessary filesystem types and mitigates potential risks associated with unauthorized execution of setuid files, enhancing the overall system security."},{"id":"cisb-ubnt24.04lts-001.001.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `overlayfs` module: \n\n**\\- IF \\-** the `overlayfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install overlayfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist overlayfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r overlayfs 2>/dev/null; rmmod overlayfs 2>/dev/null` to remove `overlayfs` from the kernel\n\n**\\- IF \\-** the `overlayfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\n**WARNING:** **If Container applications such as Docker, Kubernetes, Podman, Linux Containers (LXC), etc. are in use proceed with caution and consider the impact on containerized workloads, as disabling the `overlayfs` may severely disrupt containerization.**\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"overlayfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `overlayfs` module: \n\n**\\- IF \\-** the `overlayfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install overlayfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist overlayfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r overlayfs 2>/dev/null; rmmod overlayfs 2>/dev/null` to remove `overlayfs` from the kernel\n\n**\\- IF \\-** the `overlayfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\n**WARNING:** **If Container applications such as Docker, Kubernetes, Podman, Linux Containers (LXC), etc. are in use proceed with caution and consider the impact on containerized workloads, as disabling the `overlayfs` may severely disrupt containerization.**\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"overlayfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.006_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#71f01caa-6548-44fd-baa6-52bf370ec097"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.6_Ensure_overlayfs_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure overlayfs kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.007_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `squashfs` filesystem type is a compressed read\\-only Linux filesystem embedded in small footprint systems. A `squashfs` image can be used without having to first decompress the image."},{"id":"cisb-ubnt24.04lts-001.001.001.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `udf` module: \n\n**\\- IF \\-** the `squashfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install squashfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist squashfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r squashfs 2>/dev/null; rmmod squashfs 2>/dev/null` to remove `squashfs` from the kernel\n\n**\\- IF \\-** the `squashfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nAs Snap packages utilize `squashfs` as a compressed filesystem, disabling `squashfs` will cause Snap packages to fail. \n\n`Snap` application packages of software are self\\-contained and work across a range of Linux distributions. This is unlike traditional Linux package management approaches, like APT or RPM, which require specifically adapted packages per Linux distribution on an application update and delay therefore application deployment from developers to their software's end\\-user. Snaps themselves have no dependency on any external store (\"App store\"), can be obtained from any source and can be therefore used for upstream software deployment.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"squashfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `udf` module: \n\n**\\- IF \\-** the `squashfs` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install squashfs /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist squashfs` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r squashfs 2>/dev/null; rmmod squashfs 2>/dev/null` to remove `squashfs` from the kernel\n\n**\\- IF \\-** the `squashfs` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nAs Snap packages utilize `squashfs` as a compressed filesystem, disabling `squashfs` will cause Snap packages to fail. \n\n`Snap` application packages of software are self\\-contained and work across a range of Linux distributions. This is unlike traditional Linux package management approaches, like APT or RPM, which require specifically adapted packages per Linux distribution on an application update and delay therefore application deployment from developers to their software's end\\-user. Snaps themselves have no dependency on any external store (\"App store\"), can be obtained from any source and can be therefore used for upstream software deployment.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"squashfs\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.7_Ensure_squashfs_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure squashfs kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.008_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `udf` filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA\\-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats."},{"id":"cisb-ubnt24.04lts-001.001.001.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."},{"id":"cisb-ubnt24.04lts-001.001.001.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `udf` module: \n\n**\\- IF \\-** the `udf` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install udf /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist udf` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r udf 2>/dev/null; rmmod udf 2>/dev/null` to remove `udf` from the kernel\n\n**\\- IF \\-** the `udf` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nMicrosoft Azure requires the usage of `udf`. \n\n`udf` **should not** be disabled on systems run on Microsoft Azure.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"udf\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `udf` module: \n\n**\\- IF \\-** the `udf` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install udf /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist udf` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r udf 2>/dev/null; rmmod udf 2>/dev/null` to remove `udf` from the kernel\n\n**\\- IF \\-** the `udf` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nMicrosoft Azure requires the usage of `udf`. \n\n`udf` **should not** be disabled on systems run on Microsoft Azure.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"udf\" l_mod_type=\"fs\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.1.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.8_Ensure_udf_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure udf kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"USB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB\\-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment."},{"id":"cisb-ubnt24.04lts-001.001.001.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware."},{"id":"cisb-ubnt24.04lts-001.001.001.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `usb-storage` module: \n\n**\\- IF \\-** the `usb-storage` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install usb-storage /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist usb-storage` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r usb-storage 2>/dev/null; rmmod usb-storage 2>/dev/null` to remove `usb-storage` from the kernel\n\n**\\- IF \\-** the `usb-storage` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nDisabling the `usb-storage` module will disable any usage of USB storage devices. \n\nIf requirements and local site policy allow the use of such devices, other solutions should be configured accordingly instead. One example of a commonly used solution is `USBGuard`.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"usb-storage\" l_mod_type=\"drivers\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `usb-storage` module: \n\n**\\- IF \\-** the `usb-storage` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install usb-storage /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist usb-storage` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r usb-storage 2>/dev/null; rmmod usb-storage 2>/dev/null` to remove `usb-storage` from the kernel\n\n**\\- IF \\-** the `usb-storage` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary \n\nImpact: \n\nDisabling the `usb-storage` module will disable any usage of USB storage devices. \n\nIf requirements and local site policy allow the use of such devices, other solutions should be configured accordingly instead. One example of a commonly used solution is `USBGuard`.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"usb-storage\" l_mod_type=\"drivers\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#a49162d5-d194-4695-81c5-52c52a3b5e4f"},{"rel":"reference","href":"#d3322cdd-c2af-44ce-9f5a-11222553f5a5"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-3"}]}],"props":[{"name":"label","value":"1.1.1.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.9_Ensure_usb-storage_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure usb-storage kernel module is not available"},{"id":"cisb-ubnt24.04lts-001.001.001.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.001.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.001.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Filesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so\\-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls."},{"id":"cisb-ubnt24.04lts-001.001.001.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"While loadable filesystem kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of loadable filesystem kernel modules in this way.\n\nRemoving support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it. The following filesystem kernel modules have known CVE's and should be made unavailable if no dependencies exist:\n\n- `afs` \\- CVE\\-2022\\-37402\n- `ceph` \\- CVE\\-2022\\-0670\n- `cifs` \\- CVE\\-2022\\-29869\n- `exfat` CVE\\-2022\\-29973\n- `ext` CVE\\-2022\\-1184\n- `fat` CVE\\-2022\\-22043\n- `fscache` CVE\\-2022\\-3630\n- `fuse` CVE\\-2023\\-0386\n- `gfs2` CVE\\-2023\\-3212\n- `nfs_common` CVE\\-2023\\-6660\n- `nfsd` CVE\\-2022\\-43945\n- `smbfs_common` CVE\\-2022\\-2585"},{"id":"cisb-ubnt24.04lts-001.001.001.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** the module is available in the running kernel: \n\n- Unload the filesystem kernel module from the kernel\n- Create a file ending in `.conf` with install filesystem kernel modules `/bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with deny list filesystem kernel modules in the `/etc/modprobe.d/` directory\n\n**WARNING**: unloading, disabling or denylisting filesystem modules that are in use on the system maybe FATAL. It is extremely important to thoroughly review the filesystems returned by the audit before following the remediation procedure. \n\n*Example of unloading the `gfs2`kernel module:* \n\n*Example of fully disabling the `gfs2` kernel module:* \n\n**Note:** \n\n- Disabling a kernel module by modifying the command above for each unused filesystem kernel module\n- The example `gfs2` must be updated with the appropriate module name for the command or example script bellow to run correctly.\n\n**Below is an example Script that can be modified to use on various filesystem kernel modules manual remediation process:** \n\n*Example Script* \n\nImpact: \n\nThis list may be quite extensive and covering all edges cases is difficult. Therefore, it's crucial to carefully consider the implications and dependencies before making any changes to the filesystem kernel module configurations.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=(); l_dl=\"\" # Initialize arrays and clear variables\n l_mod_name=\"gfs2\" # set module name\n l_mod_type=\"fs\" # set module type\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" # Set to ignore duplicate checks\n a_showconfig=() # Create array with modprobe output\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_name\" &> /dev/null; then # Check if the module is currently loaded\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n echo -e \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\n```\n# printf '%s\\n' \"blacklist gfs2\" \"install gfs2 /bin/false\" >> /etc/modprobe.d/gfs2.conf\n```\n\n```\n# modprobe -r gfs2 2>/dev/null\n# rmmod gfs2 2>/dev/null\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** the module is available in the running kernel: \n\n- Unload the filesystem kernel module from the kernel\n- Create a file ending in `.conf` with install filesystem kernel modules `/bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with deny list filesystem kernel modules in the `/etc/modprobe.d/` directory\n\n**WARNING**: unloading, disabling or denylisting filesystem modules that are in use on the system maybe FATAL. It is extremely important to thoroughly review the filesystems returned by the audit before following the remediation procedure. \n\n*Example of unloading the `gfs2`kernel module:* \n\n*Example of fully disabling the `gfs2` kernel module:* \n\n**Note:** \n\n- Disabling a kernel module by modifying the command above for each unused filesystem kernel module\n- The example `gfs2` must be updated with the appropriate module name for the command or example script bellow to run correctly.\n\n**Below is an example Script that can be modified to use on various filesystem kernel modules manual remediation process:** \n\n*Example Script* \n\nImpact: \n\nThis list may be quite extensive and covering all edges cases is difficult. Therefore, it's crucial to carefully consider the implications and dependencies before making any changes to the filesystem kernel module configurations.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=(); l_dl=\"\" # Initialize arrays and clear variables\n l_mod_name=\"gfs2\" # set module name\n l_mod_type=\"fs\" # set module type\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" # Set to ignore duplicate checks\n a_showconfig=() # Create array with modprobe output\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_name\" &> /dev/null; then # Check if the module is currently loaded\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n echo -e \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```\n\n```\n# printf '%s\\n' \"blacklist gfs2\" \"install gfs2 /bin/false\" >> /etc/modprobe.d/gfs2.conf\n```\n\n```\n# modprobe -r gfs2 2>/dev/null\n# rmmod gfs2 2>/dev/null\n```"},{"id":"cisb-ubnt24.04lts-001.001.001.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.001.010_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#793fab00-89a0-4fd6-959b-fc8fe679d274"}],"props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"1.1.1.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.1.10_Ensure_unused_filesystems_kernel_modules_are_not_available"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure unused filesystems kernel modules are not available"}]},{"id":"cisb-ubnt24.04lts-001.001.002_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002_ovrvw","name":"overview","prose":"Directories that are used for system\\-wide functions can be further protected by placing them on separate partitions. This provides protection for resource exhaustion and enables the use of mounting options that are applicable to the directory's intended use. Users' data can be stored on separate partitions and have stricter mount options. A user partition is a filesystem that has been established for use by the users and does not contain software for system operations.\n\nThe recommendations in this section are easier to perform during initial system installation. If the system is already installed, it is recommended that a full backup be performed before repartitioning the system.\n\n**Note:**\n\n**\\-IF\\-** you are repartitioning a system that has already been installed (This may require the system to be in single\\-user mode):\n\n- Mount the new partition to a temporary mountpoint e.g. `mount /dev/sda2 /mnt`\n- Copy data from the original partition to the new partition. e.g. `cp -a /var/tmp/* /mnt`\n- Verify that all data is present on the new partition. e.g. `ls -la /mnt`\n- Unmount the new partition. e.g. `umount /mnt`\n- Remove the data from the original directory that was in the old partition. e.g. `rm -Rf /var/tmp/*` Otherwise it will still consume space in the old partition that will be masked when the new filesystem is mounted.\n- Mount the new partition to the desired mountpoint. e.g. `mount /dev/sda2 /var/tmp`\n- Update `/etc/fstab` with the new mountpoint. e.g. `/dev/sda2 /var/tmp xfs defaults,rw,nosuid,nodev,noexec,relatime 0 0`"}],"props":[{"name":"label","value":"1.1.2"}],"title":"Configure Filesystem Partitions","groups":[{"id":"cisb-ubnt24.04lts-001.001.002.001_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.001_ovrvw","name":"overview","prose":"The `/tmp` directory is a world\\-writable directory used to store data used by the system and user applications for a short period of time. This data should have no expectation of surviving a reboot, as this directory is intended to be emptied after each reboot."}],"props":[{"name":"label","value":"1.1.2.1"}],"title":"Configure /tmp","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/tmp` directory is a world\\-writable directory used for temporary storage by all users and some applications.\n\n**\\- IF \\-** an entry for `/tmp` exists in `/etc/fstab` it will take precedence over entries in systemd default unit file.\n\n**Note:** In an environment where the main system is diskless and connected to iSCSI, entries in `/etc/fstab` may not take precedence.\n\n`/tmp` can be configured to use `tmpfs`.\n\n`tmpfs` puts everything into the kernel internal caches and grows and shrinks to accommodate the files it contains and is able to swap unneeded pages out to swap space. It has maximum size limits which can be adjusted on the fly via `mount -o remount`.\n\nSince `tmpfs` lives completely in the page cache and on swap, all `tmpfs` pages will be shown as \"Shmem\" in `/proc/meminfo` and \"Shared\" in `free`. Notice that these counters also include shared memory. The most reliable way to get the count is using `df` and `du`.\n\n`tmpfs` has three mount options for sizing:\n\n- `size`: The limit of allocated bytes for this `tmpfs` instance. The default is half of your physical RAM without swap. If you oversize your `tmpfs` instances the machine will deadlock since the OOM handler will not be able to free that memory.\n- `nr_blocks`: The same as size, but in blocks of PAGE\\_SIZE.\n- `nr_inodes`: The maximum number of inodes for this instance. The default is half of the number of your physical RAM pages, or (on a machine with highmem) the number of lowmem RAM pages, whichever is the lower.\n\nThese parameters accept a suffix k, m or g and can be changed on remount. The size parameter also accepts a suffix % to limit this `tmpfs` instance to that percentage of your physical RAM. The default, when neither `size` nor `nr_blocks` is specified, is `size=50%`."},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Making `/tmp` its own file system allows an administrator to set additional mount options such as the `noexec` option on the mount, making `/tmp` useless for an attacker to install executable code. It would also prevent an attacker from establishing a hard link to a system `setuid` program and wait for it to be updated. Once the program was updated, the hard link would be broken, and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.\n\nThis can be accomplished by either mounting `tmpfs` to `/tmp`, or creating a separate partition for `/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"First ensure that systemd is correctly configured to ensure that `/tmp` will be mounted at boot time. \n\nFor specific configuration requirements of the `/tmp` mount for your environment, modify `/etc/fstab`. \n\nExample of using `tmpfs` with specific mount options: \n\n**Note:** the `size=2G` is an example of setting a specific size for `tmpfs`. \n\nExample of using a volume or disk with specific mount options. The source location of the volume or disk will vary depending on your environment: \n\nImpact: \n\nBy design files saved to `/tmp` should have no expectation of surviving a reboot of the system. `tmpfs` is ram based and all files stored to `tmpfs` will be lost when the system is rebooted. \n\nIf files need to be persistent through a reboot, they should be saved to `/var/tmp` not `/tmp`. \n\nSince the `/tmp` directory is intended to be world\\-writable, there is a risk of resource exhaustion if it is not bound to `tmpfs` or a separate partition. \n\nRunning out of `/tmp` space is a problem regardless of what kind of filesystem lies under it, but in a configuration where `/tmp` is not a separate file system it will essentially have the whole disk available, as the default installation only creates a single `/` partition. On the other hand, a RAM\\-based `/tmp` (as with `tmpfs`) will almost certainly be much smaller, which can lead to applications filling up the filesystem much more easily. Another alternative is to create a dedicated partition for `/tmp` from a separate volume or disk. One of the downsides of a disk\\-based dedicated partition is that it will be slower than `tmpfs` which is RAM\\-based.\n\n```\n /tmp defaults,nodev,nosuid,noexec 0 0\n```\n\n```\ntmpfs\t/tmp\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```\n\n```\n# systemctl unmask tmp.mount\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"First ensure that systemd is correctly configured to ensure that `/tmp` will be mounted at boot time. \n\nFor specific configuration requirements of the `/tmp` mount for your environment, modify `/etc/fstab`. \n\nExample of using `tmpfs` with specific mount options: \n\n**Note:** the `size=2G` is an example of setting a specific size for `tmpfs`. \n\nExample of using a volume or disk with specific mount options. The source location of the volume or disk will vary depending on your environment: \n\nImpact: \n\nBy design files saved to `/tmp` should have no expectation of surviving a reboot of the system. `tmpfs` is ram based and all files stored to `tmpfs` will be lost when the system is rebooted. \n\nIf files need to be persistent through a reboot, they should be saved to `/var/tmp` not `/tmp`. \n\nSince the `/tmp` directory is intended to be world\\-writable, there is a risk of resource exhaustion if it is not bound to `tmpfs` or a separate partition. \n\nRunning out of `/tmp` space is a problem regardless of what kind of filesystem lies under it, but in a configuration where `/tmp` is not a separate file system it will essentially have the whole disk available, as the default installation only creates a single `/` partition. On the other hand, a RAM\\-based `/tmp` (as with `tmpfs`) will almost certainly be much smaller, which can lead to applications filling up the filesystem much more easily. Another alternative is to create a dedicated partition for `/tmp` from a separate volume or disk. One of the downsides of a disk\\-based dedicated partition is that it will be slower than `tmpfs` which is RAM\\-based.\n\n```\n /tmp defaults,nodev,nosuid,noexec 0 0\n```\n\n```\ntmpfs\t/tmp\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```\n\n```\n# systemctl unmask tmp.mount\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.001.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#969b5424-4ef4-46f0-96ed-1b87789f1d13"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.2.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.1_Ensure_tmp_is_a_separate_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure /tmp is a separate partition"},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/tmp` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/tmp` with the configured options:\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/tmp` with the configured options:\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.2_Ensure_nodev_option_set_on_tmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /tmp partition"},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot create `setuid` files in `/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/tmp` partition. \n\nExample: \n\nRun the following command to remount `/tmp` with the configured options:\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/tmp` partition. \n\nExample: \n\nRun the following command to remount `/tmp` with the configured options:\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.3_Ensure_nosuid_option_set_on_tmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /tmp partition"},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from `/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/tmp` partition. \n\nExample: \n\nRun the following command to remount `/tmp` with the configured options: \n\nImpact: \n\nSetting the `noexec` option on `/tmp` may prevent installation and/or updating of some 3rd party software.\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/tmp`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/tmp` partition. \n\nExample: \n\nRun the following command to remount `/tmp` with the configured options: \n\nImpact: \n\nSetting the `noexec` option on `/tmp` may prevent installation and/or updating of some 3rd party software.\n\n```\n# mount -o remount /tmp\n```\n\n```\n /tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.1.4_Ensure_noexec_option_set_on_tmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure noexec option set on /tmp partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.002_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.002_ovrvw","name":"overview","prose":"The `/dev/shm` directory is a world\\-writable directory that can function as shared memory that facilitates inter process communication (IPC)"}],"props":[{"name":"label","value":"1.1.2.2"}],"title":"Configure /dev/shm","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/dev/shm` directory is a world\\-writable directory that can function as shared memory that facilitates inter process communication (IPC)."},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Making `/dev/shm` its own file system allows an administrator to set additional mount options such as the `noexec` option on the mount, making `/dev/shm` useless for an attacker to install executable code. It would also prevent an attacker from establishing a hard link to a system `setuid` program and wait for it to be updated. Once the program was updated, the hard link would be broken and the attacker would have his own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw.\n\nThis can be accomplished by mounting `tmpfs` to `/dev/shm`."},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For specific configuration requirements of the `/dev/shm` mount for your environment, modify `/etc/fstab`. \n\n*Example:* \n\nImpact: \n\nSince the `/dev/shm` directory is intended to be world\\-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. \n\n`/dev/shm` utilizing `tmpfs` can be resized using the `size={size}` parameter in the relevant entry in `/etc/fstab`.\n\n```\ntmpfs\t/dev/shm\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For specific configuration requirements of the `/dev/shm` mount for your environment, modify `/etc/fstab`. \n\n*Example:* \n\nImpact: \n\nSince the `/dev/shm` directory is intended to be world\\-writable, there is a risk of resource exhaustion if it is not bound to a separate partition. \n\n`/dev/shm` utilizing `tmpfs` can be resized using the `size={size}` parameter in the relevant entry in `/etc/fstab`.\n\n```\ntmpfs\t/dev/shm\ttmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.002.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#af98eab8-d0f5-49e0-b1bb-5bfab23f0728"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"1.1.2.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.1_Ensure_devshm_is_a_separate_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure /dev/shm is a separate partition"},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/dev/shm` filesystem is not intended to support devices, set this option to ensure that users cannot attempt to create special devices in `/dev/shm` partitions."},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"1.1.2.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.2_Ensure_nodev_option_set_on_devshm_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /dev/shm partition"},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting this option on a file system prevents users from introducing privileged programs onto the system and allowing non\\-root users to execute them."},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/dev/shm` partition. See the `fstab(5)` manual page for more information. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"1.1.2.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.3_Ensure_nosuid_option_set_on_devshm_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /dev/shm partition"},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting this option on a file system prevents users from executing programs from shared memory. This deters users from introducing potentially malicious software on the system."},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/dev/shm` partition. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/dev/shm`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/dev/shm` partition. \n\n*Example:* \n\nRun the following command to remount `/dev/shm` with the configured options: \n\n**Note:** It is recommended to use `tmpfs` as the device/filesystem type as `/dev/shm` is used as shared memory space by applications.\n\n```\n# mount -o remount /dev/shm\n```\n\n```\ntmpfs /dev/shm tmpfs defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.2.4_Ensure_noexec_option_set_on_devshm_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure noexec option set on /dev/shm partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.003_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.003_ovrvw","name":"overview","prose":"Please note that home directories can be mounted anywhere and are not necessarily restricted to `/home`, nor restricted to a single location, nor is the name restricted in any way.\n\nFinding user home directories can be done by looking in `/etc/passwd`, looking over the mounted file systems with `mount` or querying the relevant database with `getent`.\n\n```\nfor user in $(awk -F ':' '{print $1}' /etc/passwd); do echo \"${user} - $(sudo getent passwd ${user} | awk -F ':' '{print $NF}')\"; done\n```"}],"props":[{"name":"label","value":"1.1.2.3"}],"title":"Configure /home","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.003.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/home` directory is used to support disk storage needs of local users."},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The default installation only creates a single `/` partition. Since the `/home` directory contains user generated data, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole. In addition, other operations on the system could fill up the disk unrelated to `/home` and impact all local users.\n\nConfiguring `/home` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. In the case of `/home` options such as `usrquota/grpquota` may be considered to limit the impact that users can have on each other with regards to disk resource exhaustion. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem\\-independent and filesystem\\-specific options.\n\nAs `/home` contains user data, care should be taken to ensure the security and integrity of the data and mount point."},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/home`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/home`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"AJ Lewis, \"LVM HOWTO\", http://tldp.org/HOWTO/LVM-HOWTO/"}]}],"props":[{"name":"label","value":"1.1.2.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.1_Ensure_separate_partition_exists_for_home"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure separate partition exists for /home"},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/home` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/home`."},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/home`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/home` partition. \n\n*Example:* \n\nRun the following command to remount `/home` with the configured options:\n\n```\n# mount -o remount /home\n```\n\n```\n /home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/home`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/home` partition. \n\n*Example:* \n\nRun the following command to remount `/home` with the configured options:\n\n```\n# mount -o remount /home\n```\n\n```\n /home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.2_Ensure_nodev_option_set_on_home_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /home partition"},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/home` filesystem is only intended for user file storage, set this option to ensure that users cannot create `setuid` files in `/home`."},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/home`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/home` partition. \n\n*Example:* \n\nRun the following command to remount `/home` with the configured options:\n\n```\n# mount -o remount /home\n```\n\n```\n /home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/home`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/home` partition. \n\n*Example:* \n\nRun the following command to remount `/home` with the configured options:\n\n```\n# mount -o remount /home\n```\n\n```\n /home defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.3.3_Ensure_nosuid_option_set_on_home_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /home partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.004_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.004_ovrvw","name":"overview","prose":"The `/var` directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world\\-writable."}],"props":[{"name":"label","value":"1.1.2.4"}],"title":"Configure /var","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.004.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.004.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/var` directory is used by daemons and other system services to temporarily store dynamic data. Some directories created by these processes may be world\\-writable."},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The reasoning for mounting `/var` on a separate partition is as follows.\n\nThe default installation only creates a single `/` partition. Since the `/var` directory may contain world writable files and directories, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system. In addition, other operations on the system could fill up the disk unrelated to `/var` and cause unintended behavior across the system as the disk is full. See `man auditd.conf` for details.\n\nConfiguring `/var` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem\\-independent and filesystem\\-specific options.\n\nAn example of exploiting `/var` may be an attacker establishing a hard\\-link to a system `setuid` program and waiting for it to be updated. Once the program is updated, the hard\\-link can be broken and the attacker would have their own copy of the program. If the program happened to have a security vulnerability, the attacker could continue to exploit the known flaw."},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.004.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"AJ Lewis, \"LVM HOWTO\", http://tldp.org/HOWTO/LVM-HOWTO/"}]}],"props":[{"name":"label","value":"1.1.2.4.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.1_Ensure_separate_partition_exists_for_var"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure separate partition exists for /var"},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.004.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var`."},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var` partition. \n\n*Example:* \n\nRun the following command to remount `/var` with the configured options:\n\n```\n# mount -o remount /var\n```\n\n```\n /var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var` partition. \n\n*Example:* \n\nRun the following command to remount `/var` with the configured options:\n\n```\n# mount -o remount /var\n```\n\n```\n /var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.004.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.4.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.2_Ensure_nodev_option_set_on_var_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /var partition"},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.004.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var` filesystem is only intended for variable files such as logs, set this option to ensure that users cannot create `setuid` files in `/var`."},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var` partition. \n\n*Example:* \n\nRun the following command to remount `/var` with the configured options:\n\n```\n# mount -o remount /var\n```\n\n```\n /var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var` partition. \n\n*Example:* \n\nRun the following command to remount `/var` with the configured options:\n\n```\n# mount -o remount /var\n```\n\n```\n /var defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.004.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.4.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.4.3_Ensure_nosuid_option_set_on_var_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /var partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.005_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.005_ovrvw","name":"overview","prose":"The `/var/tmp` directory is a world\\-writable directory used for temporary storage by all users and some applications. Temporary files residing in `/var/tmp` are to be preserved between reboots."}],"props":[{"name":"label","value":"1.1.2.5"}],"title":"Configure /var/tmp","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.005.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.005.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/var/tmp` directory is a world\\-writable directory used for temporary storage by all users and some applications. Temporary files residing in `/var/tmp` are to be preserved between reboots."},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The default installation only creates a single `/` partition. Since the `/var/tmp` directory is world\\-writable, there is a risk of resource exhaustion. In addition, other operations on the system could fill up the disk unrelated to `/var/tmp` and cause potential disruption to daemons as the disk is full.\n\nConfiguring `/var/tmp` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system."},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/tmp`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/tmp`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.005.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"AJ Lewis, \"LVM HOWTO\", http://tldp.org/HOWTO/LVM-HOWTO/"}]}],"props":[{"name":"label","value":"1.1.2.5.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.1_Ensure_separate_partition_exists_for_vartmp"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure separate partition exists for /var/tmp"},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.005.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/tmp` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.005.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.5.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.2_Ensure_nodev_option_set_on_vartmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /var/tmp partition"},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.005.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot create `setuid` files in `/var/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.005.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.5.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.3_Ensure_nosuid_option_set_on_vartmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /var/tmp partition"},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.005.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/tmp` filesystem is only intended for temporary file storage, set this option to ensure that users cannot run executable binaries from `/var/tmp`."},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/tmp`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/tmp` partition. \n\n*Example:* \n\nRun the following command to remount `/var/tmp` with the configured options:\n\n```\n# mount -o remount /var/tmp\n```\n\n```\n /var/tmp defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.005.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.5.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.5.4_Ensure_noexec_option_set_on_vartmp_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure noexec option set on /var/tmp partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.006_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.006_ovrvw","name":"overview","prose":"The `/var/log` directory is used by system services to store log data."}],"props":[{"name":"label","value":"1.1.2.6"}],"title":"Configure /var/log","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.006.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.006.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/var/log` directory is used by system services to store log data."},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The default installation only creates a single `/` partition. Since the `/var/log` directory contains log files which can grow quite large, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole.\n\nConfiguring `/var/log` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attackers ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem\\-independent and filesystem\\-specific options.\n\nAs `/var/log` contains log files, care should be taken to ensure the security and integrity of the data and mount point."},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log` . \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log` . \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing, or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.006.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"AJ Lewis, \"LVM HOWTO\", http://tldp.org/HOWTO/LVM-HOWTO/"}]}],"props":[{"name":"label","value":"1.1.2.6.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.1_Ensure_separate_partition_exists_for_varlog"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure separate partition exists for /var/log"},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.006.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/log`."},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.006.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.6.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.2_Ensure_nodev_option_set_on_varlog_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /var/log partition"},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.006.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log` filesystem is only intended for log files, set this option to ensure that users cannot create `setuid` files in `/var/log`."},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.006.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.6.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.3_Ensure_nosuid_option_set_on_varlog_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /var/log partition"},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.006.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log` filesystem is only intended for log files, set this option to ensure that users cannot run executable binaries from `/var/log`."},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log` with the configured options:\n\n```\n# mount -o remount /var/log\n```\n\n```\n /var/log defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.006.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.6.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.6.4_Ensure_noexec_option_set_on_varlog_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure noexec option set on /var/log partition"}]},{"id":"cisb-ubnt24.04lts-001.001.002.007_grp","parts":[{"id":"cisb-ubnt24.04lts-001.001.002.007_ovrvw","name":"overview","prose":"The auditing daemon, `auditd`, stores log data in the `/var/log/audit` directory."}],"props":[{"name":"label","value":"1.1.2.7"}],"title":"Configure /var/log/audit","controls":[{"id":"cisb-ubnt24.04lts-001.001.002.007.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.007.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The auditing daemon, `auditd`, stores log data in the `/var/log/audit` directory."},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The default installation only creates a single `/` partition. Since the `/var/log/audit` directory contains the `audit.log` file which can grow quite large, there is a risk of resource exhaustion. It will essentially have the whole disk available to fill up and impact the system as a whole. In addition, other operations on the system could fill up the disk unrelated to `/var/log/audit` and cause `auditd` to trigger its `space_left_action` as the disk is full. See `man auditd.conf` for details.\n\nConfiguring `/var/log/audit` as its own file system allows an administrator to set additional mount options such as `noexec/nosuid/nodev`. These options limit an attacker's ability to create exploits on the system. Other options allow for specific behavior. See `man mount` for exact details regarding filesystem\\-independent and filesystem\\-specific options.\n\nAs `/var/log/audit` contains audit logs, care should be taken to ensure the security and integrity of the data and mount point."},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log/audit`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For new installations, during installation create a custom partition setup and specify a separate partition for `/var/log/audit`. \n\nFor systems that were previously installed, create a new partition and configure `/etc/fstab` as appropriate. \n\nImpact: \n\nResizing filesystems is a common activity in cloud\\-hosted servers. Separate filesystem partitions may prevent successful resizing or may require the installation of additional tools solely for the purpose of resizing operations. The use of these additional tools may introduce their own security considerations."},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.007.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"AJ Lewis, \"LVM HOWTO\", http://tldp.org/HOWTO/LVM-HOWTO/"}]}],"props":[{"name":"label","value":"1.1.2.7.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.1_Ensure_separate_partition_exists_for_varlogaudit"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure separate partition exists for /var/log/audit"},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.007.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nodev` mount option specifies that the filesystem cannot contain special devices."},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log/audit` filesystem is not intended to support devices, set this option to ensure that users cannot create a block or character special devices in `/var/log/audit`."},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `nodev` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.007.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.7.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.2_Ensure_nodev_option_set_on_varlogaudit_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nodev option set on /var/log/audit partition"},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.007.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nosuid` mount option specifies that the filesystem cannot contain `setuid` files."},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log/audit` filesystem is only intended for variable files such as logs, set this option to ensure that users cannot create `setuid` files in `/var/log/audit`."},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `nosuid` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.007.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.7.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.3_Ensure_nosuid_option_set_on_varlogaudit_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nosuid option set on /var/log/audit partition"},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.001.002.007.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `noexec` mount option specifies that the filesystem cannot contain executable binaries."},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the `/var/log/audit` filesystem is only intended for audit logs, set this option to ensure that users cannot run executable binaries from `/var/log/audit`."},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a separate partition exists for `/var/log/audit`. \n\nEdit the `/etc/fstab` file and add `noexec` to the fourth field (mounting options) for the `/var/log/audit` partition. \n\n*Example:* \n\nRun the following command to remount `/var/log/audit` with the configured options:\n\n```\n# mount -o remount /var/log/audit\n```\n\n```\n /var/log/audit defaults,rw,nosuid,nodev,noexec,relatime 0 0\n```"},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.001.002.007.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"},{"name":"marking","class":"Reference","value":"See the fstab(5) manual page for more information."}]}],"props":[{"name":"label","value":"1.1.2.7.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.1.2.7.4_Ensure_noexec_option_set_on_varlogaudit_partition"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure noexec option set on /var/log/audit partition"}]}]}]},{"id":"cisb-ubnt24.04lts-001.002_grp","parts":[{"id":"cisb-ubnt24.04lts-001.002_ovrvw","name":"overview","prose":"Patch management procedures may vary widely between enterprises. Large enterprises may choose to install a local updates server that can be used in place of their distributions servers, whereas a single deployment of a system may prefer to get updates directly. Updates can be performed automatically or manually, depending on the site's policy for patch management. Organizations may prefer to test patches against their environment on a non\\-production system before rolling out to production.\n\nOutdated software is vulnerable to cyber criminals and hackers. Software updates help reduce the risk to your organization. The release of software update notes often reveals the patched exploitable entry points to the public. Public knowledge of these exploits can make your organization more vulnerable to malicious actors attempting to gain entry to your system's data.\n\nSoftware updates often offer new and improved features and speed enhancements.\n\nFor the purpose of this benchmark, the requirement is to ensure that a patch management process is defined and maintained, the specifics of which are left to the organization."}],"props":[{"name":"label","value":"1.2"}],"title":"Package Management","groups":[{"id":"cisb-ubnt24.04lts-001.002.001_grp","parts":[{"id":"cisb-ubnt24.04lts-001.002.001_ovrvw","name":"overview","prose":"Patch management procedures may vary widely between enterprises. Large enterprises may choose to install a local updates server that can be used in place of their distributions servers, whereas a single deployment of a system may prefer to get updates directly. Updates can be performed automatically or manually, depending on the site's policy for patch management. Organizations may prefer to test patches against their environment on a non\\-production system before rolling out to production.\n\nOutdated software is vulnerable to cyber criminals and hackers. Software updates help reduce the risk to your organization. The release of software update notes often reveals the patched exploitable entry points to the public. Public knowledge of these exploits can leave your organization more vulnerable to malicious actors attempting to gain access to your system's data.\n\n**Note:** Creation of an appropriate patch management policy is left to the organization."}],"props":[{"name":"label","value":"1.2.1"}],"title":"Configure Package Repositories","controls":[{"id":"cisb-ubnt24.04lts-001.002.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.002.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.002.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Most package managers implement GPG key signing to verify package integrity during installation."},{"id":"cisb-ubnt24.04lts-001.002.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system."},{"id":"cisb-ubnt24.04lts-001.002.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Update your package manager GPG keys in accordance with site policy."},{"id":"cisb-ubnt24.04lts-001.002.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Update your package manager GPG keys in accordance with site policy."},{"id":"cisb-ubnt24.04lts-001.002.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c5848cf8-e858-43e9-8404-a08cd11ff80e"},{"rel":"reference","href":"#c1873e2a-247c-4d65-af1d-3c8fff93c432"},{"rel":"reference","href":"#bce69284-01e8-4d50-bee6-840a29cd42a1"},{"rel":"reference","href":"#4a7d2a45-05bb-4662-87b5-fc5ddf38d3e3"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.002.001.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#14c7e817-8391-4839-bab7-e56fa4095b64"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-2"}]}],"props":[{"name":"label","value":"1.2.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.2.1.1_Ensure_GPG_keys_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure GPG keys are configured"},{"id":"cisb-ubnt24.04lts-001.002.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.002.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.002.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Systems need to have package manager repositories configured to ensure they receive the latest patches and updates."},{"id":"cisb-ubnt24.04lts-001.002.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a system's package repositories are misconfigured important patches may not be identified or a rogue repository could introduce compromised software."},{"id":"cisb-ubnt24.04lts-001.002.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure your package manager repositories according to site policy."},{"id":"cisb-ubnt24.04lts-001.002.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure your package manager repositories according to site policy."},{"id":"cisb-ubnt24.04lts-001.002.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c5848cf8-e858-43e9-8404-a08cd11ff80e"},{"rel":"reference","href":"#c1873e2a-247c-4d65-af1d-3c8fff93c432"},{"rel":"reference","href":"#bce69284-01e8-4d50-bee6-840a29cd42a1"},{"rel":"reference","href":"#4a7d2a45-05bb-4662-87b5-fc5ddf38d3e3"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.002.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-2"}]}],"props":[{"name":"label","value":"1.2.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.2.1.2_Ensure_package_manager_repositories_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure package manager repositories are configured"}]},{"id":"cisb-ubnt24.04lts-001.002.002_grp","parts":[{"id":"cisb-ubnt24.04lts-001.002.002_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"1.2.2"}],"title":"Configure Package Updates","controls":[{"id":"cisb-ubnt24.04lts-001.002.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.002.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.002.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Periodically patches are released for included software either due to security flaws or to include additional functionality."},{"id":"cisb-ubnt24.04lts-001.002.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Newer patches may contain security enhancements that would not be available through the latest full update. As a result, it is recommended that the latest software patches be used to take advantage of the latest functionality. As with any software installation, organizations need to determine if a given update meets their requirements and verify the compatibility and supportability of any additional software against the update revision that is selected."},{"id":"cisb-ubnt24.04lts-001.002.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to update all packages following local site policy guidance on applying updates and patches:\n\n```\n# apt update\n\n# apt upgrade\n - OR -\n# apt dist-upgrade\n```"},{"id":"cisb-ubnt24.04lts-001.002.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to update all packages following local site policy guidance on applying updates and patches:\n\n```\n# apt update\n\n# apt upgrade\n - OR -\n# apt dist-upgrade\n```"},{"id":"cisb-ubnt24.04lts-001.002.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c5848cf8-e858-43e9-8404-a08cd11ff80e"},{"rel":"reference","href":"#c1873e2a-247c-4d65-af1d-3c8fff93c432"},{"rel":"reference","href":"#bce69284-01e8-4d50-bee6-840a29cd42a1"},{"rel":"reference","href":"#4a7d2a45-05bb-4662-87b5-fc5ddf38d3e3"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.002.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-2"}]}],"props":[{"name":"label","value":"1.2.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.2.2.1_Ensure_updates_patches_and_additional_security_software_are_installed"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure updates, patches, and additional security software are installed"}]}]},{"id":"cisb-ubnt24.04lts-001.003_grp","parts":[{"id":"cisb-ubnt24.04lts-001.003_ovrvw","name":"overview","prose":"Mandatory Access Control (MAC) provides an additional layer of access restrictions to processes on top of the base Discretionary Access Controls. By restricting how processes can access files and resources on a system the potential impact from vulnerabilities in the processes can be reduced.\n\n**Impact:** Mandatory Access Control limits the capabilities of applications and daemons on a system, while this can prevent unauthorized access the configuration of MAC can be complex and difficult to implement correctly preventing legitimate access from occurring."}],"props":[{"name":"label","value":"1.3"}],"title":"Mandatory Access Control","groups":[{"id":"cisb-ubnt24.04lts-001.003.001_grp","parts":[{"id":"cisb-ubnt24.04lts-001.003.001_ovrvw","name":"overview","prose":"AppArmor provides a Mandatory Access Control (MAC) system that greatly augments the default Discretionary Access Control (DAC) model. Under AppArmor MAC rules are applied by file paths instead of by security contexts as in other MAC systems. As such it does not require support in the filesystem and can be applied to network mounted filesystems for example. AppArmor security policies define what system resources applications can access and what privileges they can do so with. This automatically limits the damage that the software can do to files accessible by the calling user. The user does not need to take any action to gain this benefit. For an action to occur, both the traditional DAC permissions must be satisfied as well as the AppArmor MAC rules. The action will not be allowed if either one of these models does not permit the action. In this way, AppArmor rules can only make a system's permissions more restrictive and secure.\n\n**References:**\n\n1. AppArmor Documentation: http://wiki.apparmor.net/index.php/Documentation\n2. Ubuntu AppArmor Documentation: https://help.ubuntu.com/community/AppArmor\n3. SUSE AppArmor Documentation: https://www.suse.com/documentation/apparmor/"}],"props":[{"name":"label","value":"1.3.1"}],"title":"Configure AppArmor","controls":[{"id":"cisb-ubnt24.04lts-001.003.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.003.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.003.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"AppArmor provides Mandatory Access Controls."},{"id":"cisb-ubnt24.04lts-001.003.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available."},{"id":"cisb-ubnt24.04lts-001.003.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Install AppArmor.\n\n```\n# apt install apparmor apparmor-utils\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Install AppArmor.\n\n```\n# apt install apparmor apparmor-utils\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.003.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3"}]}],"props":[{"name":"label","value":"1.3.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.3.1.1_Ensure_AppArmor_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure AppArmor is installed"},{"id":"cisb-ubnt24.04lts-001.003.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.003.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.003.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters.\n\n**Note:** This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings."},{"id":"cisb-ubnt24.04lts-001.003.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden."},{"id":"cisb-ubnt24.04lts-001.003.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/default/grub` and add the `apparmor=1` and `security=apparmor` parameters to the `GRUB_CMDLINE_LINUX=` line \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\"\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/default/grub` and add the `apparmor=1` and `security=apparmor` parameters to the `GRUB_CMDLINE_LINUX=` line \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\"\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.003.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3"}]}],"props":[{"name":"label","value":"1.3.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.3.1.2_Ensure_AppArmor_is_enabled_in_the_bootloader_configuration"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure AppArmor is enabled in the bootloader configuration"},{"id":"cisb-ubnt24.04lts-001.003.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.003.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.003.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"AppArmor profiles define what resources applications are able to access."},{"id":"cisb-ubnt24.04lts-001.003.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated."},{"id":"cisb-ubnt24.04lts-001.003.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set all profiles to enforce mode: \n\n**\\- OR \\-** \n\nRun the following command to set all profiles to complain mode: \n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted.\n\n```\n# aa-complain /etc/apparmor.d/*\n```\n\n```\n# aa-enforce /etc/apparmor.d/*\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set all profiles to enforce mode: \n\n**\\- OR \\-** \n\nRun the following command to set all profiles to complain mode: \n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted.\n\n```\n# aa-complain /etc/apparmor.d/*\n```\n\n```\n# aa-enforce /etc/apparmor.d/*\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.003.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3"}]}],"props":[{"name":"label","value":"1.3.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.3.1.3_Ensure_all_AppArmor_Profiles_are_in_enforce_or_complain_mode"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure all AppArmor Profiles are in enforce or complain mode"},{"id":"cisb-ubnt24.04lts-001.003.001.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.003.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.003.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"AppArmor profiles define what resources applications are able to access."},{"id":"cisb-ubnt24.04lts-001.003.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Security configuration requirements vary from site to site. Some sites may mandate a policy that is stricter than the default policy, which is perfectly acceptable. This item is intended to ensure that any policies that exist on the system are activated."},{"id":"cisb-ubnt24.04lts-001.003.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set all profiles to enforce mode: \n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted\n\n```\n# aa-enforce /etc/apparmor.d/*\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set all profiles to enforce mode: \n\n**Note:** Any unconfined processes may need to have a profile created or activated for them and then be restarted\n\n```\n# aa-enforce /etc/apparmor.d/*\n```"},{"id":"cisb-ubnt24.04lts-001.003.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.003.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3"}]}],"props":[{"name":"label","value":"1.3.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.3.1.4_Ensure_all_AppArmor_Profiles_are_enforcing"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure all AppArmor Profiles are enforcing"}]}]},{"id":"cisb-ubnt24.04lts-001.004_grp","parts":[{"id":"cisb-ubnt24.04lts-001.004_ovrvw","name":"overview","prose":"The recommendations in this section focus on securing the bootloader and settings involved in the boot process directly."}],"props":[{"name":"label","value":"1.4"}],"title":"Configure Bootloader","controls":[{"id":"cisb-ubnt24.04lts-001.004.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.004.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.004.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Setting the boot loader password will require that anyone rebooting the system must enter a password before being able to set command line boot parameters"},{"id":"cisb-ubnt24.04lts-001.004.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Requiring a boot password upon execution of the boot loader will prevent an unauthorized user from entering boot parameters or changing the boot partition. This prevents users from weakening security (e.g. turning off AppArmor at boot time)."},{"id":"cisb-ubnt24.04lts-001.004.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create an encrypted password with `grub-mkpasswd-pbkdf2`: \n\nAdd the following into a custom `/etc/grub.d` configuration file: \n\nThe superuser/user information and password should not be contained in the `/etc/grub.d/00_header` file as this file could be overwritten in a package update. \n\nIf there is a requirement to be able to boot/reboot without entering the password, edit `/etc/grub.d/10_linux` and add `--unrestricted` to the line `CLASS=` \n\n*Example:* \n\nRun the following command to update the `grub2` configuration: \n\nImpact: \n\nIf password protection is enabled, only the designated superuser can edit a GRUB 2 menu item by pressing \"e\" or access the GRUB 2 command line by pressing \"c\" \n\nIf GRUB 2 is set up to boot automatically to a password\\-protected menu entry the user has no option to back out of the password prompt to select another menu entry. Holding the SHIFT key will not display the menu in this case. The user must enter the correct username and password. If unable to do so, the configuration files will have to be edited via a LiveCD or other means to fix the problem \n\nYou can add `--unrestricted` to the menu entries to allow the system to boot without entering a password. A password will still be required to edit menu items. \n\nMore Information: https://help.ubuntu.com/community/Grub2/Passwords\n\n```\n# update-grub\n```\n\n```\nCLASS=\"--class gnu-linux --class gnu --class os --unrestricted\"\n```\n\n```\ncat > /etc/sysctl.d/60-kernel_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-001.005.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `kernel.randomize_va_space = 2`\n\n*Example:* \n\nRun the following command to set the active kernel parameter: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n# sysctl -w kernel.randomize_va_space=2\n```\n\n```\n# printf \"%s\\n\" \"kernel.randomize_va_space = 2\" >> /etc/sysctl.d/60-kernel_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-001.005.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#80a840ce-b20b-4a5f-8ab4-6ef92cccc549"},{"rel":"reference","href":"#33fb37ab-f99e-4939-b208-a5995f021956"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.005.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#db00b2ef-a817-4198-8483-c03ba67df366"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6"},{"name":"marking","class":"Reference","value":"CCI-000366: The organization implements the security configuration settings"}]}],"props":[{"name":"label","value":"1.5.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.5.1_Ensure_address_space_layout_randomization_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure address space layout randomization is enabled"},{"id":"cisb-ubnt24.04lts-001.005.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.005.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.005.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `ptrace()` system call provides a means by which one process (the \"tracer\") may observe and control the execution of another process (the \"tracee\"), and examine and change the tracee's memory and registers.\n\nThe sysctl settings (writable only with CAP\\_SYS\\_PTRACE) are:\n\n- `0` \\- classic ptrace permissions: a process can PTRACE\\_ATTACH to any other process running under the same uid, as long as it is dumpable (i.e. did not transition uids, start privileged, or have called prctl(PR\\_SET\\_DUMPABLE...) already). Similarly, PTRACE\\_TRACEME is unchanged.\n- `1` \\- restricted ptrace: a process must have a predefined relationship with the inferior it wants to call PTRACE\\_ATTACH on. By default, this relationship is that of only its descendants when the above classic criteria is also met. To change the relationship, an inferior can call prctl(PR\\_SET\\_PTRACER, debugger, ...) to declare an allowed debugger PID to call PTRACE\\_ATTACH on the inferior. Using PTRACE\\_TRACEME is unchanged.\n- `2` \\- admin\\-only attach: only processes with CAP\\_SYS\\_PTRACE may use ptrace with PTRACE\\_ATTACH, or through children calling PTRACE\\_TRACEME.\n- `3` \\- no attach: no processes may use ptrace with PTRACE\\_ATTACH nor via PTRACE\\_TRACEME. Once set, this sysctl value cannot be changed."},{"id":"cisb-ubnt24.04lts-001.005.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If one application is compromised, it would be possible for an attacker to attach to other running processes (e.g. Bash, Firefox, SSH sessions, GPG agent, etc) to extract additional credentials and continue to expand the scope of their attack.\n\nEnabling restricted mode will limit the ability of a compromised process to PTRACE\\_ATTACH on other processes running under the same user. With restricted mode, ptrace will continue to work with root user."},{"id":"cisb-ubnt24.04lts-001.005.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the `kernel.yama.ptrace_scope` parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf` to a value of `1`, `2`, or `3`: \n\n*Example:* \n\nRun the following command to set the active kernel parameter: \n\n**Note:** \n\n- If a value of `2` or `3` is preferred, or required by local site policy, replace the `1` with the desired value of `2` or `3` in the example above\n- If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\n```\n# sysctl -w kernel.yama.ptrace_scope=1\n```\n\n```\n# printf \"%s\\n\" \"kernel.yama.ptrace_scope = 1\" >> /etc/sysctl.d/60-kernel_sysctl.conf\n```\n\n```\nkernel.yama.ptrace_scope = 1\n - OR -\nkernel.yama.ptrace_scope = 2\n - OR -\nkernel.yama.ptrace_scope = 3\n```"},{"id":"cisb-ubnt24.04lts-001.005.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the `kernel.yama.ptrace_scope` parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf` to a value of `1`, `2`, or `3`: \n\n*Example:* \n\nRun the following command to set the active kernel parameter: \n\n**Note:** \n\n- If a value of `2` or `3` is preferred, or required by local site policy, replace the `1` with the desired value of `2` or `3` in the example above\n- If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten\n\n```\n# sysctl -w kernel.yama.ptrace_scope=1\n```\n\n```\n# printf \"%s\\n\" \"kernel.yama.ptrace_scope = 1\" >> /etc/sysctl.d/60-kernel_sysctl.conf\n```\n\n```\nkernel.yama.ptrace_scope = 1\n - OR -\nkernel.yama.ptrace_scope = 2\n - OR -\nkernel.yama.ptrace_scope = 3\n```"},{"id":"cisb-ubnt24.04lts-001.005.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.005.002_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#2fdc7669-16b6-4b84-a97d-576340484c77"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6"}]}],"props":[{"name":"label","value":"1.5.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.5.2_Ensure_ptrace_scope_is_restricted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ptrace_scope is restricted"},{"id":"cisb-ubnt24.04lts-001.005.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.005.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.005.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A core dump is the memory of an executable program. It is generally used to determine why a program aborted. It can also be used to glean confidential information from a core file. The system provides the ability to set a soft limit for core dumps, but this can be overridden by the user."},{"id":"cisb-ubnt24.04lts-001.005.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a hard limit on core dumps prevents users from overriding the soft variable. If core dumps are required, consider setting limits for user groups (see `limits.conf(5)` ). In addition, setting the `fs.suid_dumpable` variable to 0 will prevent setuid programs from dumping core."},{"id":"cisb-ubnt24.04lts-001.005.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Add the following line to `/etc/security/limits.conf` or a `/etc/security/limits.d/*` file: \n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `fs.suid_dumpable = 0`\n\n*Example:* \n\nRun the following command to set the active kernel parameter: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\n**\\-IF\\-** systemd\\-coredump is installed: \n\nedit `/etc/systemd/coredump.conf` and add/modify the following lines: \n\nRun the command:\n\n```\nsystemctl daemon-reload\n```\n\n```\nStorage=none\nProcessSizeMax=0\n```\n\n```\n# sysctl -w fs.suid_dumpable=0\n```\n\n```\n# printf \"\\n%s\" \"fs.suid_dumpable = 0\" >> /etc/sysctl.d/60-fs_sysctl.conf\n```\n\n```\n* hard core 0\n```"},{"id":"cisb-ubnt24.04lts-001.005.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Add the following line to `/etc/security/limits.conf` or a `/etc/security/limits.d/*` file: \n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `fs.suid_dumpable = 0`\n\n*Example:* \n\nRun the following command to set the active kernel parameter: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\n**\\-IF\\-** systemd\\-coredump is installed: \n\nedit `/etc/systemd/coredump.conf` and add/modify the following lines: \n\nRun the command:\n\n```\nsystemctl daemon-reload\n```\n\n```\nStorage=none\nProcessSizeMax=0\n```\n\n```\n# sysctl -w fs.suid_dumpable=0\n```\n\n```\n# printf \"\\n%s\" \"fs.suid_dumpable = 0\" >> /etc/sysctl.d/60-fs_sysctl.conf\n```\n\n```\n* hard core 0\n```"},{"id":"cisb-ubnt24.04lts-001.005.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6"}]}],"props":[{"name":"label","value":"1.5.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.5.3_Ensure_core_dumps_are_restricted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure core dumps are restricted"},{"id":"cisb-ubnt24.04lts-001.005.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.005.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.005.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`prelink` is a program that modifies ELF shared libraries and ELF dynamically linked binaries in such a way that the time needed for the dynamic linker to perform relocations at startup significantly decreases."},{"id":"cisb-ubnt24.04lts-001.005.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The prelinking feature can interfere with the operation of AIDE, because it changes binaries. Prelinking can also increase the vulnerability of the system if a malicious user is able to compromise a common library such as libc."},{"id":"cisb-ubnt24.04lts-001.005.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to restore binaries to normal: \n\nUninstall `prelink` using the appropriate package manager or manual installation:\n\n```\n# apt purge prelink\n```\n\n```\n# prelink -ua\n```"},{"id":"cisb-ubnt24.04lts-001.005.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to restore binaries to normal: \n\nUninstall `prelink` using the appropriate package manager or manual installation:\n\n```\n# apt purge prelink\n```\n\n```\n# prelink -ua\n```"},{"id":"cisb-ubnt24.04lts-001.005.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#56b32ac3-31da-4fc5-993d-09f1ededcd20"},{"rel":"reference","href":"#5c4f90ec-a1e4-4140-865c-e3a87694b13f"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.005.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-1, CM-3"}]}],"props":[{"name":"label","value":"1.5.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.5.4_Ensure_prelink_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure prelink is not installed"},{"id":"cisb-ubnt24.04lts-001.005.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.005.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.005.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Apport Error Reporting Service automatically generates crash reports for debugging"},{"id":"cisb-ubnt24.04lts-001.005.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Apport collects potentially sensitive data, such as core dumps, stack traces, and log files. They can contain passwords, credit card numbers, serial numbers, and other private material."},{"id":"cisb-ubnt24.04lts-001.005.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/default/apport` and add or edit the enabled parameter to equal `0`: \n\nRun the following commands to stop and mask the apport service \n\n**\\- OR \\-** \n\nRun the following command to remove the apport package:\n\n```\n# apt purge apport\n```\n\n```\n# systemctl stop apport.service\n# systemctl mask apport.service\n```\n\n```\nenabled=0\n```"},{"id":"cisb-ubnt24.04lts-001.005.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/default/apport` and add or edit the enabled parameter to equal `0`: \n\nRun the following commands to stop and mask the apport service \n\n**\\- OR \\-** \n\nRun the following command to remove the apport package:\n\n```\n# apt purge apport\n```\n\n```\n# systemctl stop apport.service\n# systemctl mask apport.service\n```\n\n```\nenabled=0\n```"},{"id":"cisb-ubnt24.04lts-001.005.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.005.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"1.5.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.5.5_Ensure_Automatic_Error_Reporting_is_not_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure Automatic Error Reporting is not enabled"}]},{"id":"cisb-ubnt24.04lts-001.006_grp","parts":[{"id":"cisb-ubnt24.04lts-001.006_ovrvw","name":"overview","prose":"Presenting a warning message prior to the normal user login may assist in the prosecution of trespassers on the computer system. Changing some of these login banners also has the side effect of hiding OS version information and other detailed system information from attackers attempting to target specific exploits at a system.\n\nGuidelines published by the US Department of Defense require that warning messages include at least the name of the organization that owns the system, the fact that the system is subject to monitoring and that such monitoring is in compliance with local statutes, and that use of the system implies consent to such monitoring. It is important that the organization's legal counsel review the content of all messages before any system modifications are made, as these warning messages are inherently site\\-specific. More information (including citations of relevant case law) can be found at http://www.justice.gov/criminal/cybercrime/\n\nThe `/etc/motd`, `/etc/issue`, and `/etc/issue.net` files govern warning banners for standard command line logins for both local and remote users.\n\n**Note:** The text provided in the remediation actions for these items is intended as an example only. Please edit to include the specific text for your organization as approved by your legal department."}],"props":[{"name":"label","value":"1.6"}],"title":"Configure Command Line Warning Banners","controls":[{"id":"cisb-ubnt24.04lts-001.006.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users.\n\nUnix\\-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` \\- machine architecture `\\r` \\- operating system release `\\s` \\- operating system name `\\v` \\- operating system version"},{"id":"cisb-ubnt24.04lts-001.006.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in."},{"id":"cisb-ubnt24.04lts-001.006.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/motd` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `motd` is not used, this file can be removed. \n\nRun the following command to remove the `motd` file:\n\n```\n# rm /etc/motd\n```"},{"id":"cisb-ubnt24.04lts-001.006.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/motd` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `motd` is not used, this file can be removed. \n\nRun the following command to remove the `motd` file:\n\n```\n# rm /etc/motd\n```"},{"id":"cisb-ubnt24.04lts-001.006.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-1, CM-3"}]}],"props":[{"name":"label","value":"1.6.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.1_Ensure_message_of_the_day_is_configured_properly"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure message of the day is configured properly"},{"id":"cisb-ubnt24.04lts-001.006.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/issue` file are displayed to users prior to login for local terminals.\n\nUnix\\-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` \\- machine architecture `\\r` \\- operating system release `\\s` \\- operating system name `\\v` \\- operating system version \\- or the operating system's name"},{"id":"cisb-ubnt24.04lts-001.006.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in."},{"id":"cisb-ubnt24.04lts-001.006.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/issue` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue\n```"},{"id":"cisb-ubnt24.04lts-001.006.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/issue` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue\n```"},{"id":"cisb-ubnt24.04lts-001.006.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-1, CM-3"}]}],"props":[{"name":"label","value":"1.6.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.2_Ensure_local_login_warning_banner_is_configured_properly"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure local login warning banner is configured properly"},{"id":"cisb-ubnt24.04lts-001.006.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services.\n\nUnix\\-based systems have typically displayed information about the OS release and patch level upon logging in to the system. This information can be useful to developers who are developing software for a particular OS platform. If `mingetty(8)` supports the following options, they display operating system information: `\\m` \\- machine architecture `\\r` \\- operating system release `\\s` \\- operating system name `\\v` \\- operating system version"},{"id":"cisb-ubnt24.04lts-001.006.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place. Displaying OS and patch level information in login banners also has the side effect of providing detailed system information to attackers attempting to target specific exploits of a system. Authorized users can easily get this information by running the \" `uname -a` \" command once they have logged in."},{"id":"cisb-ubnt24.04lts-001.006.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/issue.net` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue.net\n```"},{"id":"cisb-ubnt24.04lts-001.006.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/issue.net` file with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# echo \"Authorized users only. All activity may be monitored and reported.\" > /etc/issue.net\n```"},{"id":"cisb-ubnt24.04lts-001.006.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-1, CM-3"}]}],"props":[{"name":"label","value":"1.6.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.3_Ensure_remote_login_warning_banner_is_configured_properly"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure remote login warning banner is configured properly"},{"id":"cisb-ubnt24.04lts-001.006.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/motd` file are displayed to users after login and function as a message of the day for authenticated users."},{"id":"cisb-ubnt24.04lts-001.006.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the `/etc/motd` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."},{"id":"cisb-ubnt24.04lts-001.006.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/motd`: \n\n**\\- OR \\-** \n\nRun the following command to remove the `/etc/motd` file:\n\n```\n# rm /etc/motd\n```\n\n```\n# chown root:root $(readlink -e /etc/motd)\n# chmod u-x,go-wx $(readlink -e /etc/motd)\n```"},{"id":"cisb-ubnt24.04lts-001.006.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/motd`: \n\n**\\- OR \\-** \n\nRun the following command to remove the `/etc/motd` file:\n\n```\n# rm /etc/motd\n```\n\n```\n# chown root:root $(readlink -e /etc/motd)\n# chmod u-x,go-wx $(readlink -e /etc/motd)\n```"},{"id":"cisb-ubnt24.04lts-001.006.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.006.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"1.6.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.4_Ensure_access_to_etcmotd_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure access to /etc/motd is configured"},{"id":"cisb-ubnt24.04lts-001.006.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/issue` file are displayed to users prior to login for local terminals."},{"id":"cisb-ubnt24.04lts-001.006.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the `/etc/issue` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."},{"id":"cisb-ubnt24.04lts-001.006.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/issue`:\n\n```\n# chown root:root $(readlink -e /etc/issue)\n# chmod u-x,go-wx $(readlink -e /etc/issue)\n```"},{"id":"cisb-ubnt24.04lts-001.006.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/issue`:\n\n```\n# chown root:root $(readlink -e /etc/issue)\n# chmod u-x,go-wx $(readlink -e /etc/issue)\n```"},{"id":"cisb-ubnt24.04lts-001.006.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.006.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"1.6.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.5_Ensure_access_to_etcissue_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure access to /etc/issue is configured"},{"id":"cisb-ubnt24.04lts-001.006.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.006.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.006.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The contents of the `/etc/issue.net` file are displayed to users prior to login for remote connections from configured services."},{"id":"cisb-ubnt24.04lts-001.006.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the `/etc/issue.net` file does not have the correct access configured, it could be modified by unauthorized users with incorrect or misleading information."},{"id":"cisb-ubnt24.04lts-001.006.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/issue.net`:\n\n```\n# chown root:root $(readlink -e /etc/issue.net)\n# chmod u-x,go-wx $(readlink -e /etc/issue.net)\n```"},{"id":"cisb-ubnt24.04lts-001.006.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to set mode, owner, and group on `/etc/issue.net`:\n\n```\n# chown root:root $(readlink -e /etc/issue.net)\n# chmod u-x,go-wx $(readlink -e /etc/issue.net)\n```"},{"id":"cisb-ubnt24.04lts-001.006.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.006.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"1.6.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.6.6_Ensure_access_to_etcissue.net_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure access to /etc/issue.net is configured"}]},{"id":"cisb-ubnt24.04lts-001.007_grp","parts":[{"id":"cisb-ubnt24.04lts-001.007_ovrvw","name":"overview","prose":"The GNOME Display Manager (GDM) is a program that manages graphical display servers and handles graphical user logins.\n\nThis subsection requires user profiles to already exist on the system. A profile is a list of configuration databases.\n\n*Sample profile:*\n\n```\nuser-db:user\nsystem-db:local\nsystem-db:site\n```\n\nConfiguring a single user and multiple system databases allows for layering of preferences. Settings from the user database file take precedence over the settings in the local database file, and the local database file in turn takes precedence over the site database file.\n\n**Note:**\n\n- **\\- IF \\-** GDM is not installed on the system, this section can be skipped\n- The Remediation Procedure commands in this section **MUST** be done from a command window on a graphical desktop or an error will be returned."}],"props":[{"name":"label","value":"1.7"}],"title":"Configure GNOME Display Manager","controls":[{"id":"cisb-ubnt24.04lts-001.007.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The GNOME Display Manager (GDM) is a program that manages graphical display servers and handles graphical user logins."},{"id":"cisb-ubnt24.04lts-001.007.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a Graphical User Interface (GUI) is not required, it should be removed to reduce the attack surface of the system."},{"id":"cisb-ubnt24.04lts-001.007.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to uninstall `gdm3` and remove unused dependencies: \n\nImpact: \n\nRemoving the GNOME Display manager will remove the Graphical User Interface (GUI) from the system.\n\n```\n# apt purge gdm3\n# apt autoremove gdm3\n```"},{"id":"cisb-ubnt24.04lts-001.007.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to uninstall `gdm3` and remove unused dependencies: \n\nImpact: \n\nRemoving the GNOME Display manager will remove the Graphical User Interface (GUI) from the system.\n\n```\n# apt purge gdm3\n# apt autoremove gdm3\n```"},{"id":"cisb-ubnt24.04lts-001.007.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-11"}]}],"props":[{"name":"label","value":"1.7.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.1_Ensure_GDM_is_removed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM is removed"},{"id":"cisb-ubnt24.04lts-001.007.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"GDM is the GNOME Display Manager which handles graphical login for GNOME based systems."},{"id":"cisb-ubnt24.04lts-001.007.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place."},{"id":"cisb-ubnt24.04lts-001.007.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** A user profile is already created run the following commands to set and enable the text banner message on the login screen: \n\n**Note:** \n\n- `banner-message-text` may be set in accordance with local site policy\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create or edit the gdm profile in the `/etc/dconf/profile/gdm` with the following lines:\n\n**Note:** gdm is the name of a dconf database. \n\n1. Create a gdm keyfile for machine\\-wide settings in `/etc/dconf/db/gdm.d/01-banner-message`:\n\n1. Update the system databases\n\n**Note:** \n\n- Users must log out and back in again before the system\\-wide settings take effect.\n- There is no character limit for the banner message. gnome\\-shell autodetects longer stretches of text and enters two column mode.\n- The banner message cannot be read from an external file.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/login-screen]\nbanner-message-enable=true\nbanner-message-text='Type the banner message here.'\n```\n\n```\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n```\n# gsettings set org.gnome.login-screen banner-message-enable true\n```\n\n```\n# gsettings set org.gnome.login-screen banner-message-text 'Authorized uses only. All activity may be monitored and reported'\n```"},{"id":"cisb-ubnt24.04lts-001.007.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** A user profile is already created run the following commands to set and enable the text banner message on the login screen: \n\n**Note:** \n\n- `banner-message-text` may be set in accordance with local site policy\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create or edit the gdm profile in the `/etc/dconf/profile/gdm` with the following lines:\n\n**Note:** gdm is the name of a dconf database. \n\n1. Create a gdm keyfile for machine\\-wide settings in `/etc/dconf/db/gdm.d/01-banner-message`:\n\n1. Update the system databases\n\n**Note:** \n\n- Users must log out and back in again before the system\\-wide settings take effect.\n- There is no character limit for the banner message. gnome\\-shell autodetects longer stretches of text and enters two column mode.\n- The banner message cannot be read from an external file.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/login-screen]\nbanner-message-enable=true\nbanner-message-text='Type the banner message here.'\n```\n\n```\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n```\n# gsettings set org.gnome.login-screen banner-message-enable true\n```\n\n```\n# gsettings set org.gnome.login-screen banner-message-text 'Authorized uses only. All activity may be monitored and reported'\n```"},{"id":"cisb-ubnt24.04lts-001.007.002_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#82d8f182-9446-4ec1-b986-5837a9ede529"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.2_Ensure_GDM_login_banner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM login banner is configured"},{"id":"cisb-ubnt24.04lts-001.007.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.\n\nThe `disable-user-list` option controls if a list of users is displayed on the login screen"},{"id":"cisb-ubnt24.04lts-001.007.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Displaying the user list eliminates half of the Userid/Password equation that an unauthorized person would need to log on."},{"id":"cisb-ubnt24.04lts-001.007.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** A user profile exists run the following command to enable the `disable-user-list`: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create or edit the gdm profile in `/etc/dconf/profile/gdm` with the following lines:\n\n**Note:** gdm is the name of a dconf database. \n\n1. Create a gdm keyfile for machine\\-wide settings in `/etc/dconf/db/gdm.d/00-login-screen`:\n\n1. Update the system databases:\n\n**Note:** When the user profile is created or changed, the user will need to log out and log in again before the changes will be applied.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/login-screen]\n# Do not show the user list\ndisable-user-list=true\n```\n\n```\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n```\n# gsettings set org.gnome.login-screen disable-user-list true\n```"},{"id":"cisb-ubnt24.04lts-001.007.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** A user profile exists run the following command to enable the `disable-user-list`: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create or edit the gdm profile in `/etc/dconf/profile/gdm` with the following lines:\n\n**Note:** gdm is the name of a dconf database. \n\n1. Create a gdm keyfile for machine\\-wide settings in `/etc/dconf/db/gdm.d/00-login-screen`:\n\n1. Update the system databases:\n\n**Note:** When the user profile is created or changed, the user will need to log out and log in again before the changes will be applied.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/login-screen]\n# Do not show the user list\ndisable-user-list=true\n```\n\n```\nuser-db:user\nsystem-db:gdm\nfile-db:/usr/share/gdm/greeter-dconf-defaults\n```\n\n```\n# gsettings set org.gnome.login-screen disable-user-list true\n```"},{"id":"cisb-ubnt24.04lts-001.007.003_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#c9d4919f-270b-4586-a56d-5c9c63cc7914"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.3_Ensure_GDM_disable-user-list_option_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM disable-user-list option is enabled"},{"id":"cisb-ubnt24.04lts-001.007.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"GNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time."},{"id":"cisb-ubnt24.04lts-001.007.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a lock\\-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended."},{"id":"cisb-ubnt24.04lts-001.007.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** A user profile is already created run the following commands to enable screen locks when the user is idle: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF\\-** A user profile does not exist: \n\n1. Create or edit the user profile in the `/etc/dconf/profile/` and verify it includes the following:\n\n**Note:** `local` is the name of a dconf database used in the examples. \n\n1. Create the directory `/etc/dconf/db/local.d/` if it doesn't already exist:\n2. Create the key file `/etc/dconf/db/local.d/00-screensaver` to provide information for the `local` database:\n\n*Example key file:* \n\n**Note:** You must include the uint32 along with the integer key values as shown. \n\n1. Run the following command to update the system databases:\n\n1. Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n# Specify the dconf path\n[org/gnome/desktop/session]\n\n# Number of seconds of inactivity before the screen goes blank\n# Set to 0 seconds if you want to deactivate the screensaver.\nidle-delay=uint32 180\n\n# Specify the dconf path\n[org/gnome/desktop/screensaver]\n\n# Number of seconds after the screen is blank before locking the screen\nlock-delay=uint32 0\n```\n\n```\nuser-db:user\nsystem-db:{NAME_OF_DCONF_DATABASE}\n```\n\n```\n# gsettings set org.gnome.desktop.session idle-delay 900\n```\n\n```\n# gsettings set org.gnome.desktop.screensaver lock-delay 5\n```"},{"id":"cisb-ubnt24.04lts-001.007.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** A user profile is already created run the following commands to enable screen locks when the user is idle: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF\\-** A user profile does not exist: \n\n1. Create or edit the user profile in the `/etc/dconf/profile/` and verify it includes the following:\n\n**Note:** `local` is the name of a dconf database used in the examples. \n\n1. Create the directory `/etc/dconf/db/local.d/` if it doesn't already exist:\n2. Create the key file `/etc/dconf/db/local.d/00-screensaver` to provide information for the `local` database:\n\n*Example key file:* \n\n**Note:** You must include the uint32 along with the integer key values as shown. \n\n1. Run the following command to update the system databases:\n\n1. Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n# Specify the dconf path\n[org/gnome/desktop/session]\n\n# Number of seconds of inactivity before the screen goes blank\n# Set to 0 seconds if you want to deactivate the screensaver.\nidle-delay=uint32 180\n\n# Specify the dconf path\n[org/gnome/desktop/screensaver]\n\n# Number of seconds after the screen is blank before locking the screen\nlock-delay=uint32 0\n```\n\n```\nuser-db:user\nsystem-db:{NAME_OF_DCONF_DATABASE}\n```\n\n```\n# gsettings set org.gnome.desktop.session idle-delay 900\n```\n\n```\n# gsettings set org.gnome.desktop.screensaver lock-delay 5\n```"},{"id":"cisb-ubnt24.04lts-001.007.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cf7d770e-dfe9-4d35-9ff2-f09c88ca1443"},{"rel":"reference","href":"#9b7007f5-27f9-4e2e-a63f-1546ed368515"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.004_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#ff129dff-63ec-44a6-9659-668d37709d37"}],"props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"1.7.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.4_Ensure_GDM_screen_locks_when_the_user_is_idle"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM screen locks when the user is idle"},{"id":"cisb-ubnt24.04lts-001.007.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"GNOME Desktop Manager can lock down specific settings by using the lockdown mode in dconf to prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"id":"cisb-ubnt24.04lts-001.007.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a lock\\-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.\n\nWithout locking down the system settings, user settings take precedence over the system settings."},{"id":"cisb-ubnt24.04lts-001.007.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-screensaver` with the following content:\n\n1. Update the system databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n# Lock desktop screensaver settings\n/org/gnome/desktop/session/idle-delay\n/org/gnome/desktop/screensaver/lock-delay\n```"},{"id":"cisb-ubnt24.04lts-001.007.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-screensaver` with the following content:\n\n1. Update the system databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n# Lock desktop screensaver settings\n/org/gnome/desktop/session/idle-delay\n/org/gnome/desktop/screensaver/lock-delay\n```"},{"id":"cisb-ubnt24.04lts-001.007.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cf7d770e-dfe9-4d35-9ff2-f09c88ca1443"},{"rel":"reference","href":"#9b7007f5-27f9-4e2e-a63f-1546ed368515"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.005_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#1825fccd-8bad-4577-af9e-f9c64821462d"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-11"}]}],"props":[{"name":"label","value":"1.7.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.5_Ensure_GDM_screen_locks_cannot_be_overridden"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM screen locks cannot be overridden"},{"id":"cisb-ubnt24.04lts-001.007.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"By default GNOME automatically mounts removable media when inserted as a convenience to the user."},{"id":"cisb-ubnt24.04lts-001.007.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves."},{"id":"cisb-ubnt24.04lts-001.007.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** A user profile exists run the following commands to ensure automatic mounting is disabled: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create a file `/etc/dconf/db/local.d/00-media-automount` with following content:\n\n1. After creating the file, apply the changes using below command :\n\n**Note:** Users must log out and back in again before the system\\-wide settings take effect. \n\nImpact: \n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```\n\n```\n# gsettings set org.gnome.desktop.media-handling automount false\n# gsettings set org.gnome.desktop.media-handling automount-open false\n```"},{"id":"cisb-ubnt24.04lts-001.007.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** A user profile exists run the following commands to ensure automatic mounting is disabled: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. Create a file `/etc/dconf/db/local.d/00-media-automount` with following content:\n\n1. After creating the file, apply the changes using below command :\n\n**Note:** Users must log out and back in again before the system\\-wide settings take effect. \n\nImpact: \n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```\n\n```\n# gsettings set org.gnome.desktop.media-handling automount false\n# gsettings set org.gnome.desktop.media-handling automount-open false\n```"},{"id":"cisb-ubnt24.04lts-001.007.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cccae7ba-38ea-4557-a8b4-bdf07f718ea1"},{"rel":"reference","href":"#d3322cdd-c2af-44ce-9f5a-11222553f5a5"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.006_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#437b84bd-601c-44b3-b9b9-3bfc96ea80e1"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.6_Ensure_GDM_automatic_mounting_of_removable_media_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM automatic mounting of removable media is disabled"},{"id":"cisb-ubnt24.04lts-001.007.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"By default GNOME automatically mounts removable media when inserted as a convenience to the user.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings. To lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"id":"cisb-ubnt24.04lts-001.007.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves."},{"id":"cisb-ubnt24.04lts-001.007.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-automount` with the following content:\n\n1. Update the systems databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\nImpact: \n\nThe use of portable hard drives is very common for workstation users\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```"},{"id":"cisb-ubnt24.04lts-001.007.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-automount` with the following content:\n\n1. Update the systems databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\nImpact: \n\nThe use of portable hard drives is very common for workstation users\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautomount=false\nautomount-open=false\n```"},{"id":"cisb-ubnt24.04lts-001.007.007_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#437b84bd-601c-44b3-b9b9-3bfc96ea80e1"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.7_Ensure_GDM_disabling_automatic_mounting_of_removable_media_is_not_overridden"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM disabling automatic mounting of removable media is not overridden"},{"id":"cisb-ubnt24.04lts-001.007.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `autorun-never` setting allows the GNOME Desktop Display Manager to disable autorun through GDM."},{"id":"cisb-ubnt24.04lts-001.007.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Malware on removable media may taking advantage of Autorun features when the media is inserted into a system and execute."},{"id":"cisb-ubnt24.04lts-001.007.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** A user profile exists run the following command to set `autorun-never` to `true` for GDM users: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n1. Update the systems databases:\n\n**Note:** Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```\n\n```\n# gsettings set org.gnome.desktop.media-handling autorun-never true\n```"},{"id":"cisb-ubnt24.04lts-001.007.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** A user profile exists run the following command to set `autorun-never` to `true` for GDM users: \n\n**Note:** \n\n- `gsettings` commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.\n- The system must be restarted after all `gsettings` configurations have been set in order for CIS\\-CAT Assessor to appropriately assess.\n\n**\\- OR/IF \\-** A user profile does not exist: \n\n1. create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n1. Update the systems databases:\n\n**Note:** Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```\n\n```\n# gsettings set org.gnome.desktop.media-handling autorun-never true\n```"},{"id":"cisb-ubnt24.04lts-001.007.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cccae7ba-38ea-4557-a8b4-bdf07f718ea1"},{"rel":"reference","href":"#d3322cdd-c2af-44ce-9f5a-11222553f5a5"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.8_Ensure_GDM_autorun-never_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM autorun-never is enabled"},{"id":"cisb-ubnt24.04lts-001.007.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The autorun\\-never setting allows the GNOME Desktop Display Manager to disable autorun through GDM.\n\nBy using the lockdown mode in dconf, you can prevent users from changing specific settings.\n\nTo lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory."},{"id":"cisb-ubnt24.04lts-001.007.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Malware on removable media may taking advantage of Autorun features when the media is inserted into a system and execute."},{"id":"cisb-ubnt24.04lts-001.007.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n1. Update the systems databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```"},{"id":"cisb-ubnt24.04lts-001.007.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-autorun` with the following content:\n\n1. Update the systems databases:\n\n**Note:** \n\n- A user profile must exist in order to apply locks.\n- Users must log out and back in again before the system\\-wide settings take effect.\n\n```\n# dconf update\n```\n\n```\n[org/gnome/desktop/media-handling]\nautorun-never=true\n```"},{"id":"cisb-ubnt24.04lts-001.007.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cccae7ba-38ea-4557-a8b4-bdf07f718ea1"},{"rel":"reference","href":"#d3322cdd-c2af-44ce-9f5a-11222553f5a5"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"1.7.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.9_Ensure_GDM_autorun-never_is_not_overridden"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure GDM autorun-never is not overridden"},{"id":"cisb-ubnt24.04lts-001.007.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-001.007.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-001.007.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"X Display Manager Control Protocol (XDMCP) is designed to provide authenticated access to display management services for remote displays"},{"id":"cisb-ubnt24.04lts-001.007.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"XDMCP is inherently insecure.\n\n- XDMCP is not a ciphered protocol. This may allow an attacker to capture keystrokes entered by a user\n- XDMCP is vulnerable to man\\-in\\-the\\-middle attacks. This may allow an attacker to steal the credentials of legitimate users by impersonating the XDMCP server."},{"id":"cisb-ubnt24.04lts-001.007.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit all files returned by the audit and remove or commend out the `Enable=true` line in the `[xdmcp]` block: \n\n*Example file:*\n\n```\n# GDM configuration storage\n#\n# See /usr/share/gdm/gdm.schemas for a list of available options.\n\n[daemon]\n# Uncomment the line below to force the login screen to use Xorg\n#WaylandEnable=false\n\n# Enabling automatic login\n# AutomaticLoginEnable = true\n# AutomaticLogin = user1\n\n# Enabling timed login\n# TimedLoginEnable = true\n# TimedLogin = user1\n# TimedLoginDelay = 10\n\n[security]\n\n[xdmcp]\n# Enable=true <- **This line should be removed or commented out**\n\n[chooser]\n\n[debug]\n# Uncomment the line below to turn on debugging\n# More verbose logs\n# Additionally lets the X server dump core if it crashes\n#Enable=true\n```"},{"id":"cisb-ubnt24.04lts-001.007.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit all files returned by the audit and remove or commend out the `Enable=true` line in the `[xdmcp]` block: \n\n*Example file:*\n\n```\n# GDM configuration storage\n#\n# See /usr/share/gdm/gdm.schemas for a list of available options.\n\n[daemon]\n# Uncomment the line below to force the login screen to use Xorg\n#WaylandEnable=false\n\n# Enabling automatic login\n# AutomaticLoginEnable = true\n# AutomaticLogin = user1\n\n# Enabling timed login\n# TimedLoginEnable = true\n# TimedLogin = user1\n# TimedLoginDelay = 10\n\n[security]\n\n[xdmcp]\n# Enable=true <- **This line should be removed or commented out**\n\n[chooser]\n\n[debug]\n# Uncomment the line below to turn on debugging\n# More verbose logs\n# Additionally lets the X server dump core if it crashes\n#Enable=true\n```"},{"id":"cisb-ubnt24.04lts-001.007.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-001.007.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4"}]}],"props":[{"name":"label","value":"1.7.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_1.7.10_Ensure_XDMCP_is_not_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure XDMCP is not enabled"}]}]},{"id":"cisb-ubnt24.04lts-002_grp","parts":[{"id":"cisb-ubnt24.04lts-002_ovrvw","name":"overview","prose":"While applying system updates and patches helps correct known vulnerabilities, one of the best ways to protect the system against as yet unreported vulnerabilities is to disable all services that are not required for normal system operation. This prevents the exploitation of vulnerabilities discovered at a later date. If a service is not enabled, it cannot be exploited. The actions in this section of the document provide guidance on some services which can be safely disabled and under which circumstances, greatly reducing the number of possible threats to the resulting system. Additionally, some services which should remain enabled but with secure configuration are covered as well as insecure service clients."}],"props":[{"name":"label","value":"2"}],"title":"Services","groups":[{"id":"cisb-ubnt24.04lts-002.001_grp","parts":[{"id":"cisb-ubnt24.04lts-002.001_ovrvw","name":"overview","prose":"This section describes services that are installed on systems that specifically need to run these services. If any of these services are not required, it is recommended that the package be removed.\n\n**\\- IF \\-** the package is required for a dependency:\n\n- Ensure the dependent package is approved by local site policy\n- Ensure stopping and masking the service and/or socket meets local site policy\n- Stop and mask the service and/or socket to reduce the potential attack surface\n\nThe following commands can be used to stop and mask the service and socket:\n\n```\n# systemctl stop .socket .service\n# systemctl mask .socket .service\n```\n\n**Note:** This should not be considered a comprehensive list of services not required for normal system operation. You may wish to consider additions to those listed here for your environment"}],"props":[{"name":"label","value":"2.1"}],"title":"Configure Server Services","controls":[{"id":"cisb-ubnt24.04lts-002.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`autofs` allows automatic mounting of devices, typically including CD/DVDs and USB drives."},{"id":"cisb-ubnt24.04lts-002.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in the filesystem even if they lacked permissions to mount it themselves."},{"id":"cisb-ubnt24.04lts-002.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `autofs.service` and remove the `autofs` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `autofs` package is required as a dependency: \n\nRun the following commands to stop and mask `autofs.service`: \n\nImpact: \n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting. \n\nThere may be packages that are dependent on the `autofs` package. If the `autofs` package is removed, these dependent packages will be removed as well. Before removing the `autofs` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `autofs.service` leaving the `autofs` package installed.\n\n```\n# systemctl stop autofs.service\n# systemctl mask autofs.service\n```\n\n```\n# systemctl stop autofs.service\n# apt purge autofs\n```"},{"id":"cisb-ubnt24.04lts-002.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `autofs.service` and remove the `autofs` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `autofs` package is required as a dependency: \n\nRun the following commands to stop and mask `autofs.service`: \n\nImpact: \n\nThe use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting. \n\nThere may be packages that are dependent on the `autofs` package. If the `autofs` package is removed, these dependent packages will be removed as well. Before removing the `autofs` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `autofs.service` leaving the `autofs` package installed.\n\n```\n# systemctl stop autofs.service\n# systemctl mask autofs.service\n```\n\n```\n# systemctl stop autofs.service\n# apt purge autofs\n```"},{"id":"cisb-ubnt24.04lts-002.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cccae7ba-38ea-4557-a8b4-bdf07f718ea1"},{"rel":"reference","href":"#d3322cdd-c2af-44ce-9f5a-11222553f5a5"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-3, MP-7"}]}],"props":[{"name":"label","value":"2.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.1_Ensure_autofs_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure autofs services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Avahi is a free zeroconf implementation, including a system for multicast DNS/DNS\\-SD service discovery. Avahi allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, a user can plug a computer into a network and Avahi automatically finds printers to print to, files to look at and people to talk to, as well as network services running on the machine."},{"id":"cisb-ubnt24.04lts-002.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Automatic discovery of network services is not normally required for system functionality. It is recommended to remove this package to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `avahi-daemon.socket` and `avahi-daemon.service`, and remove the `avahi-daemon` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `avahi-daemon` package is required as a dependency: \n\nRun the following commands to stop and mask the `avahi-daemon.socket` and `avahi-daemon.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `avahi` package. If the `avahi` package is removed, these dependent packages will be removed as well. Before removing the `avahi` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `avahi-daemon.socket` and `avahi-daemon.service` leaving the `avahi` package installed.\n\n```\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# systemctl mask avahi-daemon.socket avahi-daemon.service\n```\n\n```\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# apt purge avahi-daemon\n```"},{"id":"cisb-ubnt24.04lts-002.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `avahi-daemon.socket` and `avahi-daemon.service`, and remove the `avahi-daemon` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `avahi-daemon` package is required as a dependency: \n\nRun the following commands to stop and mask the `avahi-daemon.socket` and `avahi-daemon.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `avahi` package. If the `avahi` package is removed, these dependent packages will be removed as well. Before removing the `avahi` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `avahi-daemon.socket` and `avahi-daemon.service` leaving the `avahi` package installed.\n\n```\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# systemctl mask avahi-daemon.socket avahi-daemon.service\n```\n\n```\n# systemctl stop avahi-daemon.socket avahi-daemon.service\n# apt purge avahi-daemon\n```"},{"id":"cisb-ubnt24.04lts-002.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4"}]}],"props":[{"name":"label","value":"2.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.2_Ensure_avahi_daemon_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure avahi daemon services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Dynamic Host Configuration Protocol (DHCP) is a service that allows machines to be dynamically assigned IP addresses. There are two versions of the DHCP protocol `DHCPv4` and `DHCPv6`. At startup the server may be started for one or the other via the `-4` or `-6` arguments."},{"id":"cisb-ubnt24.04lts-002.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless a system is specifically set up to act as a DHCP server, it is recommended that this package be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `isc-dhcp-server.service` and `isc-dhcp-server6.service` and remove the `isc-dhcp-server` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `isc-dhcp-server` package is required as a dependency: \n\nRun the following commands to stop and mask `isc-dhcp-server.service` and `isc-dhcp-server6.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `isc-dhcp-server` package. If the `isc-dhcp-server` package is removed, these dependent packages will be removed as well. Before removing the `isc-dhcp-server` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `isc-dhcp-server.service` and `isc-dhcp-server6.service` leaving the `isc-dhcp-server` package installed.\n\n```\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# systemctl mask isc-dhcp-server isc-dhcp-server6.service\n```\n\n```\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# apt purge isc-dhcp-server\n```"},{"id":"cisb-ubnt24.04lts-002.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `isc-dhcp-server.service` and `isc-dhcp-server6.service` and remove the `isc-dhcp-server` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `isc-dhcp-server` package is required as a dependency: \n\nRun the following commands to stop and mask `isc-dhcp-server.service` and `isc-dhcp-server6.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `isc-dhcp-server` package. If the `isc-dhcp-server` package is removed, these dependent packages will be removed as well. Before removing the `isc-dhcp-server` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `isc-dhcp-server.service` and `isc-dhcp-server6.service` leaving the `isc-dhcp-server` package installed.\n\n```\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# systemctl mask isc-dhcp-server isc-dhcp-server6.service\n```\n\n```\n# systemctl stop isc-dhcp-server.service isc-dhcp-server6.service\n# apt purge isc-dhcp-server\n```"},{"id":"cisb-ubnt24.04lts-002.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"More detailed documentation on DHCP is available at http://www.isc.org/software/dhcp."}]}],"props":[{"name":"label","value":"2.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.3_Ensure_dhcp_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure dhcp server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Domain Name System (DNS) is a hierarchical naming system that maps names to IP addresses for computers, services and other resources connected to a network.\n\n**Note:** `bind9` is the package and `bind.service` is the alias for `named.service`."},{"id":"cisb-ubnt24.04lts-002.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless a system is specifically designated to act as a DNS server, it is recommended that the package be deleted to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `named.service` and remove the `bind9` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `bind9` package is required as a dependency: \n\nRun the following commands to stop and mask `bind9.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `bind9` package. If the `bind9` package is removed, these dependent packages will be removed as well. Before removing the `bind9` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `named.service` leaving the `bind9` package installed.\n\n```\n# systemctl stop named.service\n# systemctl mask named.service\n```\n\n```\n# systemctl stop named.service\n# apt purge bind9\n```"},{"id":"cisb-ubnt24.04lts-002.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `named.service` and remove the `bind9` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `bind9` package is required as a dependency: \n\nRun the following commands to stop and mask `bind9.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `bind9` package. If the `bind9` package is removed, these dependent packages will be removed as well. Before removing the `bind9` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `named.service` leaving the `bind9` package installed.\n\n```\n# systemctl stop named.service\n# systemctl mask named.service\n```\n\n```\n# systemctl stop named.service\n# apt purge bind9\n```"},{"id":"cisb-ubnt24.04lts-002.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.4_Ensure_dns_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure dns server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`dnsmasq` is a lightweight tool that provides DNS caching, DNS forwarding and DHCP (Dynamic Host Configuration Protocol) services."},{"id":"cisb-ubnt24.04lts-002.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless a system is specifically designated to act as a DNS caching, DNS forwarding and/or DHCP server, it is recommended that the package be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `dnsmasq.service` and remove `dnsmasq` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `dnsmasq` package is required as a dependency: \n\nRun the following commands to stop and mask the `dnsmasq.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `dnsmasq` package. If the `dnsmasq` package is removed, these dependent packages will be removed as well. Before removing the `dnsmasq` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `dnsmasq.service` leaving the `dnsmasq` package installed.\n\n```\n# systemctl stop dnsmasq.service\n# systemctl mask dnsmasq.service\n```\n\n```\n# systemctl stop dnsmasq.service\n# apt purge dnsmasq\n```"},{"id":"cisb-ubnt24.04lts-002.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `dnsmasq.service` and remove `dnsmasq` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `dnsmasq` package is required as a dependency: \n\nRun the following commands to stop and mask the `dnsmasq.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `dnsmasq` package. If the `dnsmasq` package is removed, these dependent packages will be removed as well. Before removing the `dnsmasq` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `dnsmasq.service` leaving the `dnsmasq` package installed.\n\n```\n# systemctl stop dnsmasq.service\n# systemctl mask dnsmasq.service\n```\n\n```\n# systemctl stop dnsmasq.service\n# apt purge dnsmasq\n```"},{"id":"cisb-ubnt24.04lts-002.001.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.5_Ensure_dnsmasq_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure dnsmasq services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The File Transfer Protocol (FTP) provides networked computers with the ability to transfer files. `vsftpd` is the Very Secure File Transfer Protocol Daemon."},{"id":"cisb-ubnt24.04lts-002.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"FTP does not protect the confidentiality of data or authentication credentials. It is recommended SFTP be used if file transfer is required. Unless there is a need to run the system as a FTP server (for example, to allow anonymous downloads), it is recommended that the package be deleted to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `vsftpd.service` and remove the `vsftpd` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `vsftpd` package is required as a dependency: \n\nRun the following commands to stop and mask the `vsftpd.service`: \n\n**Note:** Other ftp server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service should be stopped and masked. \n\nImpact: \n\nThere may be packages that are dependent on the `vsftpd` package. If the `vsftpd` package is removed, these dependent packages will be removed as well. Before removing the `vsftpd` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `vsftpd.service` leaving the `vsftpd` package installed.\n\n```\n# systemctl stop vsftpd.service\n# systemctl mask vsftpd.service\n```\n\n```\n# systemctl stop vsftpd.service\n# apt purge vsftpd\n```"},{"id":"cisb-ubnt24.04lts-002.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `vsftpd.service` and remove the `vsftpd` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `vsftpd` package is required as a dependency: \n\nRun the following commands to stop and mask the `vsftpd.service`: \n\n**Note:** Other ftp server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service should be stopped and masked. \n\nImpact: \n\nThere may be packages that are dependent on the `vsftpd` package. If the `vsftpd` package is removed, these dependent packages will be removed as well. Before removing the `vsftpd` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `vsftpd.service` leaving the `vsftpd` package installed.\n\n```\n# systemctl stop vsftpd.service\n# systemctl mask vsftpd.service\n```\n\n```\n# systemctl stop vsftpd.service\n# apt purge vsftpd\n```"},{"id":"cisb-ubnt24.04lts-002.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.6_Ensure_ftp_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ftp server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."},{"id":"cisb-ubnt24.04lts-002.001.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the system will not need to act as an LDAP server, it is recommended that the software be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `slapd.service` and remove the `slapd` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `slapd` package is required as a dependency: \n\nRun the following commands to stop and mask `slapd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `slapd` package. If the `slapd` package is removed, these dependent packages will be removed as well. Before removing the `slapd` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `slapd.service` leaving the `slapd` package installed.\n\n```\n# systemctl stop slapd.service\n# systemctl mask slapd.service\n```\n\n```\n# systemctl stop slapd.service\n# apt purge slapd\n```"},{"id":"cisb-ubnt24.04lts-002.001.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `slapd.service` and remove the `slapd` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `slapd` package is required as a dependency: \n\nRun the following commands to stop and mask `slapd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `slapd` package. If the `slapd` package is removed, these dependent packages will be removed as well. Before removing the `slapd` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `slapd.service` leaving the `slapd` package installed.\n\n```\n# systemctl stop slapd.service\n# systemctl mask slapd.service\n```\n\n```\n# systemctl stop slapd.service\n# apt purge slapd\n```"},{"id":"cisb-ubnt24.04lts-002.001.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"For more detailed documentation on OpenLDAP, go to the project homepage at http://www.openldap.org."}]}],"props":[{"name":"label","value":"2.1.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.7_Ensure_ldap_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ldap server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`dovecot-imapd` and `dovecot-pop3d` are an open source IMAP and POP3 server for Linux based systems."},{"id":"cisb-ubnt24.04lts-002.001.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless POP3 and/or IMAP servers are to be provided by this system, it is recommended that the package be removed to reduce the potential attack surface.\n\n**Note:** Several IMAP/POP3 servers exist and can use other service names. These should also be audited and the packages removed if not required."},{"id":"cisb-ubnt24.04lts-002.001.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run one of the following commands to remove `dovecot-imapd` and `dovecot-pop3d`: \n\nRun the following commands to stop `dovecot.socket` and `dovecot.service`, and remove the `dovecot-imapd` and `dovecot-pop3d` packages: \n\n**\\- OR \\-** \n\n**\\- IF \\-** a package is installed **and** is required for dependencies: \n\nRun the following commands to stop and mask `dovecot.socket` and `dovecot.service`: \n\nImpact: \n\nThere may be packages that are dependent on `dovecot-imapd` and/or `dovecot-pop3d` packages. If `dovecot-imapd` and `dovecot-pop3d` packages are removed, these dependent packages will be removed as well. Before removing `dovecot-imapd` and/or `dovecot-pop3d` packages, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `dovecot.socket` and `dovecot.service` leaving `dovecot-imapd` and/or `dovecot-pop3d` packages installed.\n\n```\n# systemctl stop dovecot.socket dovecot.service\n# systemctl mask dovecot.socket dovecot.service\n```\n\n```\n# systemctl stop dovecot.socket dovecot.service\n# apt purge dovecot-imapd dovecot-pop3d\n```"},{"id":"cisb-ubnt24.04lts-002.001.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run one of the following commands to remove `dovecot-imapd` and `dovecot-pop3d`: \n\nRun the following commands to stop `dovecot.socket` and `dovecot.service`, and remove the `dovecot-imapd` and `dovecot-pop3d` packages: \n\n**\\- OR \\-** \n\n**\\- IF \\-** a package is installed **and** is required for dependencies: \n\nRun the following commands to stop and mask `dovecot.socket` and `dovecot.service`: \n\nImpact: \n\nThere may be packages that are dependent on `dovecot-imapd` and/or `dovecot-pop3d` packages. If `dovecot-imapd` and `dovecot-pop3d` packages are removed, these dependent packages will be removed as well. Before removing `dovecot-imapd` and/or `dovecot-pop3d` packages, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `dovecot.socket` and `dovecot.service` leaving `dovecot-imapd` and/or `dovecot-pop3d` packages installed.\n\n```\n# systemctl stop dovecot.socket dovecot.service\n# systemctl mask dovecot.socket dovecot.service\n```\n\n```\n# systemctl stop dovecot.socket dovecot.service\n# apt purge dovecot-imapd dovecot-pop3d\n```"},{"id":"cisb-ubnt24.04lts-002.001.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.8_Ensure_message_access_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure message access server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network."},{"id":"cisb-ubnt24.04lts-002.001.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the system does not export NFS shares, it is recommended that the `nfs-kernel-server` package be removed to reduce the remote attack surface."},{"id":"cisb-ubnt24.04lts-002.001.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to stop `nfs-server.service` and remove `nfs-kernel-server` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `nfs-kernel-server` package is required as a dependency: \n\nRun the following commands to stop and mask the `nfs-server.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `nfs-kernel-server` package. If the `nfs-kernel-server` package is removed, these dependent packages will be removed as well. Before removing the `nfs-kernel-server` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `nfs-server.service` leaving the `nfs-kernel-server` package installed.\n\n```\n# systemctl stop nfs-server.service\n# systemctl mask nfs-server.service\n```\n\n```\n# systemctl stop nfs-server.service\n# apt purge nfs-kernel-server\n```"},{"id":"cisb-ubnt24.04lts-002.001.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to stop `nfs-server.service` and remove `nfs-kernel-server` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `nfs-kernel-server` package is required as a dependency: \n\nRun the following commands to stop and mask the `nfs-server.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `nfs-kernel-server` package. If the `nfs-kernel-server` package is removed, these dependent packages will be removed as well. Before removing the `nfs-kernel-server` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `nfs-server.service` leaving the `nfs-kernel-server` package installed.\n\n```\n# systemctl stop nfs-server.service\n# systemctl mask nfs-server.service\n```\n\n```\n# systemctl stop nfs-server.service\n# apt purge nfs-kernel-server\n```"},{"id":"cisb-ubnt24.04lts-002.001.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-7"}]}],"props":[{"name":"label","value":"2.1.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.9_Ensure_network_file_system_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure network file system services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Network Information Service (NIS) (formally known as Yellow Pages) is a client\\-server directory service protocol for distributing system configuration files. The NIS server is a collection of programs that allow for the distribution of configuration files. The NIS client (`ypbind`) was used to bind a machine to an NIS server and receive the distributed configuration files."},{"id":"cisb-ubnt24.04lts-002.001.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`ypserv.service` is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that `ypserv.service` be removed and other, more secure services be used"},{"id":"cisb-ubnt24.04lts-002.001.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `ypserv.service` and remove `ypserv` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `ypserv` package is required as a dependency: \n\nRun the following commands to stop and mask `ypserv.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `ypserv` package. If the `ypserv` package is removed, these dependent packages will be removed as well. Before removing the `ypserv` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `ypserv.service` leaving the `ypserv` package installed.\n\n```\n# systemctl stop ypserv.service\n# systemctl mask ypserv.service\n```\n\n```\n# systemctl stop ypserv.service\n# apt purge ypserv\n```"},{"id":"cisb-ubnt24.04lts-002.001.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `ypserv.service` and remove `ypserv` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `ypserv` package is required as a dependency: \n\nRun the following commands to stop and mask `ypserv.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `ypserv` package. If the `ypserv` package is removed, these dependent packages will be removed as well. Before removing the `ypserv` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `ypserv.service` leaving the `ypserv` package installed.\n\n```\n# systemctl stop ypserv.service\n# systemctl mask ypserv.service\n```\n\n```\n# systemctl stop ypserv.service\n# apt purge ypserv\n```"},{"id":"cisb-ubnt24.04lts-002.001.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.10_Ensure_nis_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nis server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.011_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.011_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.011_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Common Unix Print System (CUPS) provides the ability to print to both local and network printers. A system running CUPS can also accept print jobs from remote systems and print them to local printers. It also provides a web based remote administration capability."},{"id":"cisb-ubnt24.04lts-002.001.011_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the system does not need to print jobs or accept print jobs from other systems, it is recommended that CUPS be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.011_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `cups.socket` and `cups.service`, and remove the `cups` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `cups` package is required as a dependency: \n\nRun the following commands to stop and mask the `cups.socket` and `cups.service`: \n\nImpact: \n\nRemoving the cups package, or disabling `cups.socket` and/or `cups.service` will prevent printing from the system, a common task for workstation systems. \n\nThere may be packages that are dependent on the `cups` package. If the `cups` package is removed, these dependent packages will be removed as well. Before removing the `cups` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `cups.socket` and `cups.service` leaving the `cups` package installed.\n\n```\n# systemctl stop cups.socket cups.service\n# systemctl mask cups.socket cups.service\n```\n\n```\n# systemctl stop cups.socket cups.service\n# apt purge cups\n```"},{"id":"cisb-ubnt24.04lts-002.001.011_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `cups.socket` and `cups.service`, and remove the `cups` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `cups` package is required as a dependency: \n\nRun the following commands to stop and mask the `cups.socket` and `cups.service`: \n\nImpact: \n\nRemoving the cups package, or disabling `cups.socket` and/or `cups.service` will prevent printing from the system, a common task for workstation systems. \n\nThere may be packages that are dependent on the `cups` package. If the `cups` package is removed, these dependent packages will be removed as well. Before removing the `cups` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `cups.socket` and `cups.service` leaving the `cups` package installed.\n\n```\n# systemctl stop cups.socket cups.service\n# systemctl mask cups.socket cups.service\n```\n\n```\n# systemctl stop cups.socket cups.service\n# apt purge cups\n```"},{"id":"cisb-ubnt24.04lts-002.001.011_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.011_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#2ff11322-3ede-4336-a120-a67aff398a42"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.11"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.11_Ensure_print_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure print server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.012_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.012_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.012_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `rpcbind` utility maps RPC services to the ports on which they listen. RPC processes notify `rpcbind` when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts `rpcbind` on the server with a particular RPC program number. The `rpcbind.service` redirects the client to the proper port number so it can communicate with the requested service.\n\nPortmapper is an RPC service, which always listens on tcp and udp 111, and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port number on the server. When a remote host makes an RPC call to that server, it first consults with portmap to determine where the RPC server is listening."},{"id":"cisb-ubnt24.04lts-002.001.012_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A small request (~82 bytes via UDP) sent to the Portmapper generates a large response (7x to 28x amplification), which makes it a suitable tool for DDoS attacks. If `rpcbind` is not required, it is recommended to remove `rpcbind` package to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.012_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `rpcbind.socket` and `rpcbind.service`, and remove the `rpcbind` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `rpcbind` package is required as a dependency: \n\nRun the following commands to stop and mask the `rpcbind.socket` and `rpcbind.service`: \n\nImpact: \n\nMany of the libvirt packages used by Enterprise Linux virtualization, and the `nfs-utils` package used for The Network File System (NFS), are dependent on the `rpcbind` package. If the `rpcbind` package is removed, these dependent packages will be removed as well. Before removing the `rpcbind` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `rpcbind.socket` and `rpcbind.service` leaving the `rpcbind` package installed.\n\n```\n# systemctl stop rpcbind.socket rpcbind.service\n# systemctl mask rpcbind.socket rpcbind.service\n```\n\n```\n# systemctl stop rpcbind.socket rpcbind.service\n# apt purge rpcbind\n```"},{"id":"cisb-ubnt24.04lts-002.001.012_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `rpcbind.socket` and `rpcbind.service`, and remove the `rpcbind` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `rpcbind` package is required as a dependency: \n\nRun the following commands to stop and mask the `rpcbind.socket` and `rpcbind.service`: \n\nImpact: \n\nMany of the libvirt packages used by Enterprise Linux virtualization, and the `nfs-utils` package used for The Network File System (NFS), are dependent on the `rpcbind` package. If the `rpcbind` package is removed, these dependent packages will be removed as well. Before removing the `rpcbind` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `rpcbind.socket` and `rpcbind.service` leaving the `rpcbind` package installed.\n\n```\n# systemctl stop rpcbind.socket rpcbind.service\n# systemctl mask rpcbind.socket rpcbind.service\n```\n\n```\n# systemctl stop rpcbind.socket rpcbind.service\n# apt purge rpcbind\n```"},{"id":"cisb-ubnt24.04lts-002.001.012_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.012_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-7"}]}],"props":[{"name":"label","value":"2.1.12"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.12_Ensure_rpcbind_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rpcbind services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.013_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.013_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.013_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `rsync` service can be used to synchronize files between systems over network links."},{"id":"cisb-ubnt24.04lts-002.001.013_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`rsync.service` presents a security risk as the `rsync` protocol is unencrypted.\n\nThe `rsync` package should be removed to reduce the attack area of the system."},{"id":"cisb-ubnt24.04lts-002.001.013_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `rsync.service`, and remove the `rsync` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `rsync` package is required as a dependency: \n\nRun the following commands to stop and mask `rsync.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `rsync` package. If the `rsync` package is removed, these dependent packages will be removed as well. Before removing the `rsync` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `rsync.service` leaving the `rsync` package installed.\n\n```\n# systemctl stop rsync.service\n# systemctl mask rsync.service\n```\n\n```\n# systemctl stop rsync.service\n# apt purge rsync\n```"},{"id":"cisb-ubnt24.04lts-002.001.013_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `rsync.service`, and remove the `rsync` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `rsync` package is required as a dependency: \n\nRun the following commands to stop and mask `rsync.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `rsync` package. If the `rsync` package is removed, these dependent packages will be removed as well. Before removing the `rsync` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `rsync.service` leaving the `rsync` package installed.\n\n```\n# systemctl stop rsync.service\n# systemctl mask rsync.service\n```\n\n```\n# systemctl stop rsync.service\n# apt purge rsync\n```"},{"id":"cisb-ubnt24.04lts-002.001.013_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.013_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.13"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.13_Ensure_rsync_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsync services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.014_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.014_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.014_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Samba daemon allows system administrators to configure their Linux systems to share file systems and directories with Windows desktops. Samba will advertise the file systems and directories via the Server Message Block (SMB) protocol. Windows desktop users will be able to mount these directories and file systems as letter drives on their systems."},{"id":"cisb-ubnt24.04lts-002.001.014_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If there is no need to mount directories and file systems to Windows systems, then this service should be deleted to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.014_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `smbd.service` and remove `samba` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `samba` package is required as a dependency: \n\nRun the following commands to stop and mask the `smbd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `samba` package. If the `samba` package is removed, these dependent packages will be removed as well. Before removing the `samba` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `smbd.service` leaving the `samba` package installed.\n\n```\n# systemctl stop smbd.service\n# systemctl mask smbd.service\n```\n\n```\n# systemctl stop smbd.service\n# apt purge samba\n```"},{"id":"cisb-ubnt24.04lts-002.001.014_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `smbd.service` and remove `samba` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `samba` package is required as a dependency: \n\nRun the following commands to stop and mask the `smbd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `samba` package. If the `samba` package is removed, these dependent packages will be removed as well. Before removing the `samba` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `smbd.service` leaving the `samba` package installed.\n\n```\n# systemctl stop smbd.service\n# systemctl mask smbd.service\n```\n\n```\n# systemctl stop smbd.service\n# apt purge samba\n```"},{"id":"cisb-ubnt24.04lts-002.001.014_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.014_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6, CM-7"}]}],"props":[{"name":"label","value":"2.1.14"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.14_Ensure_samba_file_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure samba file server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.015_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.015_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.015_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Simple Network Management Protocol (SNMP) is a widely used protocol for monitoring the health and welfare of network equipment, computer equipment and devices like UPSs.\n\nNet\\-SNMP is a suite of applications used to implement SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901\\-1908), and SNMPv3 (RFCs 3411\\-3418) using both IPv4 and IPv6.\n\nSupport for SNMPv2 classic (a.k.a. \"SNMPv2 historic\" \\- RFCs 1441\\-1452) was dropped with the 4.0 release of the UCD\\-snmp package.\n\nThe Simple Network Management Protocol (SNMP) server is used to listen for SNMP commands from an SNMP management system, execute the commands or collect the information and then send results back to the requesting system."},{"id":"cisb-ubnt24.04lts-002.001.015_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The SNMP server can communicate using `SNMPv1`, which transmits data in the clear and does not require authentication to execute commands. `SNMPv3` replaces the simple/clear text password sharing used in `SNMPv2` with more securely encoded parameters. If the the SNMP service is not required, the `snmpd` package should be removed to reduce the attack surface of the system.\n\n**Note:** If SNMP is required:\n\n- The server should be configured for `SNMP v3` only. `User Authentication` and `Message Encryption` should be configured.\n- If `SNMP v2` is **absolutely** necessary, modify the community strings' values."},{"id":"cisb-ubnt24.04lts-002.001.015_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `snmpd.service` and remove the `snmpd` package: \n\n**\\- OR \\-** If the package is required for dependencies: \n\nRun the following commands to stop and mask the `snmpd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `snmpd` package. If the `snmpd` package is removed, these packages will be removed as well. \n\nBefore removing the `snmpd` package, review any dependent packages to determine if they are required on the system. If a dependent package is required, stop and mask the `snmpd.service` leaving the `snmpd` package installed.\n\n```\n# systemctl stop snmpd.service\n# systemctl mask snmpd.service\n```\n\n```\n# systemctl stop snmpd.service\n# apt purge snmpd\n```"},{"id":"cisb-ubnt24.04lts-002.001.015_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `snmpd.service` and remove the `snmpd` package: \n\n**\\- OR \\-** If the package is required for dependencies: \n\nRun the following commands to stop and mask the `snmpd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `snmpd` package. If the `snmpd` package is removed, these packages will be removed as well. \n\nBefore removing the `snmpd` package, review any dependent packages to determine if they are required on the system. If a dependent package is required, stop and mask the `snmpd.service` leaving the `snmpd` package installed.\n\n```\n# systemctl stop snmpd.service\n# systemctl mask snmpd.service\n```\n\n```\n# systemctl stop snmpd.service\n# apt purge snmpd\n```"},{"id":"cisb-ubnt24.04lts-002.001.015_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.015_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.15"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.15_Ensure_snmp_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure snmp services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.016_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.016_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.016_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Trivial File Transfer Protocol (TFTP) is a simple protocol for exchanging files between two TCP/IP machines. TFTP servers allow connections from a TFTP Client for sending and receiving files."},{"id":"cisb-ubnt24.04lts-002.001.016_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless there is a need to run the system as a TFTP server, it is recommended that the package be removed to reduce the potential attack surface.\n\nTFTP does not have built\\-in encryption, access control or authentication. This makes it very easy for an attacker to exploit TFTP to gain access to files"},{"id":"cisb-ubnt24.04lts-002.001.016_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `tftpd-hpa.service`, and remove the `tftpd-hpa` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `tftpd-hpa` package is required as a dependency: \n\nRun the following commands to stop and mask `tftpd-hpa.service`: \n\nImpact: \n\nTFTP is often used to provide files for network booting such as for PXE based installation of servers. \n\nThere may be packages that are dependent on the `tftpd-hpa` package. If the `tftpd-hpa` package is removed, these dependent packages will be removed as well. Before removing the `tftpd-hpa` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `tftpd-hpa.service` leaving the `tftpd-hpa` package installed.\n\n```\n# systemctl stop tftpd-hpa.service\n# systemctl mask tftpd-hpa.service\n```\n\n```\n# systemctl stop tftpd-hpa.service\n# apt purge tftpd-hpa\n```"},{"id":"cisb-ubnt24.04lts-002.001.016_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `tftpd-hpa.service`, and remove the `tftpd-hpa` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `tftpd-hpa` package is required as a dependency: \n\nRun the following commands to stop and mask `tftpd-hpa.service`: \n\nImpact: \n\nTFTP is often used to provide files for network booting such as for PXE based installation of servers. \n\nThere may be packages that are dependent on the `tftpd-hpa` package. If the `tftpd-hpa` package is removed, these dependent packages will be removed as well. Before removing the `tftpd-hpa` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask `tftpd-hpa.service` leaving the `tftpd-hpa` package installed.\n\n```\n# systemctl stop tftpd-hpa.service\n# systemctl mask tftpd-hpa.service\n```\n\n```\n# systemctl stop tftpd-hpa.service\n# apt purge tftpd-hpa\n```"},{"id":"cisb-ubnt24.04lts-002.001.016_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.016_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.16"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.16_Ensure_tftp_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure tftp server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.017_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.017_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.017_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Squid is a standard proxy server used in many distributions and environments."},{"id":"cisb-ubnt24.04lts-002.001.017_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless a system is specifically set up to act as a proxy server, it is recommended that the squid package be removed to reduce the potential attack surface.\n\n**Note:** Several HTTP proxy servers exist. These should be checked and removed unless required."},{"id":"cisb-ubnt24.04lts-002.001.017_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `squid.service` and remove the `squid` package: \n\n**\\- OR \\-** If the `squid` package is required as a dependency: \n\nRun the following commands to stop and mask the `squid.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `squid` package. If the `squid` package is removed, these dependent packages will be removed as well. Before removing the `squid` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `squid.service` leaving the `squid` package installed.\n\n```\n# systemctl stop squid.service\n# systemctl mask squid.service\n```\n\n```\n# systemctl stop squid.service\n# apt purge squid\n```"},{"id":"cisb-ubnt24.04lts-002.001.017_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `squid.service` and remove the `squid` package: \n\n**\\- OR \\-** If the `squid` package is required as a dependency: \n\nRun the following commands to stop and mask the `squid.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `squid` package. If the `squid` package is removed, these dependent packages will be removed as well. Before removing the `squid` package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `squid.service` leaving the `squid` package installed.\n\n```\n# systemctl stop squid.service\n# systemctl mask squid.service\n```\n\n```\n# systemctl stop squid.service\n# apt purge squid\n```"},{"id":"cisb-ubnt24.04lts-002.001.017_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.017_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.17"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.17_Ensure_web_proxy_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure web proxy server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.018_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.018_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.018_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Web servers provide the ability to host web site content."},{"id":"cisb-ubnt24.04lts-002.001.018_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless there is a local site approved requirement to run a web server service on the system, web server packages should be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.018_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `httpd.socket`, `httpd.service`, and `nginx.service`, and remove `apache2` and `nginx` packages: \n\n**\\- OR \\-** \n\n**\\- IF \\-** a package is installed **and** is required for dependencies: \n\nRun the following commands to stop and mask `apache2.socket`, `apache2.service`, and `nginx.service`: \n\n**Note:** Other web server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service and socket should be stopped and masked. \n\nImpact: \n\nRemoval of web server packages will remove that ability for the server to host web services. \n\n**\\- IF \\-** the web server package is required for a dependency, any related service or socket should be stopped and masked. \n\n**Note:** If the remediation steps to mask a service are followed and that package is not installed on the system, the service and/or socket will still be masked. If the package is installed due to an approved requirement to host a web server, the associated service and/or socket would need to be unmasked before it could be enabled and/or started.\n\n```\n# systemctl stop apache2.socket apache2.service nginx.service\n# systemctl mask apache2.socket apache2.service nginx.service\n```\n\n```\n# systemctl stop apache2.socket apache2.service nginx.service\n# apt purge apache2 nginx\n```"},{"id":"cisb-ubnt24.04lts-002.001.018_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `httpd.socket`, `httpd.service`, and `nginx.service`, and remove `apache2` and `nginx` packages: \n\n**\\- OR \\-** \n\n**\\- IF \\-** a package is installed **and** is required for dependencies: \n\nRun the following commands to stop and mask `apache2.socket`, `apache2.service`, and `nginx.service`: \n\n**Note:** Other web server packages may exist. If not required and authorized by local site policy, they should also be removed. If the package is required for a dependency, the service and socket should be stopped and masked. \n\nImpact: \n\nRemoval of web server packages will remove that ability for the server to host web services. \n\n**\\- IF \\-** the web server package is required for a dependency, any related service or socket should be stopped and masked. \n\n**Note:** If the remediation steps to mask a service are followed and that package is not installed on the system, the service and/or socket will still be masked. If the package is installed due to an approved requirement to host a web server, the associated service and/or socket would need to be unmasked before it could be enabled and/or started.\n\n```\n# systemctl stop apache2.socket apache2.service nginx.service\n# systemctl mask apache2.socket apache2.service nginx.service\n```\n\n```\n# systemctl stop apache2.socket apache2.service nginx.service\n# apt purge apache2 nginx\n```"},{"id":"cisb-ubnt24.04lts-002.001.018_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.018_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.18"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.18_Ensure_web_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure web server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.019_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.019_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.019_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The eXtended InterNET Daemon (`xinetd`) is an open source super daemon that replaced the original `inetd` daemon. The `xinetd` daemon listens for well known services and dispatches the appropriate daemon to properly respond to service requests."},{"id":"cisb-ubnt24.04lts-002.001.019_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If there are no `xinetd` services required, it is recommended that the package be removed to reduce the attack surface are of the system.\n\n**Note:** If an `xinetd` service or services are required, ensure that any `xinetd` service not required is stopped and masked"},{"id":"cisb-ubnt24.04lts-002.001.019_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `xinetd.service`, and remove the `xinetd` package: \n\n**\\-OR\\-** \n\n**\\-IF\\-** the `xinetd` package is required as a dependency: \n\nRun the following commands to stop and mask the `xinetd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `xinetd` package. If the `xinetd` package is removed, these dependent packages will be removed as well. Before removing the `xinetd` package, review any dependent packages to determine if they are required on the system. \n\n**\\-IF\\-** a dependent package is required: stop and mask xinetd.service leaving the xinetd package installed.\n\n```\n# systemctl stop xinetd.service\n# systemctl mask xinetd.service\n```\n\n```\n# systemctl stop xinetd.service\n# apt purge xinetd\n```"},{"id":"cisb-ubnt24.04lts-002.001.019_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `xinetd.service`, and remove the `xinetd` package: \n\n**\\-OR\\-** \n\n**\\-IF\\-** the `xinetd` package is required as a dependency: \n\nRun the following commands to stop and mask the `xinetd.service`: \n\nImpact: \n\nThere may be packages that are dependent on the `xinetd` package. If the `xinetd` package is removed, these dependent packages will be removed as well. Before removing the `xinetd` package, review any dependent packages to determine if they are required on the system. \n\n**\\-IF\\-** a dependent package is required: stop and mask xinetd.service leaving the xinetd package installed.\n\n```\n# systemctl stop xinetd.service\n# systemctl mask xinetd.service\n```\n\n```\n# systemctl stop xinetd.service\n# apt purge xinetd\n```"},{"id":"cisb-ubnt24.04lts-002.001.019_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.019_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.19"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.19_Ensure_xinetd_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure xinetd services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.020_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.020_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.020_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The X Window System provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. The X Windows system is typically used on workstations where users login, but not on servers where users typically do not login."},{"id":"cisb-ubnt24.04lts-002.001.020_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless your organization specifically requires graphical login access via X Windows, remove it to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.001.020_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** a Graphical Desktop Manager or X\\-Windows server is not required and approved by local site policy: \n\nRun the following command to remove the X Windows Server package: \n\nImpact: \n\nIf a Graphical Desktop Manager (GDM) is in use on the system, there may be a dependency on the `xorg-x11-server-common` package. If the GDM is required and approved by local site policy, the package should **not** be removed. \n\nMany Linux systems run applications which require a Java runtime. Some Linux Java packages have a dependency on specific X Windows xorg\\-x11\\-fonts. One workaround to avoid this dependency is to use the \"headless\" Java packages for your specific Java runtime.\n\n```\n# apt purge xserver-common\n```"},{"id":"cisb-ubnt24.04lts-002.001.020_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** a Graphical Desktop Manager or X\\-Windows server is not required and approved by local site policy: \n\nRun the following command to remove the X Windows Server package: \n\nImpact: \n\nIf a Graphical Desktop Manager (GDM) is in use on the system, there may be a dependency on the `xorg-x11-server-common` package. If the GDM is required and approved by local site policy, the package should **not** be removed. \n\nMany Linux systems run applications which require a Java runtime. Some Linux Java packages have a dependency on specific X Windows xorg\\-x11\\-fonts. One workaround to avoid this dependency is to use the \"headless\" Java packages for your specific Java runtime.\n\n```\n# apt purge xserver-common\n```"},{"id":"cisb-ubnt24.04lts-002.001.020_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#bf712ff3-8edb-40bd-bb17-b10e10bc0964"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.020_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-11"}]}],"props":[{"name":"label","value":"2.1.20"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.20_Ensure_X_window_server_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure X window server services are not in use"},{"id":"cisb-ubnt24.04lts-002.001.021_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.021_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.021_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Mail Transfer Agents (MTA), such as sendmail and Postfix, are used to listen for incoming mail and transfer the messages to the appropriate user or mail server. If the system is not intended to be a mail server, it is recommended that the MTA be configured to only process local mail."},{"id":"cisb-ubnt24.04lts-002.001.021_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The software for all Mail Transfer Agents is complex and most have a long history of security issues. While it is important to ensure that the system can process local mail messages, it is not necessary to have the MTA's daemon listening on a port unless the server is intended to be a mail server that receives and processes mail from other systems."},{"id":"cisb-ubnt24.04lts-002.001.021_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/postfix/main.cf` and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below: \n\nRun the following command to restart `postfix`: \n\n**Note:** \n\n- This recommendation is designed around the postfix mail server.\n- Depending on your environment you may have an alternative MTA installed such as exim4. If this is the case consult the documentation for your installed MTA to configure the recommended state.\n\n```\n# systemctl restart postfix\n```\n\n```\ninet_interfaces = loopback-only\n```"},{"id":"cisb-ubnt24.04lts-002.001.021_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/postfix/main.cf` and add the following line to the RECEIVING MAIL section. If the line already exists, change it to look like the line below: \n\nRun the following command to restart `postfix`: \n\n**Note:** \n\n- This recommendation is designed around the postfix mail server.\n- Depending on your environment you may have an alternative MTA installed such as exim4. If this is the case consult the documentation for your installed MTA to configure the recommended state.\n\n```\n# systemctl restart postfix\n```\n\n```\ninet_interfaces = loopback-only\n```"},{"id":"cisb-ubnt24.04lts-002.001.021_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.021_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.21"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.21_Ensure_mail_transfer_agent_is_configured_for_local-only_mode"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure mail transfer agent is configured for local-only mode"},{"id":"cisb-ubnt24.04lts-002.001.022_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.001.022_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.001.022_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A network port is identified by its number, the associated IP address, and the type of the communication protocol such as TCP or UDP.\n\nA listening port is a network port on which an application or process listens on, acting as a communication endpoint.\n\nEach listening port can be open or closed (filtered) using a firewall. In general terms, an open port is a network port that accepts incoming packets from remote locations."},{"id":"cisb-ubnt24.04lts-002.001.022_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Services listening on the system pose a potential risk as an attack vector. These services should be reviewed, and if not required, the service should be stopped, and the package containing the service should be removed. If required packages have a dependency, the service should be stopped and masked to reduce the attack surface of the system."},{"id":"cisb-ubnt24.04lts-002.001.022_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop the service and remove the package containing the service: \n\n**\\- OR \\-** If required packages have a dependency: \n\nRun the following commands to stop and mask the service and socket: \n\n**Note:** replace `` with the appropriate service name. \n\nImpact: \n\nThere may be packages that are dependent on the service's package. If the service's package is removed, these dependent packages will be removed as well. Before removing the service's package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `.socket` and `.service` leaving the service's package installed.\n\n```\n# systemctl stop .socket .service\n# systemctl mask .socket .service\n```\n\n```\n# systemctl stop .socket .service\n# apt purge\n```"},{"id":"cisb-ubnt24.04lts-002.001.022_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop the service and remove the package containing the service: \n\n**\\- OR \\-** If required packages have a dependency: \n\nRun the following commands to stop and mask the service and socket: \n\n**Note:** replace `` with the appropriate service name. \n\nImpact: \n\nThere may be packages that are dependent on the service's package. If the service's package is removed, these dependent packages will be removed as well. Before removing the service's package, review any dependent packages to determine if they are required on the system. \n\n**\\- IF \\-** a dependent package is required: stop and mask the `.socket` and `.service` leaving the service's package installed.\n\n```\n# systemctl stop .socket .service\n# systemctl mask .socket .service\n```\n\n```\n# systemctl stop .socket .service\n# apt purge\n```"},{"id":"cisb-ubnt24.04lts-002.001.022_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.001.022_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.1.22"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.1.22_Ensure_only_approved_services_are_listening_on_a_network_interface"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure only approved services are listening on a network interface"}]},{"id":"cisb-ubnt24.04lts-002.002_grp","parts":[{"id":"cisb-ubnt24.04lts-002.002_ovrvw","name":"overview","prose":"A number of insecure services exist. While disabling the servers prevents a local attack against these services, it is advised to remove their clients unless they are required.\n\n**Note:** This should not be considered a comprehensive list of insecure service clients. You may wish to consider additions to those listed here for your environment."}],"props":[{"name":"label","value":"2.2"}],"title":"Configure Client Services","controls":[{"id":"cisb-ubnt24.04lts-002.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Network Information Service (NIS), formerly known as Yellow Pages, is a client\\-server directory service protocol used to distribute system configuration files. The NIS client was used to bind a machine to an NIS server and receive the distributed configuration files."},{"id":"cisb-ubnt24.04lts-002.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The NIS service is inherently an insecure system that has been vulnerable to DOS attacks, buffer overflows and has poor authentication for querying NIS maps. NIS generally has been replaced by such protocols as Lightweight Directory Access Protocol (LDAP). It is recommended that the service be removed."},{"id":"cisb-ubnt24.04lts-002.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Uninstall `nis`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge nis\n```"},{"id":"cisb-ubnt24.04lts-002.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Uninstall `nis`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge nis\n```"},{"id":"cisb-ubnt24.04lts-002.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#bf712ff3-8edb-40bd-bb17-b10e10bc0964"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7, CM-11"}]}],"props":[{"name":"label","value":"2.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.1_Ensure_NIS_Client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure NIS Client is not installed"},{"id":"cisb-ubnt24.04lts-002.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `rsh-client` package contains the client commands for the rsh services."},{"id":"cisb-ubnt24.04lts-002.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"These legacy clients contain numerous security exposures and have been replaced with the more secure SSH package. Even if the server is removed, it is best to ensure the clients are also removed to prevent users from inadvertently attempting to use these commands and therefore exposing their credentials. Note that removing the `rsh-client` package removes the clients for `rsh` , `rcp` and `rlogin` ."},{"id":"cisb-ubnt24.04lts-002.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Uninstall `rsh`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge rsh-client\n```"},{"id":"cisb-ubnt24.04lts-002.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Uninstall `rsh`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge rsh-client\n```"},{"id":"cisb-ubnt24.04lts-002.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.2_Ensure_rsh_client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsh client is not installed"},{"id":"cisb-ubnt24.04lts-002.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `talk` software makes it possible for users to send and receive messages across systems through a terminal session. The `talk` client, which allows initialization of talk sessions, is installed by default."},{"id":"cisb-ubnt24.04lts-002.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The software presents a security risk as it uses unencrypted protocols for communication."},{"id":"cisb-ubnt24.04lts-002.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Uninstall `talk`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge talk\n```"},{"id":"cisb-ubnt24.04lts-002.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Uninstall `talk`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge talk\n```"},{"id":"cisb-ubnt24.04lts-002.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.3_Ensure_talk_client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure talk client is not installed"},{"id":"cisb-ubnt24.04lts-002.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `inetutils-telnet` package contains the `telnet` client, which allows users to start connections to other systems via the telnet protocol."},{"id":"cisb-ubnt24.04lts-002.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `telnet` protocol is insecure and unencrypted. The use of an unencrypted transmission medium could allow an unauthorized user to steal credentials. The `ssh` package provides an encrypted session and stronger security and is included in most Linux distributions."},{"id":"cisb-ubnt24.04lts-002.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to uninstall `telnet` & `inetutils-telnet`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge telnet\n# apt purge inetutils-telnet\n```"},{"id":"cisb-ubnt24.04lts-002.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to uninstall `telnet` & `inetutils-telnet`: \n\nImpact: \n\nMany insecure service clients are used as troubleshooting tools and in testing environments. Uninstalling them can inhibit capability to test and troubleshoot. If they are required it is advisable to remove the clients after use to prevent accidental or intentional misuse.\n\n```\n# apt purge telnet\n# apt purge inetutils-telnet\n```"},{"id":"cisb-ubnt24.04lts-002.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7, CM-11"}]}],"props":[{"name":"label","value":"2.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.4_Ensure_telnet_client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure telnet client is not installed"},{"id":"cisb-ubnt24.04lts-002.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Lightweight Directory Access Protocol (LDAP) was introduced as a replacement for NIS/YP. It is a service that provides a method for looking up information from a central database."},{"id":"cisb-ubnt24.04lts-002.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the system will not need to act as an LDAP client, it is recommended that the software be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Uninstall `ldap-utils`: \n\nImpact: \n\nRemoving the LDAP client will prevent or inhibit using LDAP for authentication in your environment.\n\n```\n# apt purge ldap-utils\n```"},{"id":"cisb-ubnt24.04lts-002.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Uninstall `ldap-utils`: \n\nImpact: \n\nRemoving the LDAP client will prevent or inhibit using LDAP for authentication in your environment.\n\n```\n# apt purge ldap-utils\n```"},{"id":"cisb-ubnt24.04lts-002.002.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"2.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.5_Ensure_ldap_client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ldap client is not installed"},{"id":"cisb-ubnt24.04lts-002.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`tnftp` an enhanced FTP client, is the user interface to the Internet standard File Transfer Protocol. The program allows a user to transfer files to and from a remote network site."},{"id":"cisb-ubnt24.04lts-002.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unless there is a need to run the system using Internet standard File Transfer Protocol (for example, to allow anonymous downloads), it is recommended that the package be removed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-002.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to uninstall `tnftp` & `ftp`:\n\n```\n# apt purge ftp\n# apt purge tnftp\n```"},{"id":"cisb-ubnt24.04lts-002.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to uninstall `tnftp` & `ftp`:\n\n```\n# apt purge ftp\n# apt purge tnftp\n```"},{"id":"cisb-ubnt24.04lts-002.002.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.002.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7, CM-11"}]}],"props":[{"name":"label","value":"2.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.2.6_Ensure_ftp_client_is_not_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ftp client is not installed"}]},{"id":"cisb-ubnt24.04lts-002.003_grp","parts":[{"id":"cisb-ubnt24.04lts-002.003_ovrvw","name":"overview","prose":"It is recommended that systems be configured to synchronize their time using a service such as `systemd-timesyncd`, or `chrony`.\n\nVirtual systems may be configured to receive their time synchronization from their host system.\n\nThe host system must be configured to synchronize its time from an authoritative source to be considered compliant with this section.\n\nAny \"physical\" clock present on a system should be synchronized from an authoritative time source.\n\n**Only one time synchronization method should be in use on the system**\n\n**Notes:** Only the section related to the time synchronization method in use on the system should be followed, all other time synchronization recommendations should be skipped"}],"props":[{"name":"label","value":"2.3"}],"title":"Configure Time Synchronization","groups":[{"id":"cisb-ubnt24.04lts-002.003.001_grp","parts":[{"id":"cisb-ubnt24.04lts-002.003.001_ovrvw","name":"overview","prose":"It is recommended that physical systems and virtual guests lacking direct access to the physical host's clock be configured to synchronize their time using a service such as `systemd-timesyncd`, or `chrony`."}],"props":[{"name":"label","value":"2.3.1"}],"title":"Ensure time synchronization is in use","controls":[{"id":"cisb-ubnt24.04lts-002.003.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them.\n\n**Note:**\n\n- **On virtual systems where host based time synchronization is available consult your virtualization software documentation and verify that host based synchronization is in use and follows local site policy. In this scenario, this section should be skipped**\n- Only **one** time synchronization method should be in use on the system. Configuring multiple time synchronization methods could lead to unexpected or unreliable results"},{"id":"cisb-ubnt24.04lts-002.003.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Time synchronization is important to support time sensitive security mechanisms and ensures log files have consistent time records across the enterprise, which aids in forensic investigations."},{"id":"cisb-ubnt24.04lts-002.003.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"On physical systems, and virtual systems where host based time synchronization is not available. \n\nSelect **one** of the two time synchronization daemons; **`chrony (1)`** or **`systemd-timesyncd (2)`** and following the remediation procedure for the selected daemon. \n\n**Note:** enabling more than one synchronization daemon could lead to unexpected or unreliable results: \n\n1. **`chrony`**\n\nRun the following command to install `chrony`: \n\nRun the following commands to stop and mask the `systemd-timesyncd` daemon: \n\n**Note:** \n\n- Subsection: ***Configure chrony*** should be followed\n- Subsection: ***Configure systemd\\-timesyncd*** should be skipped\n\n1. **`systemd-timesyncd`**\n\nRun the following command to remove the chrony package: \n\n**Note:** \n\n- Subsection: ***Configure systemd\\-timesyncd*** should be followed\n- Subsection: ***Configure chrony*** should be skipped\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\n# systemctl stop systemd-timesyncd.service\n\n# systemctl mask systemd-timesyncd.service\n```\n\n```\n# apt install chrony\n```"},{"id":"cisb-ubnt24.04lts-002.003.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"On physical systems, and virtual systems where host based time synchronization is not available. \n\nSelect **one** of the two time synchronization daemons; **`chrony (1)`** or **`systemd-timesyncd (2)`** and following the remediation procedure for the selected daemon. \n\n**Note:** enabling more than one synchronization daemon could lead to unexpected or unreliable results: \n\n1. **`chrony`**\n\nRun the following command to install `chrony`: \n\nRun the following commands to stop and mask the `systemd-timesyncd` daemon: \n\n**Note:** \n\n- Subsection: ***Configure chrony*** should be followed\n- Subsection: ***Configure systemd\\-timesyncd*** should be skipped\n\n1. **`systemd-timesyncd`**\n\nRun the following command to remove the chrony package: \n\n**Note:** \n\n- Subsection: ***Configure systemd\\-timesyncd*** should be followed\n- Subsection: ***Configure chrony*** should be skipped\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\n# systemctl stop systemd-timesyncd.service\n\n# systemctl mask systemd-timesyncd.service\n```\n\n```\n# apt install chrony\n```"},{"id":"cisb-ubnt24.04lts-002.003.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-12"}]}],"props":[{"name":"label","value":"2.3.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.1.1_Ensure_a_single_time_synchronization_daemon_is_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure a single time synchronization daemon is in use"}]},{"id":"cisb-ubnt24.04lts-002.003.002_grp","parts":[{"id":"cisb-ubnt24.04lts-002.003.002_ovrvw","name":"overview","prose":"`systemd-timesyncd` is a daemon that has been added for synchronizing the system clock across the network. It implements an SNTP client. In contrast to NTP implementations such as chrony or the NTP reference server this only implements a client side, and does not bother with the full NTP complexity, focusing only on querying time from one remote server and synchronizing the local clock to it. The daemon runs with minimal privileges, and has been hooked up with networkd to only operate when network connectivity is available. The daemon saves the current clock to disk every time a new NTP sync has been acquired, and uses this to possibly correct the system clock early at bootup, in order to accommodate for systems that lack an RTC such as the Raspberry Pi and embedded devices, and make sure that time monotonically progresses on these systems, even if it is not always correct. To make use of this daemon a new system user and group \"systemd\\-timesync\" needs to be created on installation of systemd.\n\nThe default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults. Initially, the main configuration file in /etc/systemd/ contains commented out entries showing the defaults as a guide to the administrator. Local overrides can be created by editing this file or by creating drop\\-ins, as described below. Using drop\\-ins for local configuration is recommended over modifications to the main configuration file.\n\nIn addition to the \"main\" configuration file, drop\\-in configuration snippets are read from `/usr/lib/systemd/*.conf.d/`, `/usr/local/lib/systemd/*.conf.d/`, and `/etc/systemd/*.conf.d/`. Those drop\\-ins have higher precedence and override the main configuration file. Files in the \\*.conf.d/ configuration subdirectories are sorted by their filename in lexicographic order, regardless of in which of the subdirectories they reside. When multiple files specify the same option, for options which accept just a single value, the entry in the file sorted last takes precedence, and for options which accept a list of values, entries are collected as they occur in the sorted files.\n\nWhen packages need to customize the configuration, they can install drop\\-ins under /usr/. Files in /etc/ are reserved for the local administrator, who may use this logic to override the configuration files installed by vendor packages. Drop\\-ins have to be used to override package drop\\-ins, since the main configuration file has lower precedence. It is recommended to prefix all filenames in those subdirectories with a two\\-digit number and a dash, to simplify the ordering of the files.\n\nTo disable a configuration file supplied by the vendor, the recommended way is to place a symlink to /dev/null in the configuration directory in /etc/, with the same filename as the vendor configuration file.\n\n**Note:**\n\n- The recommendations in this section only apply if `timesyncd` is in use on the system\n- The `systemd-timesyncd` service specifically implements only SNTP.\n - This minimalistic service will set the system clock for large offsets or slowly adjust it for smaller deltas\n - More complex use cases are not covered by `systemd-timesyncd`\n - This minimalistic service will set the system clock for large offsets or slowly adjust it for smaller deltas\n - More complex use cases are not covered by `systemd-timesyncd`\n- **If `chrony` is used, `systemd-timesyncd` should be stopped and masked, and this section skipped**\n- **One, and only one, time synchronization method should be in use on the system**"}],"props":[{"name":"label","value":"2.3.2"}],"title":"Configure systemd-timesyncd","controls":[{"id":"cisb-ubnt24.04lts-002.003.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`NTP=`\n\n- A space\\-separated list of NTP server host names or IP addresses. During runtime this list is combined with any per\\-interface NTP servers acquired from systemd\\-networkd.service(8). systemd\\-timesyncd will contact all configured system or per\\-interface servers in turn, until one responds. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. This setting defaults to an empty list.\n\n`FallbackNTP=`\n\n- A space\\-separated list of NTP server host names or IP addresses to be used as the fallback NTP servers. Any per\\-interface NTP servers obtained from systemd\\-networkd.service(8) take precedence over this setting, as do any servers set via NTP= above. This setting is hence only relevant if no other NTP server information is known. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. If this option is not given, a compiled\\-in list of NTP servers is used."},{"id":"cisb-ubnt24.04lts-002.003.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations"},{"id":"cisb-ubnt24.04lts-002.003.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set `NTP` and/or `FallbackNPT` parameters to local site approved authoritative time server(s) in `/etc/systemd/timesyncd.conf` or a file in `/etc/systemd/timesyncd.conf.d/` ending in `.conf` in the `[Time]` section: \n\n*Example file:* \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"NTP=time.nist.gov\" \"FallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov\")\n [ ! -d /etc/systemd/timesyncd.conf.d/ ] && mkdir /etc/systemd/timesyncd.conf.d/\n if grep -Psq -- '^\\h*\\[Time\\]' /etc/systemd/timesyncd.conf.d/60-timesyncd.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n else\n printf '%s\\n' \"\" \"[Time]\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n fi\n}\n```\n\n```\n[Time]\nNTP=time.nist.gov # Uses the generic name for NIST's time servers\nFallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov # Space separated list of NIST time servers\n```"},{"id":"cisb-ubnt24.04lts-002.003.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set `NTP` and/or `FallbackNPT` parameters to local site approved authoritative time server(s) in `/etc/systemd/timesyncd.conf` or a file in `/etc/systemd/timesyncd.conf.d/` ending in `.conf` in the `[Time]` section: \n\n*Example file:* \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"NTP=time.nist.gov\" \"FallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov\")\n [ ! -d /etc/systemd/timesyncd.conf.d/ ] && mkdir /etc/systemd/timesyncd.conf.d/\n if grep -Psq -- '^\\h*\\[Time\\]' /etc/systemd/timesyncd.conf.d/60-timesyncd.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n else\n printf '%s\\n' \"\" \"[Time]\" \"${a_settings[@]}\" >> /etc/systemd/timesyncd.conf.d/60-timesyncd.conf\n fi\n}\n```\n\n```\n[Time]\nNTP=time.nist.gov # Uses the generic name for NIST's time servers\nFallbackNTP=time-a-g.nist.gov time-b-g.nist.gov time-c-g.nist.gov # Space separated list of NIST time servers\n```"},{"id":"cisb-ubnt24.04lts-002.003.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.002.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#68dc16c1-5e67-4020-bbc8-f56ccd879161"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-7, AU-8"}]}],"props":[{"name":"label","value":"2.3.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.2.1_Ensure_systemd-timesyncd_configured_with_authorized_timeserver"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure systemd-timesyncd configured with authorized timeserver"},{"id":"cisb-ubnt24.04lts-002.003.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"systemd\\-timesyncd is a daemon that has been added for synchronizing the system clock across the network"},{"id":"cisb-ubnt24.04lts-002.003.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"systemd\\-timesyncd needs to be enabled and running in order to synchronize the system to a timeserver.\n\nTime synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations"},{"id":"cisb-ubnt24.04lts-002.003.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `systemd-timesyncd` is in use on the system, run the following commands: \n\nRun the following command to unmask `systemd-timesyncd.service`: \n\nRun the following command to enable and start `systemd-timesyncd.service`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to stop and mask `systemd-timesyncd`:\n\n```\n# systemctl --now mask systemd-timesyncd.service\n```\n\n```\n# systemctl --now enable systemd-timesyncd.service\n```\n\n```\n# systemctl unmask systemd-timesyncd.service\n```"},{"id":"cisb-ubnt24.04lts-002.003.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `systemd-timesyncd` is in use on the system, run the following commands: \n\nRun the following command to unmask `systemd-timesyncd.service`: \n\nRun the following command to enable and start `systemd-timesyncd.service`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to stop and mask `systemd-timesyncd`:\n\n```\n# systemctl --now mask systemd-timesyncd.service\n```\n\n```\n# systemctl --now enable systemd-timesyncd.service\n```\n\n```\n# systemctl unmask systemd-timesyncd.service\n```"},{"id":"cisb-ubnt24.04lts-002.003.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-7, AU-8"}]}],"props":[{"name":"label","value":"2.3.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.2.2_Ensure_systemd-timesyncd_is_enabled_and_running"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure systemd-timesyncd is enabled and running"}]},{"id":"cisb-ubnt24.04lts-002.003.003_grp","parts":[{"id":"cisb-ubnt24.04lts-002.003.003_ovrvw","name":"overview","prose":"`chrony` is a daemon which implements the Network Time Protocol (NTP) and is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate.\n\n`chrony` can be configured to be a client and/or a server.\n\nMore information on `chrony` can be found at: http://chrony.tuxfamily.org/.\n\n**Note:**\n\n- If `systemd-timesyncd` is being used, `chrony` should be removed and this section skipped\n- Only one time synchronization method should be in use on the system"}],"props":[{"name":"label","value":"2.3.3"}],"title":"Configure chrony","controls":[{"id":"cisb-ubnt24.04lts-002.003.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"- server\n - The server directive specifies an NTP server which can be used as a time source. The client\\-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client.\n - This directive can be used multiple times to specify multiple servers.\n - The directive is immediately followed by either the name of the server, or its IP address.\n - The server directive specifies an NTP server which can be used as a time source. The client\\-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client.\n - This directive can be used multiple times to specify multiple servers.\n - The directive is immediately followed by either the name of the server, or its IP address.\n- pool\n - The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.\n - This directive can be used multiple times to specify multiple pools.\n - All options valid in the server directive can be used in this directive too.\n - The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.\n - This directive can be used multiple times to specify multiple pools.\n - All options valid in the server directive can be used in this directive too."},{"id":"cisb-ubnt24.04lts-002.003.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations"},{"id":"cisb-ubnt24.04lts-002.003.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/chrony/chrony.conf` or a file ending in `.sources` in `/etc/chrony/sources.d/` and add or edit server or pool lines as appropriate according to local site policy: \n\nEdit the `Chrony` configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy \n\n*Example script to add a drop\\-in configuration for the `pool` directive:* \n\n*Example script to add a drop\\-in configuration for the `server` directive:* \n\nRun the following command to reload the `chronyd` config:\n\n```\n# systemctl reload-or-restart chronyd\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"server time-a-g.nist.gov iburst\" \"server 132.163.97.3 iburst\" \\\n \"server time-d-b.nist.gov iburst\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"#The maxsources option is unique to the pool directive\" \\\n \"pool time.nist.gov iburst maxsources 4\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\n```\n<[server|pool]> <[remote-server|remote-pool]>\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/chrony/chrony.conf` or a file ending in `.sources` in `/etc/chrony/sources.d/` and add or edit server or pool lines as appropriate according to local site policy: \n\nEdit the `Chrony` configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy \n\n*Example script to add a drop\\-in configuration for the `pool` directive:* \n\n*Example script to add a drop\\-in configuration for the `server` directive:* \n\nRun the following command to reload the `chronyd` config:\n\n```\n# systemctl reload-or-restart chronyd\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"server time-a-g.nist.gov iburst\" \"server 132.163.97.3 iburst\" \\\n \"server time-d-b.nist.gov iburst\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/chrony/sources.d/\" ] && mkdir /etc/chrony/sources.d/\n printf '%s\\n' \"\" \"#The maxsources option is unique to the pool directive\" \\\n \"pool time.nist.gov iburst maxsources 4\" >> /etc/chrony/sources.d/60-sources.sources\n chronyc reload sources &>/dev/null\n}\n```\n\n```\n<[server|pool]> <[remote-server|remote-pool]>\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.003.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#68dc16c1-5e67-4020-bbc8-f56ccd879161"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-12"},{"name":"marking","class":"Reference","value":"chrony.conf(5) Manual Page"}]}],"props":[{"name":"label","value":"2.3.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.3.1_Ensure_chrony_is_configured_with_authorized_timeserver"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure chrony is configured with authorized timeserver"},{"id":"cisb-ubnt24.04lts-002.003.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `chrony` package is installed with a dedicated user account `_chrony`. This account is granted the access required by the `chronyd` service"},{"id":"cisb-ubnt24.04lts-002.003.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `chronyd` service should run with only the required privlidges"},{"id":"cisb-ubnt24.04lts-002.003.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Add or edit the `user` line to `/etc/chrony/chrony.conf` or a file ending in `.conf` in `/etc/chrony/conf.d/`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony` from the system:\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\nuser _chrony\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Add or edit the `user` line to `/etc/chrony/chrony.conf` or a file ending in `.conf` in `/etc/chrony/conf.d/`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony` from the system:\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\nuser _chrony\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-8"}]}],"props":[{"name":"label","value":"2.3.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.3.2_Ensure_chrony_is_running_as_user__chrony"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure chrony is running as user _chrony"},{"id":"cisb-ubnt24.04lts-002.003.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.003.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.003.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"chrony is a daemon for synchronizing the system clock across the network"},{"id":"cisb-ubnt24.04lts-002.003.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"chrony needs to be enabled and running in order to synchronize the system to a timeserver.\n\nTime synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations"},{"id":"cisb-ubnt24.04lts-002.003.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `chrony` is in use on the system, run the following commands: \n\nRun the following command to unmask `chrony.service`: \n\nRun the following command to enable and start `chrony.service`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony`:\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\n# systemctl --now enable chrony.service\n```\n\n```\n# systemctl unmask chrony.service\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `chrony` is in use on the system, run the following commands: \n\nRun the following command to unmask `chrony.service`: \n\nRun the following command to enable and start `chrony.service`: \n\n**\\- OR \\-** \n\nIf another time synchronization service is in use on the system, run the following command to remove `chrony`:\n\n```\n# apt purge chrony\n# apt autoremove chrony\n```\n\n```\n# systemctl --now enable chrony.service\n```\n\n```\n# systemctl unmask chrony.service\n```"},{"id":"cisb-ubnt24.04lts-002.003.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#466cc196-941d-4751-8497-ab9b445b0e24"},{"rel":"reference","href":"#c5bcd779-c481-49ed-9370-f7c3f0a29209"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.003.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-8"}]}],"props":[{"name":"label","value":"2.3.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.3.3.3_Ensure_chrony_is_enabled_and_running"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure chrony is enabled and running"}]}]},{"id":"cisb-ubnt24.04lts-002.004_grp","parts":[{"id":"cisb-ubnt24.04lts-002.004_ovrvw","name":"overview","prose":"A job scheduler is used to execute jobs, commands, or shell scripts, at fixed times, dates, or intervals"}],"props":[{"name":"label","value":"2.4"}],"title":"Job Schedulers","groups":[{"id":"cisb-ubnt24.04lts-002.004.001_grp","parts":[{"id":"cisb-ubnt24.04lts-002.004.001_ovrvw","name":"overview","prose":"`cron` is a time based job scheduler\n\n**\\- IF \\-** `cron` is not installed on the system, this sub section can be skipped\n\n**Note:** Other methods such as `systemd timers` exist for scheduling jobs. If another method is used `cron` should may be removed. The alternate method should be secured in accordance with local site policy"}],"props":[{"name":"label","value":"2.4.1"}],"title":"Configure cron","controls":[{"id":"cisb-ubnt24.04lts-002.004.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `cron` daemon is used to execute batch jobs on the system."},{"id":"cisb-ubnt24.04lts-002.004.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"While there may not be user jobs that need to be run on the system, the system does have maintenance jobs that may include security monitoring that have to run, and `cron` is used to execute them."},{"id":"cisb-ubnt24.04lts-002.004.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to unmask, enable, and start `cron`:\n\n```\n# systemctl unmask \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n# systemctl --now enable \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to unmask, enable, and start `cron`:\n\n```\n# systemctl unmask \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n# systemctl --now enable \"$(systemctl list-unit-files | awk '$1~/^crond?\\.service/{print $1}')\"\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"2.4.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.1_Ensure_cron_daemon_is_enabled_and_active"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure cron daemon is enabled and active"},{"id":"cisb-ubnt24.04lts-002.004.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/crontab` file is used by `cron` to control its own jobs. The commands in this item make sure that root is the user and group owner of the file and that only the owner can access the file."},{"id":"cisb-ubnt24.04lts-002.004.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"This file contains information on what system jobs are run by cron. Write access to these files could provide unprivileged users with the ability to elevate their privileges. Read access to these files could provide users with the ability to gain insight on system jobs that run on the system and could provide them a way to gain unauthorized privileged access."},{"id":"cisb-ubnt24.04lts-002.004.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on `/etc/crontab`:\n\n```\n# chown root:root /etc/crontab\n# chmod og-rwx /etc/crontab\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on `/etc/crontab`:\n\n```\n# chown root:root /etc/crontab\n# chmod og-rwx /etc/crontab\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"2.4.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.2_Ensure_permissions_on_etccrontab_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/crontab are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"This directory contains system `cron` jobs that need to run on an hourly basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"id":"cisb-ubnt24.04lts-002.004.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Granting write access to this directory for non\\-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."},{"id":"cisb-ubnt24.04lts-002.004.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.hourly` directory:\n\n```\n# chown root:root /etc/cron.hourly/\n# chmod og-rwx /etc/cron.hourly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.hourly` directory:\n\n```\n# chown root:root /etc/cron.hourly/\n# chmod og-rwx /etc/cron.hourly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.3_Ensure_permissions_on_etccron.hourly_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/cron.hourly are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/cron.daily` directory contains system cron jobs that need to run on a daily basis. The files in this directory cannot be manipulated by the `crontab` command, but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"id":"cisb-ubnt24.04lts-002.004.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Granting write access to this directory for non\\-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."},{"id":"cisb-ubnt24.04lts-002.004.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.daily` directory:\n\n```\n# chown root:root /etc/cron.daily/\n# chmod og-rwx /etc/cron.daily/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.daily` directory:\n\n```\n# chown root:root /etc/cron.daily/\n# chmod og-rwx /etc/cron.daily/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.4_Ensure_permissions_on_etccron.daily_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/cron.daily are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/cron.weekly` directory contains system cron jobs that need to run on a weekly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"id":"cisb-ubnt24.04lts-002.004.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Granting write access to this directory for non\\-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."},{"id":"cisb-ubnt24.04lts-002.004.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.weekly` directory:\n\n```\n# chown root:root /etc/cron.weekly/\n# chmod og-rwx /etc/cron.weekly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.weekly` directory:\n\n```\n# chown root:root /etc/cron.weekly/\n# chmod og-rwx /etc/cron.weekly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.5_Ensure_permissions_on_etccron.weekly_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/cron.weekly are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/cron.monthly` directory contains system cron jobs that need to run on a monthly basis. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"id":"cisb-ubnt24.04lts-002.004.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Granting write access to this directory for non\\-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."},{"id":"cisb-ubnt24.04lts-002.004.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.monthly` directory:\n\n```\n# chown root:root /etc/cron.monthly/\n# chmod og-rwx /etc/cron.monthly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.monthly` directory:\n\n```\n# chown root:root /etc/cron.monthly/\n# chmod og-rwx /etc/cron.monthly/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.6_Ensure_permissions_on_etccron.monthly_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/cron.monthly are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/cron.d` directory contains system `cron` jobs that need to run in a similar manner to the hourly, daily weekly and monthly jobs from `/etc/crontab`, but require more granular control as to when they run. The files in this directory cannot be manipulated by the `crontab` command but are instead edited by system administrators using a text editor. The commands below restrict read/write and search access to user and group root, preventing regular users from accessing this directory."},{"id":"cisb-ubnt24.04lts-002.004.001.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Granting write access to this directory for non\\-privileged users could provide them the means for gaining unauthorized elevated privileges. Granting read access to this directory could give an unprivileged user insight in how to gain elevated privileges or circumvent auditing controls."},{"id":"cisb-ubnt24.04lts-002.004.001.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.d` directory:\n\n```\n# chown root:root /etc/cron.d/\n# chmod og-rwx /etc/cron.d/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following commands to set ownership and permissions on the `/etc/cron.d` directory:\n\n```\n# chown root:root /etc/cron.d/\n# chmod og-rwx /etc/cron.d/\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.7_Ensure_permissions_on_etccron.d_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/cron.d are configured"},{"id":"cisb-ubnt24.04lts-002.004.001.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.001.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.001.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`crontab` is the program used to install, deinstall, or list the tables used to drive the cron daemon. Each user can have their own crontab, and though these are files in `/var/spool/cron/crontabs`, they are not intended to be edited directly.\n\nIf the `/etc/cron.allow` file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the `/etc/cron.allow` file does not exist but the `/etc/cron.deny` file does exist, then you must not be listed in the `/etc/cron.deny` file in order to use this command.\n\nIf neither of these files exists, then depending on site\\-dependent configuration parameters, only the super user will be allowed to use this command, or all users will be able to use this command.\n\nIf both files exist then `/etc/cron.allow` takes precedence. Which means that `/etc/cron.deny` is not considered and your user must be listed in `/etc/cron.allow` in order to be able to use the crontab.\n\nRegardless of the existence of any of these files, the root administrative user is always allowed to setup a crontab.\n\nThe files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, must be either world\\-readable, or readable by group `crontab`. If they are not, then cron will deny access to all users until the permissions are fixed.\n\nThere is one file for each user's crontab under the `/var/spool/cron/crontabs` directory. Users are not allowed to edit the files under that directory directly to ensure that only users allowed by the system to run periodic tasks can add them, and only syntactically correct crontabs will be written there. This is enforced by having the directory writable only by the `crontab` group and configuring crontab command with the setgid bid set for that specific group.\n\n**Note:**\n\n- Even though a given user is not listed in `cron.allow`, cron jobs can still be run as that user\n- The files `/etc/cron.allow` and `/etc/cron.deny`, if they exist, only controls administrative access to the crontab command for scheduling and modifying cron jobs"},{"id":"cisb-ubnt24.04lts-002.004.001.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"On many systems, only the system administrator is authorized to schedule `cron` jobs. Using the `cron.allow` file to control who can run `cron` jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files."},{"id":"cisb-ubnt24.04lts-002.004.001.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following script to: \n\n- Create `/etc/cron.allow` if it doesn't exist\n- Change owner to user `root`\n- Change group owner to group `root` **\\- OR \\-** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n**\\- IF \\-** `/etc/cron.deny` exists, run the following script to: \n\n- Change owner to user `root`\n- Change group owner to group `root` **\\- OR \\-** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n**Note:** On systems where cron is configured to use the group `crontab`, if the group `crontab` is not set as the owner of `cron.allow`, then cron will deny access to all users and you will see an error similar to:\n\n```\nYou () are not allowed to use this program (crontab)\nSee crontab(1) for more information\n```\n\n```\n#!/usr/bin/env bash\n\n{\n if [ -e \"/etc/cron.deny\" ]; then\n chmod u-x,g-wx,o-rwx /etc/cron.deny\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.deny\n else\n chown root:root /etc/cron.deny\n fi\n fi\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -e \"/etc/cron.deny\" ] && touch /etc/cron.allow\n chmod u-x,g-wx,o-rwx /etc/cron.allow\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.allow\n else\n chown root:root /etc/cron.allow\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** cron is installed on the system: \n\nRun the following script to: \n\n- Create `/etc/cron.allow` if it doesn't exist\n- Change owner to user `root`\n- Change group owner to group `root` **\\- OR \\-** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n**\\- IF \\-** `/etc/cron.deny` exists, run the following script to: \n\n- Change owner to user `root`\n- Change group owner to group `root` **\\- OR \\-** group `crontab` if it exists\n- Change mode to `640` or more restrictive\n\n**Note:** On systems where cron is configured to use the group `crontab`, if the group `crontab` is not set as the owner of `cron.allow`, then cron will deny access to all users and you will see an error similar to:\n\n```\nYou () are not allowed to use this program (crontab)\nSee crontab(1) for more information\n```\n\n```\n#!/usr/bin/env bash\n\n{\n if [ -e \"/etc/cron.deny\" ]; then\n chmod u-x,g-wx,o-rwx /etc/cron.deny\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.deny\n else\n chown root:root /etc/cron.deny\n fi\n fi\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -e \"/etc/cron.deny\" ] && touch /etc/cron.allow\n chmod u-x,g-wx,o-rwx /etc/cron.allow\n if grep -Pq -- '^\\h*crontab\\:' /etc/group; then\n chown root:crontab /etc/cron.allow\n else\n chown root:root /etc/cron.allow\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-002.004.001.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.001.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.1.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.1.8_Ensure_crontab_is_restricted_to_authorized_users"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure crontab is restricted to authorized users"}]},{"id":"cisb-ubnt24.04lts-002.004.002_grp","parts":[{"id":"cisb-ubnt24.04lts-002.004.002_ovrvw","name":"overview","prose":"`at` is a command\\-line utility used to schedule a job for later execution\n\n**Note:** if `at` is not installed on the system, this section can be skipped"}],"props":[{"name":"label","value":"2.4.2"}],"title":"Configure at","controls":[{"id":"cisb-ubnt24.04lts-002.004.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-002.004.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-002.004.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`at` allows fairly complex time specifications, extending the POSIX.2 standard. It accepts times of the form HH:MM to run a job at a specific time of day. (If that time is already past, the next day is assumed.) You may also specify midnight, noon, or teatime (4pm) and you can have a time\\-of\\-day suffixed with AM or PM for running in the morning or the evening. You can also say what day the job will be run, by giving a date in the form month\\-name day with an optional year, or giving a date of the form MMDD\\[CC]YY, MM/DD/\\[CC]YY, DD.MM.\\[CC]YY or \\[CC]YY\\-MM\\-DD. The specification of a date must follow the specification of the time of day. You can also give times like now \\+ count time\\-units, where the time\\-units can be minutes, hours, days, or weeks and you can tell at to run the job today by suffixing the time with today and to run the job tomorrow by suffixing the time with tomorrow.\n\nThe `/etc/at.allow` and `/etc/at.deny` files determine which user can submit commands for later execution via at or batch. The format of the files is a list of usernames, one on each line. Whitespace is not permitted. If the file `/etc/at.allow` exists, only usernames mentioned in it are allowed to use at. If `/etc/at.allow` does not exist, `/etc/at.deny` is checked, every username not mentioned in it is then allowed to use at. An empty `/etc/at.deny` means that every user may use at. If neither file exists, only the superuser is allowed to use at."},{"id":"cisb-ubnt24.04lts-002.004.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"On many systems, only the system administrator is authorized to schedule `at` jobs. Using the `at.allow` file to control who can run `at` jobs enforces this policy. It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user ID to the system and forget to add it to the deny files."},{"id":"cisb-ubnt24.04lts-002.004.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** at is installed on the system: \n\nRun the following script to: \n\n- `/etc/at.allow`:\n - Create the file if it doesn't exist\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n - Create the file if it doesn't exist\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n- **\\- IF \\-** `/etc/at.deny` exists:\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n\n```\n#!/usr/bin/env bash\n\n{\n grep -Pq -- '^daemon\\b' /etc/group && l_group=\"daemon\" || l_group=\"root\"\n [ ! -e \"/etc/at.allow\" ] && touch /etc/at.allow\n chown root:\"$l_group\" /etc/at.allow\n chmod u-x,g-wx,o-rwx /etc/at.allow\n [ -e \"/etc/at.deny\" ] && chown root:\"$l_group\" /etc/at.deny\n [ -e \"/etc/at.deny\" ] && chmod u-x,g-wx,o-rwx /etc/at.deny\n}\n```"},{"id":"cisb-ubnt24.04lts-002.004.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** at is installed on the system: \n\nRun the following script to: \n\n- `/etc/at.allow`:\n - Create the file if it doesn't exist\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n - Create the file if it doesn't exist\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n- **\\- IF \\-** `/etc/at.deny` exists:\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n - Change owner or user `root`\n - If group `daemon` exists, change to group `daemon`, else change group to `root`\n - Change mode to `640` or more restrictive\n\n```\n#!/usr/bin/env bash\n\n{\n grep -Pq -- '^daemon\\b' /etc/group && l_group=\"daemon\" || l_group=\"root\"\n [ ! -e \"/etc/at.allow\" ] && touch /etc/at.allow\n chown root:\"$l_group\" /etc/at.allow\n chmod u-x,g-wx,o-rwx /etc/at.allow\n [ -e \"/etc/at.deny\" ] && chown root:\"$l_group\" /etc/at.deny\n [ -e \"/etc/at.deny\" ] && chmod u-x,g-wx,o-rwx /etc/at.deny\n}\n```"},{"id":"cisb-ubnt24.04lts-002.004.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-002.004.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"2.4.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_2.4.2.1_Ensure_at_is_restricted_to_authorized_users"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure at is restricted to authorized users"}]}]}]},{"id":"cisb-ubnt24.04lts-003_grp","parts":[{"id":"cisb-ubnt24.04lts-003_ovrvw","name":"overview","prose":"This section provides guidance on for securing the network configuration of the system"}],"props":[{"name":"label","value":"3"}],"title":"Network","groups":[{"id":"cisb-ubnt24.04lts-003.001_grp","parts":[{"id":"cisb-ubnt24.04lts-003.001_ovrvw","name":"overview","prose":"To reduce the attack surface of a system, unused devices should be disabled.\n\n**Note:** This should not be considered a comprehensive list, you may wish to consider additions to those listed here for your environment."}],"props":[{"name":"label","value":"3.1"}],"title":"Configure Network Devices","controls":[{"id":"cisb-ubnt24.04lts-003.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Internet Protocol Version 6 (IPv6) is the most recent version of Internet Protocol (IP). It's designed to supply IP addressing and additional security to support the predicted growth of connected devices. IPv6 is based on 128\\-bit addressing and can support 340 undecillion, which is 340,282,366,920,938,463,463,374,607,431,768,211,456 unique addresses.\n\nFeatures of IPv6\n\n- Hierarchical addressing and routing infrastructure\n- Statefull and Stateless configuration\n- Support for quality of service (QoS)\n- An ideal protocol for neighboring node interaction"},{"id":"cisb-ubnt24.04lts-003.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"IETF RFC 4038 recommends that applications are built with an assumption of dual stack. It is recommended that IPv6 be enabled and configured in accordance with Benchmark recommendations.\n\n**\\- IF \\-** dual stack and IPv6 are not used in your environment, IPv6 may be disabled to reduce the attack surface of the system, and recommendations pertaining to IPv6 can be skipped.\n\n**Note:** It is recommended that IPv6 be enabled and configured unless this is against local site policy"},{"id":"cisb-ubnt24.04lts-003.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Enable or disable IPv6 in accordance with system requirements and local site policy \n\nImpact: \n\nIETF RFC 4038 recommends that applications are built with an assumption of dual stack. \n\nWhen enabled, IPv6 will require additional configuration to reduce risk to the system."},{"id":"cisb-ubnt24.04lts-003.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Enable or disable IPv6 in accordance with system requirements and local site policy \n\nImpact: \n\nIETF RFC 4038 recommends that applications are built with an assumption of dual stack. \n\nWhen enabled, IPv6 will require additional configuration to reduce risk to the system."},{"id":"cisb-ubnt24.04lts-003.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"3.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.1.1_Ensure_IPv6_status_is_identified"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure IPv6 status is identified"},{"id":"cisb-ubnt24.04lts-003.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"}],"parts":[{"id":"cisb-ubnt24.04lts-003.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Wireless networking is used when wired networks are unavailable."},{"id":"cisb-ubnt24.04lts-003.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\-IF\\-** wireless is not to be used, wireless devices can be disabled to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-003.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to disable any wireless interfaces: \n\nImpact: \n\nMany if not all laptop workstations and some desktop workstations will connect via wireless requiring these interfaces be enabled.\n\n```\n#!/usr/bin/env bash\n\n{\n module_fix()\n {\n if ! modprobe -n -v \"$l_mname\" | grep -P -- '^\\h*install \\/bin\\/(true|false)'; then\n echo -e \" - setting module: \\\"$l_mname\\\" to be un-loadable\"\n echo -e \"install $l_mname /bin/false\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n if lsmod | grep \"$l_mname\" > /dev/null 2>&1; then\n echo -e \" - unloading module \\\"$l_mname\\\"\"\n modprobe -r \"$l_mname\"\n fi\n if ! grep -Pq -- \"^\\h*blacklist\\h+$l_mname\\b\" /etc/modprobe.d/*; then\n echo -e \" - deny listing \\\"$l_mname\\\"\"\n echo -e \"blacklist $l_mname\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n }\n if [ -n \"$(find /sys/class/net/*/ -type d -name wireless)\" ]; then\n l_dname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename \"$(readlink -f \"$driverdir\"/device/driver/module)\";done | sort -u)\n for l_mname in $l_dname; do\n module_fix\n done\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-003.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to disable any wireless interfaces: \n\nImpact: \n\nMany if not all laptop workstations and some desktop workstations will connect via wireless requiring these interfaces be enabled.\n\n```\n#!/usr/bin/env bash\n\n{\n module_fix()\n {\n if ! modprobe -n -v \"$l_mname\" | grep -P -- '^\\h*install \\/bin\\/(true|false)'; then\n echo -e \" - setting module: \\\"$l_mname\\\" to be un-loadable\"\n echo -e \"install $l_mname /bin/false\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n if lsmod | grep \"$l_mname\" > /dev/null 2>&1; then\n echo -e \" - unloading module \\\"$l_mname\\\"\"\n modprobe -r \"$l_mname\"\n fi\n if ! grep -Pq -- \"^\\h*blacklist\\h+$l_mname\\b\" /etc/modprobe.d/*; then\n echo -e \" - deny listing \\\"$l_mname\\\"\"\n echo -e \"blacklist $l_mname\" >> /etc/modprobe.d/\"$l_mname\".conf\n fi\n }\n if [ -n \"$(find /sys/class/net/*/ -type d -name wireless)\" ]; then\n l_dname=$(for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname); do basename \"$(readlink -f \"$driverdir\"/device/driver/module)\";done | sort -u)\n for l_mname in $l_dname; do\n module_fix\n done\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-003.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#03383be5-1d48-42ff-a72b-fc82ded82c5b"},{"rel":"reference","href":"#fe15df43-434e-4fa4-8fca-86196232e192"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"3.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.1.2_Ensure_wireless_interfaces_are_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure wireless interfaces are disabled"},{"id":"cisb-ubnt24.04lts-003.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Bluetooth is a short\\-range wireless technology standard that is used for exchanging data between devices over short distances. It employs UHF radio waves in the ISM bands, from 2.402 GHz to 2.48 GHz. It is mainly used as an alternative to wire connections."},{"id":"cisb-ubnt24.04lts-003.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"An attacker may be able to find a way to access or corrupt your data. One example of this type of activity is `bluesnarfing`, which refers to attackers using a Bluetooth connection to steal information off of your Bluetooth device. Also, viruses or other malicious code can take advantage of Bluetooth technology to infect other devices. If you are infected, your data may be corrupted, compromised, stolen, or lost."},{"id":"cisb-ubnt24.04lts-003.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop `bluetooth.service`, and remove the `bluez` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `bluez` package is required as a dependency: \n\nRun the following commands to stop and mask `bluetooth.service`: \n\n**Note:** A reboot may be required \n\nImpact: \n\nMany personal electronic devices (PEDs) use Bluetooth technology. For example, you may be able to operate your computer with a wireless keyboard. Disabling Bluetooth will prevent these devices from connecting to the system. \n\nThere may be packages that are dependent on the `bluez` package. If the `bluez` package is removed, these dependent packages will be removed as well. Before removing the `bluez` package, review any dependent packages to determine if they are required on the system. \n\n**\\-IF\\-** a dependent package is required: stop and mask `bluetooth.service` leaving the `bluez` package installed.\n\n```\n# systemctl stop bluetooth.service\n# systemctl mask bluetooth.service\n```\n\n```\n# systemctl stop bluetooth.service\n# apt purge bluez\n```"},{"id":"cisb-ubnt24.04lts-003.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop `bluetooth.service`, and remove the `bluez` package: \n\n**\\- OR \\-** \n\n**\\- IF \\-** the `bluez` package is required as a dependency: \n\nRun the following commands to stop and mask `bluetooth.service`: \n\n**Note:** A reboot may be required \n\nImpact: \n\nMany personal electronic devices (PEDs) use Bluetooth technology. For example, you may be able to operate your computer with a wireless keyboard. Disabling Bluetooth will prevent these devices from connecting to the system. \n\nThere may be packages that are dependent on the `bluez` package. If the `bluez` package is removed, these dependent packages will be removed as well. Before removing the `bluez` package, review any dependent packages to determine if they are required on the system. \n\n**\\-IF\\-** a dependent package is required: stop and mask `bluetooth.service` leaving the `bluez` package installed.\n\n```\n# systemctl stop bluetooth.service\n# systemctl mask bluetooth.service\n```\n\n```\n# systemctl stop bluetooth.service\n# apt purge bluez\n```"},{"id":"cisb-ubnt24.04lts-003.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.001.003_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#e1607c58-78f4-451b-a2b0-fe279bc21b04"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"}]}],"props":[{"name":"label","value":"3.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.1.3_Ensure_bluetooth_services_are_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure bluetooth services are not in use"}]},{"id":"cisb-ubnt24.04lts-003.002_grp","parts":[{"id":"cisb-ubnt24.04lts-003.002_ovrvw","name":"overview","prose":"The Linux kernel modules support several network protocols that are not commonly used. If these protocols are not needed, it is recommended that they be disabled in the kernel.\n\n**Note:** This should not be considered a comprehensive list of uncommon network protocols, you may wish to consider additions to those listed here for your environment."}],"props":[{"name":"label","value":"3.2"}],"title":"Configure Network Kernel Modules","controls":[{"id":"cisb-ubnt24.04lts-003.002.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in\\-sequence delivery."},{"id":"cisb-ubnt24.04lts-003.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-003.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `dccp` module: \n\n**\\- IF \\-** the `dccp` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install dccp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist dccp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r dccp 2>/dev/null; rmmod dccp 2>/dev/null` to remove `dccp` from the kernel\n\n**\\- IF \\-** the `dccp` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"dccp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `dccp` module: \n\n**\\- IF \\-** the `dccp` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install dccp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist dccp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r dccp 2>/dev/null; rmmod dccp 2>/dev/null` to remove `dccp` from the kernel\n\n**\\- IF \\-** the `dccp` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"dccp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4, CM-7"}]}],"props":[{"name":"label","value":"3.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.2.1_Ensure_dccp_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure dccp kernel module is not available"},{"id":"cisb-ubnt24.04lts-003.002.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Transparent Inter\\-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes."},{"id":"cisb-ubnt24.04lts-003.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-003.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `tipc` module: \n\n**\\- IF \\-** the `tipc` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install tipc /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist tipc` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r tipc 2>/dev/null; rmmod tipc 2>/dev/null` to remove `tipc` from the kernel\n\n**\\- IF \\-** the `tipc` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"tipc\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `tipc` module: \n\n**\\- IF \\-** the `tipc` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install tipc /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist tipc` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r tipc 2>/dev/null; rmmod tipc 2>/dev/null` to remove `tipc` from the kernel\n\n**\\- IF \\-** the `tipc` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"tipc\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4, CM-7"}]}],"props":[{"name":"label","value":"3.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.2.2_Ensure_tipc_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure tipc kernel module is not available"},{"id":"cisb-ubnt24.04lts-003.002.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low\\-latency, high\\-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation."},{"id":"cisb-ubnt24.04lts-003.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-003.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `rds` module: \n\n**\\- IF \\-** the `rds` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install rds /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist rds` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r rds 2>/dev/null; rmmod rds 2>/dev/null` to remove `rds` from the kernel\n\n**\\- IF \\-** the `rds` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"rds\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `rds` module: \n\n**\\- IF \\-** the `rds` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install rds /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist rds` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r rds 2>/dev/null; rmmod rds 2>/dev/null` to remove `rds` from the kernel\n\n**\\- IF \\-** the `rds` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"rds\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4, CM-7"}]}],"props":[{"name":"label","value":"3.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.2.3_Ensure_rds_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rds kernel module is not available"},{"id":"cisb-ubnt24.04lts-003.002.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Stream Control Transmission Protocol (SCTP) is a transport layer protocol used to support message oriented communication, with several streams of messages in one connection. It serves a similar function as TCP and UDP, incorporating features of both. It is message\\-oriented like UDP, and ensures reliable in\\-sequence transport of messages with congestion control like TCP."},{"id":"cisb-ubnt24.04lts-003.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** the protocol is not being used, it is recommended that kernel module not be loaded, disabling the service to reduce the potential attack surface."},{"id":"cisb-ubnt24.04lts-003.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to unload and disable the `sctp` module: \n\n**\\- IF \\-** the `sctp` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install sctp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist sctp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r sctp 2>/dev/null; rmmod sctp 2>/dev/null` to remove `sctp` from the kernel\n\n**\\- IF \\-** the `sctp` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"sctp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to unload and disable the `sctp` module: \n\n**\\- IF \\-** the `sctp` kernel module is available in ANY installed kernel: \n\n- Create a file ending in `.conf` with `install sctp /bin/false` in the `/etc/modprobe.d/` directory\n- Create a file ending in `.conf` with `blacklist sctp` in the `/etc/modprobe.d/` directory\n- Run `modprobe -r sctp 2>/dev/null; rmmod sctp 2>/dev/null` to remove `sctp` from the kernel\n\n**\\- IF \\-** the `sctp` kernel module is not available on the system, or pre\\-compiled into the kernel, no remediation is necessary\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=() a_output3=() l_dl=\"\" l_mod_name=\"sctp\" l_mod_type=\"net\"\n l_mod_path=\"$(readlink -f /lib/modules/**/kernel/$l_mod_type | sort -u)\"\n f_module_fix()\n {\n l_dl=\"y\" a_showconfig=()\n while IFS= read -r l_showconfig; do\n a_showconfig+=(\"$l_showconfig\")\n done < <(modprobe --showconfig | grep -P -- '\\b(install|blacklist)\\h+'\"${l_mod_chk_name//-/_}\"'\\b')\n if lsmod | grep \"$l_mod_chk_name\" &> /dev/null; then\n a_output2+=(\" - unloading kernel module: \\\"$l_mod_name\\\"\")\n modprobe -r \"$l_mod_chk_name\" 2>/dev/null; rmmod \"$l_mod_name\" 2>/dev/null\n fi\n if ! grep -Pq -- '\\binstall\\h+'\"${l_mod_chk_name//-/_}\"'\\h+(\\/usr)?\\/bin\\/(true|false)\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - setting kernel module: \\\"$l_mod_name\\\" to \\\"$(readlink -f /bin/false)\\\"\")\n printf '%s\\n' \"install $l_mod_chk_name $(readlink -f /bin/false)\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n if ! grep -Pq -- '\\bblacklist\\h+'\"${l_mod_chk_name//-/_}\"'\\b' <<< \"${a_showconfig[*]}\"; then\n a_output2+=(\" - denylisting kernel module: \\\"$l_mod_name\\\"\")\n printf '%s\\n' \"blacklist $l_mod_chk_name\" >> /etc/modprobe.d/\"$l_mod_name\".conf\n fi\n }\n for l_mod_base_directory in $l_mod_path; do # Check if the module exists on the system\n if [ -d \"$l_mod_base_directory/${l_mod_name/-/\\/}\" ] && [ -n \"$(ls -A \"$l_mod_base_directory/${l_mod_name/-/\\/}\")\" ]; then\n a_output3+=(\" - \\\"$l_mod_base_directory\\\"\")\n l_mod_chk_name=\"$l_mod_name\"\n [[ \"$l_mod_name\" =~ overlay ]] && l_mod_chk_name=\"${l_mod_name::-2}\"\n [ \"$l_dl\" != \"y\" ] && f_module_fix\n else\n printf '%s\\n' \" - kernel module: \\\"$l_mod_name\\\" doesn't exist in \\\"$l_mod_base_directory\\\"\"\n fi\n done\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" -- INFO --\" \" - module: \\\"$l_mod_name\\\" exists in:\" \"${a_output3[@]}\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\" || printf '%s\\n' \"\" \" - No changes needed\"\n printf '%s\\n' \"\" \" - remediation of kernel module: \\\"$l_mod_name\\\" complete\" \"\"\n}\n```"},{"id":"cisb-ubnt24.04lts-003.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SI-4, CM-7"}]}],"props":[{"name":"label","value":"3.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.2.4_Ensure_sctp_kernel_module_is_not_available"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sctp kernel module is not available"}]},{"id":"cisb-ubnt24.04lts-003.003_grp","parts":[{"id":"cisb-ubnt24.04lts-003.003_ovrvw","name":"overview","prose":"The following network parameters are intended for use on both host only and router systems. A system acts as a router if it has at least two interfaces and is configured to perform routing functions.\n\n**Note:**\n\n- sysctl settings are defined through files in `/usr/local/lib`, `/usr/lib/`, `/lib/`, `/run/`, and `/etc/`\n- Files are typically placed in the `sysctl.d` directory within the parent directory\n- The paths where sysctl preload files usually exist\n - `/run/sysctl.d/*.conf`\n - `/etc/sysctl.d/*.conf`\n - `/usr/local/lib/sysctl.d/*.conf`\n - `/usr/lib/sysctl.d/*.conf`\n - `/lib/sysctl.d/*.conf`\n - `/etc/sysctl.conf`\n - `/run/sysctl.d/*.conf`\n - `/etc/sysctl.d/*.conf`\n - `/usr/local/lib/sysctl.d/*.conf`\n - `/usr/lib/sysctl.d/*.conf`\n - `/lib/sysctl.d/*.conf`\n - `/etc/sysctl.conf`\n- Files must have the \"`.conf`\" extension\n- Vendors settings usually live in `/usr/lib/` or `/usr/local/lib/`\n- To override a whole file, create a new file with the same name in `/etc/sysctl.d/` and put new settings there.\n- To override only specific settings, add a file with a lexically later name in `/etc/sysctl.d/` and put new settings there.\n- The command `/usr/lib/systemd/systemd-sysctl --cat-config` produces output containing The system's loaded kernel parameters and the files they're configured in:\n - Entries listed latter in the file take precedence over the same settings listed earlier in the file\n - Files containing kernel parameters that are over\\-ridden by other files with the same name will not be listed\n - On systems running UncomplicatedFirewall, the kernel parameters may be set or over\\-written. This will not be visible in the output of the command\n - Entries listed latter in the file take precedence over the same settings listed earlier in the file\n - Files containing kernel parameters that are over\\-ridden by other files with the same name will not be listed\n - On systems running UncomplicatedFirewall, the kernel parameters may be set or over\\-written. This will not be visible in the output of the command\n- On systems with Uncomplicated Firewall, additional settings may be configured in `/etc/ufw/sysctl.conf`\n - The settings in `/etc/ufw/sysctl.conf` will override settings other settings and **will not** be visible in the output of the `/usr/lib/systemd/systemd-sysctl --cat-config` command\n - This behavior can be changed by updating the `IPT_SYSCTL` parameter in `/etc/default/ufw`\n - The settings in `/etc/ufw/sysctl.conf` will override settings other settings and **will not** be visible in the output of the `/usr/lib/systemd/systemd-sysctl --cat-config` command\n - This behavior can be changed by updating the `IPT_SYSCTL` parameter in `/etc/default/ufw`\n\nThe system's loaded kernel parameters and the files they're configured in can be viewed by running the following command:\n\n```\n# /usr/lib/systemd/systemd-sysctl --cat-config\n```"}],"props":[{"name":"label","value":"3.3"}],"title":"Configure Network Kernel Parameters","controls":[{"id":"cisb-ubnt24.04lts-003.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` flags are used to tell the system whether it can forward packets or not."},{"id":"cisb-ubnt24.04lts-003.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` to `0` ensures that a system with multiple interfaces (for example, a hard proxy), will never be able to forward packets, and therefore, never serve as a router."},{"id":"cisb-ubnt24.04lts-003.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.ip_forward = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.forwarding = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router. \n\nMany Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.forwarding=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.forwarding = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.ip_forward=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.ip_forward = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.ip_forward = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.forwarding = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router. \n\nMany Cloud Service Provider (CSP) hosted systems require IP forwarding to be enabled. If the system is running on a CSP platform, this requirement should be reviewed before disabling IP forwarding.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.forwarding=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.forwarding = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.ip_forward=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.ip_forward = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.1_Ensure_ip_forwarding_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ip forwarding is disabled"},{"id":"cisb-ubnt24.04lts-003.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"ICMP Redirects are used to send routing information to other hosts. As a host itself does not act as a router (in a host only configuration), there is no need to send redirects."},{"id":"cisb-ubnt24.04lts-003.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"An attacker could use a compromised host to send invalid ICMP redirects to other router devices in an attempt to corrupt routing and have users access a system set up by the attacker as opposed to a valid system."},{"id":"cisb-ubnt24.04lts-003.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.send_redirects = 0`\n- `net.ipv4.conf.default.send_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.send_redirects=0\n sysctl -w net.ipv4.conf.default.send_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.send_redirects = 0\" \"net.ipv4.conf.default.send_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.send_redirects = 0`\n- `net.ipv4.conf.default.send_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIP forwarding is required on systems configured to act as a router. If these parameters are disabled, the system will not be able to perform as a router.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.send_redirects=0\n sysctl -w net.ipv4.conf.default.send_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.send_redirects = 0\" \"net.ipv4.conf.default.send_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.2_Ensure_packet_redirect_sending_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure packet redirect sending is disabled"},{"id":"cisb-ubnt24.04lts-003.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Setting `net.ipv4.icmp_ignore_bogus_error_responses` to `1` prevents the kernel from logging bogus responses (RFC\\-1122 non\\-compliant) from broadcast reframes, keeping file systems from filling up with useless log messages."},{"id":"cisb-ubnt24.04lts-003.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Some routers (and some attackers) will send responses that violate RFC\\-1122 and attempt to fill up a log file system with many useless error messages."},{"id":"cisb-ubnt24.04lts-003.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.icmp_ignore_bogus_error_responses = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.icmp_ignore_bogus_error_responses = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.icmp_ignore_bogus_error_responses = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.icmp_ignore_bogus_error_responses = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.3_Ensure_bogus_icmp_responses_are_ignored"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure bogus icmp responses are ignored"},{"id":"cisb-ubnt24.04lts-003.003.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Setting `net.ipv4.icmp_echo_ignore_broadcasts` to `1` will cause the system to ignore all ICMP echo and timestamp requests to broadcast and multicast addresses."},{"id":"cisb-ubnt24.04lts-003.003.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Accepting ICMP echo and timestamp requests with broadcast or multicast destinations for your network could be used to trick your host into starting (or participating) in a Smurf attack. A Smurf attack relies on an attacker sending large amounts of ICMP broadcast messages with a spoofed source address. All hosts receiving this message and responding would send echo\\-reply messages back to the spoofed address, which is probably not routable. If many hosts respond to the packets, the amount of traffic on the network could be significantly multiplied."},{"id":"cisb-ubnt24.04lts-003.003.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.icmp_echo_ignore_broadcasts = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.icmp_echo_ignore_broadcasts = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.icmp_echo_ignore_broadcasts = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.icmp_echo_ignore_broadcasts = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.4_Ensure_broadcast_icmp_requests_are_ignored"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure broadcast icmp requests are ignored"},{"id":"cisb-ubnt24.04lts-003.003.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables."},{"id":"cisb-ubnt24.04lts-003.003.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"ICMP redirect messages are packets that convey routing information and tell your host (acting as a router) to send packets via an alternate path. It is a way of allowing an outside routing device to update your system routing tables. By setting `net.ipv4.conf.all.accept_redirects`, `net.ipv4.conf.default.accept_redirects`, `net.ipv6.conf.all.accept_redirects`, and `net.ipv6.conf.default.accept_redirects` to `0`, the system will not accept any ICMP redirect messages, and therefore, won't allow outsiders to update the system's routing tables."},{"id":"cisb-ubnt24.04lts-003.003.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.accept_redirects = 0`\n- `net.ipv4.conf.default.accept_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_redirects = 0`\n- `net.ipv6.conf.default.accept_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_redirects=0\n sysctl -w net.ipv6.conf.default.accept_redirects=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_redirects = 0\" \"net.ipv6.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_redirects=0\n sysctl -w net.ipv4.conf.default.accept_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.accept_redirects = 0\" \"net.ipv4.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.accept_redirects = 0`\n- `net.ipv4.conf.default.accept_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_redirects = 0`\n- `net.ipv6.conf.default.accept_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_redirects=0\n sysctl -w net.ipv6.conf.default.accept_redirects=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_redirects = 0\" \"net.ipv6.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_redirects=0\n sysctl -w net.ipv4.conf.default.accept_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.accept_redirects = 0\" \"net.ipv4.conf.default.accept_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.5_Ensure_icmp_redirects_are_not_accepted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure icmp redirects are not accepted"},{"id":"cisb-ubnt24.04lts-003.003.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Secure ICMP redirects are the same as ICMP redirects, except they come from gateways listed on the default gateway list. It is assumed that these gateways are known to your system, and that they are likely to be secure."},{"id":"cisb-ubnt24.04lts-003.003.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is still possible for even known gateways to be compromised. Setting `net.ipv4.conf.all.secure_redirects` and `net.ipv4.conf.default.secure_redirects` to `0` protects the system from routing table updates by possibly compromised known gateways."},{"id":"cisb-ubnt24.04lts-003.003.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.secure_redirects = 0`\n- `net.ipv4.conf.default.secure_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.secure_redirects=0\n sysctl -w net.ipv4.conf.default.secure_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.secure_redirects = 0\" \"net.ipv4.conf.default.secure_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.secure_redirects = 0`\n- `net.ipv4.conf.default.secure_redirects = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.secure_redirects=0\n sysctl -w net.ipv4.conf.default.secure_redirects=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.secure_redirects = 0\" \"net.ipv4.conf.default.secure_redirects = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.6_Ensure_secure_icmp_redirects_are_not_accepted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure secure icmp redirects are not accepted"},{"id":"cisb-ubnt24.04lts-003.003.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Setting `net.ipv4.conf.all.rp_filter` and `net.ipv4.conf.default.rp_filter` to `1` forces the Linux kernel to utilize reverse path filtering on a received packet to determine if the packet was valid. Essentially, with reverse path filtering, if the return packet does not go out the same interface that the corresponding source packet came from, the packet is dropped (and logged if `log_martians` is set)."},{"id":"cisb-ubnt24.04lts-003.003.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting `net.ipv4.conf.all.rp_filter` and `net.ipv4.conf.default.rp_filter` to `1` is a good way to deter attackers from sending your system bogus packets that cannot be responded to. One instance where this feature breaks down is if asymmetrical routing is employed. This would occur when using dynamic routing protocols (bgp, ospf, etc) on your system. If you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing."},{"id":"cisb-ubnt24.04lts-003.003.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.rp_filter = 1`\n- `net.ipv4.conf.default.rp_filter = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIf you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.rp_filter=1\n sysctl -w net.ipv4.conf.default.rp_filter=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.rp_filter = 1\" \"net.ipv4.conf.default.rp_filter = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.rp_filter = 1`\n- `net.ipv4.conf.default.rp_filter = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten \n\nImpact: \n\nIf you are using asymmetrical routing on your system, you will not be able to enable this feature without breaking the routing.\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.rp_filter=1\n sysctl -w net.ipv4.conf.default.rp_filter=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.rp_filter = 1\" \"net.ipv4.conf.default.rp_filter = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.7_Ensure_reverse_path_filtering_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure reverse path filtering is enabled"},{"id":"cisb-ubnt24.04lts-003.003.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"In networking, source routing allows a sender to partially or fully specify the route packets take through a network. In contrast, non\\-source routed packets travel a path determined by routers in the network. In some cases, systems may not be routable or reachable from some locations (e.g. private addresses vs. Internet routable), and so source routed packets would need to be used."},{"id":"cisb-ubnt24.04lts-003.003.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting `net.ipv4.conf.all.accept_source_route`, `net.ipv4.conf.default.accept_source_route`, `net.ipv6.conf.all.accept_source_route` and `net.ipv6.conf.default.accept_source_route` to `0` disables the system from accepting source routed packets. Assume this system was capable of routing packets to Internet routable addresses on one interface and private addresses on another interface. Assume that the private addresses were not routable to the Internet routable addresses and vice versa. Under normal routing circumstances, an attacker from the Internet routable addresses could not use the system as a way to reach the private address systems. If, however, source routed packets were allowed, they could be used to gain access to the private address systems as the route could be specified, rather than rely on routing protocols that did not allow this routing."},{"id":"cisb-ubnt24.04lts-003.003.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.accept_source_route = 0`\n- `net.ipv4.conf.default.accept_source_route = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_source_route = 0`\n- `net.ipv6.conf.default.accept_source_route = 0`\n\n*Example:* \n\nRun the following command to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_source_route=0\n sysctl -w net.ipv6.conf.default.accept_source_route=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_source_route = 0\" \"net.ipv6.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_source_route=0\n sysctl -w net.ipv4.conf.default.accept_source_route=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.accept_source_route = 0\" \"net.ipv4.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.accept_source_route = 0`\n- `net.ipv4.conf.default.accept_source_route = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_source_route = 0`\n- `net.ipv6.conf.default.accept_source_route = 0`\n\n*Example:* \n\nRun the following command to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_source_route=0\n sysctl -w net.ipv6.conf.default.accept_source_route=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_source_route = 0\" \"net.ipv6.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.accept_source_route=0\n sysctl -w net.ipv4.conf.default.accept_source_route=0\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.accept_source_route = 0\" \"net.ipv4.conf.default.accept_source_route = 0\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.8_Ensure_source_routed_packets_are_not_accepted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure source routed packets are not accepted"},{"id":"cisb-ubnt24.04lts-003.003.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"When enabled, this feature logs packets with un\\-routable source addresses to the kernel log."},{"id":"cisb-ubnt24.04lts-003.003.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting `net.ipv4.conf.all.log_martians` and `net.ipv4.conf.default.log_martians` to `1` enables this feature. Logging these packets allows an administrator to investigate the possibility that an attacker is sending spoofed packets to their system."},{"id":"cisb-ubnt24.04lts-003.003.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.log_martians = 1`\n- `net.ipv4.conf.default.log_martians = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.log_martians=1\n sysctl -w net.ipv4.conf.default.log_martians=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.log_martians = 1\" \"net.ipv4.conf.default.log_martians = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.conf.all.log_martians = 1`\n- `net.ipv4.conf.default.log_martians = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.conf.all.log_martians=1\n sysctl -w net.ipv4.conf.default.log_martians=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.conf.all.log_martians = 1\" \"net.ipv4.conf.default.log_martians = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"3.3.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.9_Ensure_suspicious_packets_are_logged"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure suspicious packets are logged"},{"id":"cisb-ubnt24.04lts-003.003.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"When `tcp_syncookies` is set, the kernel will handle TCP SYN packets normally until the half\\-open connection queue is full, at which time, the SYN cookie functionality kicks in. SYN cookies work by not using the SYN queue at all. Instead, the kernel simply replies to the SYN with a SYN/ACK, but will include a specially crafted TCP sequence number that encodes the source and destination IP address and port number and the time the packet was sent. A legitimate connection would send the ACK packet of the three way handshake with the specially crafted sequence number. This allows the system to verify that it has received a valid response to a SYN cookie and allow the connection, even though there is no corresponding SYN in the queue."},{"id":"cisb-ubnt24.04lts-003.003.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Attackers use SYN flood attacks to perform a denial of service attacked on a system by sending many SYN packets without completing the three way handshake. This will quickly use up slots in the kernel's half\\-open connection queue and prevent legitimate connections from succeeding. Setting `net.ipv4.tcp_syncookies` to `1` enables SYN cookies, allowing the system to keep accepting valid connections, even if under a denial of service attack."},{"id":"cisb-ubnt24.04lts-003.003.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.tcp_syncookies = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.tcp_syncookies=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.tcp_syncookies = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv4.tcp_syncookies = 1`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv4.tcp_syncookies=1\n sysctl -w net.ipv4.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv4.tcp_syncookies = 1\" >> /etc/sysctl.d/60-netipv4_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.10_Ensure_tcp_syn_cookies_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure tcp syn cookies is enabled"},{"id":"cisb-ubnt24.04lts-003.003.011_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-003.003.011_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-003.003.011_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Routers periodically multicast Router Advertisement messages to announce their availability and convey information to neighboring nodes that enable them to be automatically configured on the network.\n\n`net.ipv6.conf.all.accept_ra` and `net.ipv6.conf.default.accept_ra` determine the systems ability to accept these advertisements"},{"id":"cisb-ubnt24.04lts-003.003.011_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is recommended that systems do not accept router advertisements as they could be tricked into routing traffic to compromised machines. Setting hard routes within the system (usually a single default route to a trusted router) protects the system from bad routes. Setting `net.ipv6.conf.all.accept_ra` and `net.ipv6.conf.default.accept_ra` to `0` disables the system's ability to accept IPv6 router advertisements."},{"id":"cisb-ubnt24.04lts-003.003.011_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_ra = 0`\n- `net.ipv6.conf.default.accept_ra = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_ra=0\n sysctl -w net.ipv6.conf.default.accept_ra=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_ra = 0\" \"net.ipv6.conf.default.accept_ra = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.011_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** IPv6 is enabled on the system: \n\nSet the following parameters in `/etc/sysctl.conf` or a file in `/etc/sysctl.d/` ending in `.conf`: \n\n- `net.ipv6.conf.all.accept_ra = 0`\n- `net.ipv6.conf.default.accept_ra = 0`\n\n*Example:* \n\nRun the following script to set the active kernel parameters: \n\n**Note:** If these settings appear in a canonically later file, or later in the same file, these settings will be overwritten\n\n```\n#!/usr/bin/env bash\n\n{\n sysctl -w net.ipv6.conf.all.accept_ra=0\n sysctl -w net.ipv6.conf.default.accept_ra=0\n sysctl -w net.ipv6.route.flush=1\n}\n```\n\n```\n# printf '%s\\n' \"net.ipv6.conf.all.accept_ra = 0\" \"net.ipv6.conf.default.accept_ra = 0\" >> /etc/sysctl.d/60-netipv6_sysctl.conf\n```"},{"id":"cisb-ubnt24.04lts-003.003.011_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-003.003.011_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"3.3.11"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_3.3.11_Ensure_ipv6_router_advertisements_are_not_accepted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ipv6 router advertisements are not accepted"}]}]},{"id":"cisb-ubnt24.04lts-004_grp","parts":[{"id":"cisb-ubnt24.04lts-004_ovrvw","name":"overview","prose":"A firewall is a set of rules. When a data packet moves into or out of a protected network space, its contents (in particular, information about its origin, target, and the protocol it plans to use) are tested against the firewall rules to see if it should be allowed through\n\nTo provide a Host Based Firewall, the Linux kernel includes support for:\n\n- `Netfilter` \\- A set of hooks inside the Linux kernel that allows kernel modules to register callback functions with the network stack. A registered callback function is then called back for every packet that traverses the respective hook within the network stack. Includes the ip\\_tables, ip6\\_tables, arp\\_tables, and ebtables kernel modules. These modules are some of the significant parts of the Netfilter hook system.\n- `nftables` \\- A subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. nftables is supposed to replace certain parts of Netfilter, while keeping and reusing most of it. nftables utilizes the building blocks of the Netfilter infrastructure, such as the existing hooks into the networking stack, connection tracking system, userspace queueing component, and logging subsystem. **Is available in Linux kernels 3.13 and newer**.\n\nIn order to configure firewall rules for Netfilter or nftables, a firewall utility needs to be installed. Guidance has been included for the following firewall utilities:\n\n- UncomplicatedFirewall (`ufw`) \\- Provides firewall features by acting as a front\\-end for the Linux kernel's netfilter framework via the iptables backend. `ufw` supports both IPv4 and IPv6 networks\n- `nftables` \\- Includes the nft utility for configuration of the nftables subsystem of the Linux kernel\n- `iptables` \\- Includes the iptables, ip6tables, arptables and ebtables utilities for configuration Netfilter and the ip\\_tables, ip6\\_tables, arp\\_tables, and ebtables kernel modules.\n\n**Notes:**\n\n- Only **one** method should be used to configure a firewall on the system. Use of more than one method could produce unexpected results\n- This section is intended only to ensure the resulting firewall rules are in place, not how they are configured"}],"props":[{"name":"label","value":"4"}],"title":"Host Based Firewall","groups":[{"id":"cisb-ubnt24.04lts-004.001_grp","parts":[{"id":"cisb-ubnt24.04lts-004.001_ovrvw","name":"overview","prose":"Only one method should be used to configure a firewall on the system. Use of more than one method could produce unexpected results.\n\nThis section ensures that only one firewall is in use on the system and provides guidance to the subsequent subsection that should be followed for a single firewall utility configuration."}],"props":[{"name":"label","value":"4.1"}],"title":"Configure a single firewall utility","controls":[{"id":"cisb-ubnt24.04lts-004.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"In Linux security, employing a single, effective firewall configuration utility ensures that only legitimate traffic gets processed, reducing the system’s exposure to potential threats. The choice between `ufw`, `nftables`, and `iptables` depends on organizational needs.\n\n**Note:** `iptables` is being phased out, and support for `iptables` will be reduced over time. It is recommended to transition towards either `nftables` or `ufw` as the default firewall management tool."},{"id":"cisb-ubnt24.04lts-004.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Proper configuration of a single firewall utility minimizes cyber threats and protects services and data, while avoiding vulnerabilities like open ports or exposed services. Standardizing on a single tool simplifies management, reduces errors, and fortifies security across Linux systems."},{"id":"cisb-ubnt24.04lts-004.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Remediating to a single firewall configuration is a complex process and involves several steps. The following provides the basic steps to follow for a single firewall configuration: \n\n1. Determine which firewall utility best fits organizational needs\n2. Follow the recommendations in the subsequent subsection for the single firewall to be used \n\n**Note:** Review the firewall subsection overview for the selected firewall to be used, it contains a script to\nsimplify this process.\n3. Return to this recommendation to ensure a single firewall configuration utility is in use\n\nImpact: \n\nThe use of more than one firewall utility may produce unexpected results."},{"id":"cisb-ubnt24.04lts-004.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Remediating to a single firewall configuration is a complex process and involves several steps. The following provides the basic steps to follow for a single firewall configuration: \n\n1. Determine which firewall utility best fits organizational needs\n2. Follow the recommendations in the subsequent subsection for the single firewall to be used \n\n**Note:** Review the firewall subsection overview for the selected firewall to be used, it contains a script to\nsimplify this process.\n3. Return to this recommendation to ensure a single firewall configuration utility is in use\n\nImpact: \n\nThe use of more than one firewall utility may produce unexpected results."},{"id":"cisb-ubnt24.04lts-004.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.001.001_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#93e957b0-1019-4661-994a-19113f9abdc0"}],"props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"4.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.1.1_Ensure_a_single_firewall_configuration_utility_is_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure a single firewall configuration utility is in use"}]},{"id":"cisb-ubnt24.04lts-004.002_grp","parts":[{"id":"cisb-ubnt24.04lts-004.002_ovrvw","name":"overview","prose":"**If nftables or iptables are being used in your environment, please follow the guidance in their respective section and pass\\-over the guidance in this section.**\n\nUncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n- Uses a command\\-line interface consisting of a small number of simple commands\n- Uses iptables for configuration\n- Rules are processed until first matching rule. The first matching rule will be applied.\n\n**Notes:**\n\n- Configuration of a live system's firewall directly over a remote connection will often result in being locked out\n- Rules should be ordered so that `ALLOW` rules come before `DENY` rules."}],"props":[{"name":"label","value":"4.2"}],"title":"Configure UncomplicatedFirewall","controls":[{"id":"cisb-ubnt24.04lts-004.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Uncomplicated Firewall (ufw) is a frontend for iptables and is particularly well\\-suited for host\\-based firewalls. ufw provides a framework for managing netfilter, as well as a command\\-line interface for manipulating the firewall"},{"id":"cisb-ubnt24.04lts-004.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A firewall utility is required to configure the Linux kernel's netfilter framework via the iptables or nftables back\\-end.\n\nThe Linux kernel's netfilter framework host\\-based firewall can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.\n\n**Note:** Only one firewall utility should be installed and configured. `UFW` is dependent on the iptables package"},{"id":"cisb-ubnt24.04lts-004.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install Uncomplicated Firewall (UFW):\n\n```\n# apt install ufw\n```"},{"id":"cisb-ubnt24.04lts-004.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install Uncomplicated Firewall (UFW):\n\n```\n# apt install ufw\n```"},{"id":"cisb-ubnt24.04lts-004.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.1_Ensure_ufw_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw is installed"},{"id":"cisb-ubnt24.04lts-004.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `iptables-persistent` is a boot\\-time loader for netfilter rules, iptables plugin"},{"id":"cisb-ubnt24.04lts-004.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Running both `ufw` and the services included in the iptables\\-persistent package may lead to conflict"},{"id":"cisb-ubnt24.04lts-004.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove the `iptables-persistent` package:\n\n```\n# apt purge iptables-persistent\n```"},{"id":"cisb-ubnt24.04lts-004.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove the `iptables-persistent` package:\n\n```\n# apt purge iptables-persistent\n```"},{"id":"cisb-ubnt24.04lts-004.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.2_Ensure_iptables-persistent_is_not_installed_with_ufw"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure iptables-persistent is not installed with ufw"},{"id":"cisb-ubnt24.04lts-004.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"UncomplicatedFirewall (ufw) is a frontend for iptables. ufw provides a framework for managing netfilter, as well as a command\\-line and available graphical user interface for manipulating the firewall.\n\n**Note:**\n\n- When running ufw enable or starting ufw via its initscript, ufw will flush its chains. This is required so ufw can maintain a consistent state, but it may drop existing connections (eg ssh). ufw does support adding rules before enabling the firewall.\n- Run the following command before running `ufw enable`.\n\n```\n# ufw allow proto tcp from any to any port 22\n```\n\n- The rules will still be flushed, but the ssh port will be open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not flush the chains when adding or removing rules (but will when modifying a rule or changing the default policy)\n- By default, ufw will prompt when enabling the firewall while running under ssh. This can be disabled by using `ufw --force enable`"},{"id":"cisb-ubnt24.04lts-004.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The ufw service must be enabled and running in order for ufw to protect the system"},{"id":"cisb-ubnt24.04lts-004.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to unmask the `ufw` daemon: \n\nRun the following command to enable and start the `ufw` daemon: \n\nRun the following command to enable ufw: \n\nImpact: \n\nChanging firewall settings while connected over network can result in being locked out of the system.\n\n```\n# ufw enable\n```\n\n```\n# systemctl --now enable ufw.service\n\nactive\n```\n\n```\n# systemctl unmask ufw.service\n```"},{"id":"cisb-ubnt24.04lts-004.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to unmask the `ufw` daemon: \n\nRun the following command to enable and start the `ufw` daemon: \n\nRun the following command to enable ufw: \n\nImpact: \n\nChanging firewall settings while connected over network can result in being locked out of the system.\n\n```\n# ufw enable\n```\n\n```\n# systemctl --now enable ufw.service\n\nactive\n```\n\n```\n# systemctl unmask ufw.service\n```"},{"id":"cisb-ubnt24.04lts-004.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.003_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#f639e935-042b-4abb-ab87-86d1599bac88"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.3_Ensure_ufw_service_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw service is enabled"},{"id":"cisb-ubnt24.04lts-004.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6)."},{"id":"cisb-ubnt24.04lts-004.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8 for IPv4 and ::1/128 for IPv6) traffic should be seen, all other interfaces should ignore traffic on this network as an anti\\-spoofing measure."},{"id":"cisb-ubnt24.04lts-004.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to configure the loopback interface to accept traffic: \n\nRun the following commands to configure all other interfaces to deny traffic to the loopback network:\n\n```\n# ufw deny in from 127.0.0.0/8\n# ufw deny in from ::1\n```\n\n```\n# ufw allow in on lo\n# ufw allow out on lo\n```"},{"id":"cisb-ubnt24.04lts-004.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to configure the loopback interface to accept traffic: \n\nRun the following commands to configure all other interfaces to deny traffic to the loopback network:\n\n```\n# ufw deny in from 127.0.0.0/8\n# ufw deny in from ::1\n```\n\n```\n# ufw allow in on lo\n# ufw allow out on lo\n```"},{"id":"cisb-ubnt24.04lts-004.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.004_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#28607f87-d6ba-4a7a-a8a3-b3eb7273a22a"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.4_Ensure_ufw_loopback_traffic_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw loopback traffic is configured"},{"id":"cisb-ubnt24.04lts-004.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the firewall rules for new outbound connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system.\n- Unlike iptables, when a new outbound rule is added, ufw automatically takes care of associated established connections, so no rules for the latter kind are required."},{"id":"cisb-ubnt24.04lts-004.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If rules are not in place for new outbound connections all packets will be dropped by the default policy preventing network usage."},{"id":"cisb-ubnt24.04lts-004.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure ufw in accordance with site policy. The following commands will implement a policy to allow all outbound connections on all interfaces:\n\n```\n# ufw allow out on all\n```"},{"id":"cisb-ubnt24.04lts-004.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure ufw in accordance with site policy. The following commands will implement a policy to allow all outbound connections on all interfaces:\n\n```\n# ufw allow out on all\n```"},{"id":"cisb-ubnt24.04lts-004.002.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.5_Ensure_ufw_outbound_connections_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure ufw outbound connections are configured"},{"id":"cisb-ubnt24.04lts-004.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Services and ports can be accepted or explicitly rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- The remediation command opens up the port to traffic from all sources. Consult ufw documentation and set any restrictions in compliance with site policy"},{"id":"cisb-ubnt24.04lts-004.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"To reduce the attack surface of a system, all services and ports should be blocked unless required.\n\n- Any ports that have been opened on non\\-loopback addresses need firewall rules to govern traffic.\n- Without a firewall rule configured for open ports, the default firewall policy will drop all packets to these ports.\n- Required ports should have a firewall rule created to allow approved connections in accordance with local site policy.\n- Unapproved ports should have an explicit deny rule created."},{"id":"cisb-ubnt24.04lts-004.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For each port identified in the audit which does not have a firewall rule, evaluate the service listening on the port and add a rule for accepting or denying inbound connections in accordance with local site policy: \n\n*Examples:* \n\n**Note:** Examples create rules for from any, to any. More specific rules should be concentered when allowing inbound traffic e.g only traffic from this network. \n\n*Example to allow traffic on port 443 using the tcp protocol from the 192.168.1.0 network:*\n\n```\nufw allow from 192.168.1.0/24 to any proto tcp port 443\n```\n\n```\n# ufw allow in /\n\n# ufw deny in /\n```"},{"id":"cisb-ubnt24.04lts-004.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For each port identified in the audit which does not have a firewall rule, evaluate the service listening on the port and add a rule for accepting or denying inbound connections in accordance with local site policy: \n\n*Examples:* \n\n**Note:** Examples create rules for from any, to any. More specific rules should be concentered when allowing inbound traffic e.g only traffic from this network. \n\n*Example to allow traffic on port 443 using the tcp protocol from the 192.168.1.0 network:*\n\n```\nufw allow from 192.168.1.0/24 to any proto tcp port 443\n```\n\n```\n# ufw allow in /\n\n# ufw deny in /\n```"},{"id":"cisb-ubnt24.04lts-004.002.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.6_Ensure_ufw_firewall_rules_exist_for_all_open_ports"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw firewall rules exist for all open ports"},{"id":"cisb-ubnt24.04lts-004.002.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.002.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.002.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A default deny policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:** Any port or protocol without a explicit allow before the default deny will be blocked"},{"id":"cisb-ubnt24.04lts-004.002.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage."},{"id":"cisb-ubnt24.04lts-004.002.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to implement a default *deny* policy: \n\nImpact: \n\nAny port and protocol not explicitly allowed will be blocked. The following rules should be considered before applying the default deny.\n\n```\nufw allow out http\nufw allow out https\nufw allow out ntp # Network Time Protocol\nufw allow out to any port 53 # DNS\nufw allow out to any port 853 # DNS over TLS\nufw logging on\n```\n\n```\n# ufw default deny incoming\n# ufw default deny outgoing\n# ufw default deny routed\n```"},{"id":"cisb-ubnt24.04lts-004.002.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to implement a default *deny* policy: \n\nImpact: \n\nAny port and protocol not explicitly allowed will be blocked. The following rules should be considered before applying the default deny.\n\n```\nufw allow out http\nufw allow out https\nufw allow out ntp # Network Time Protocol\nufw allow out to any port 53 # DNS\nufw allow out to any port 853 # DNS over TLS\nufw logging on\n```\n\n```\n# ufw default deny incoming\n# ufw default deny outgoing\n# ufw default deny routed\n```"},{"id":"cisb-ubnt24.04lts-004.002.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.002.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.2.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.2.7_Ensure_ufw_default_deny_firewall_policy"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw default deny firewall policy"}]},{"id":"cisb-ubnt24.04lts-004.003_grp","parts":[{"id":"cisb-ubnt24.04lts-004.003_ovrvw","name":"overview","prose":"**If Uncomplicated Firewall (UFW) or iptables are being used in your environment, please follow the guidance in their respective section and pass\\-over the guidance in this section.**\n\n`nftables` is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The biggest change with the successor `nftables` is its simplicity. With iptables, we have to configure every single rule and use the syntax which can be compared with normal commands. With `nftables`, the simpler syntax, much like BPF (Berkely Packet Filter) means shorter lines and less repetition. Support for `nftables` should also be compiled into the kernel, together with the related `nftables` modules. Please ensure that your kernel supports nf\\_tables before choosing this option.\n\n**Notes:**\n\n- This section broadly assumes starting with an empty `nftables` firewall ruleset (established by flushing the rules with nft flush ruleset).\n- Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot.\n- Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.\n\nThe following script will implement the firewall rules of this section and open port 22(ssh) from anywhere. Opening the ports for port 22(ssh) needs to be updated in accordance with local site policy. **Allow port 22(ssh) needs to be updated to only allow systems requiring ssh connectivity to connect, as per site policy**.\n\nSave the script below as `/etc/nftables.rules`\n\n```\n#!/sbin/nft -f\n\n# This nftables.rules config should be saved as /etc/nftables.rules\n# flush nftables rulesset\nflush ruleset\n# Load nftables ruleset\n# nftables config with inet table named filter\ntable inet filter {\n # Base chain for input hook named input (Filters inbound network packets)\n chain input {\n type filter hook input priority 0; policy drop;\n\n # Ensure loopback traffic is configured\n iif \"lo\" accept\n ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop\n # If IPv6 is enabled on the system ensure IPv6 loopback traffic is configured\n ip6 saddr ::1 counter packets 0 bytes 0 drop\n\n # Ensure established connections are configured\n ip protocol tcp ct state established accept\n ip protocol udp ct state established accept\n\n # Accept port 22(SSH) traffic from anywhere\n tcp dport ssh accept\n }\n\n # Base chain for hook forward named forward (Filters forwarded network packets)\n chain forward {\n type filter hook forward priority 0; policy drop;\n }\n\n # Base chain for hook output named output (Filters outbount network packets)\n chain output {\n type filter hook output priority 0; policy drop;\n # Ensure outbound and established connections are configured\n ip protocol tcp ct state established,related,new accept\n ip protocol udp ct state established,related,new accept\n }\n}\n```\n\nRun the following command to load the file into nftables\n\n```\n# nft -f /etc/nftables.rules\n```\n\nAll changes in the nftables subsections are temporary.\n\nTo make these changes permanent:\n\nRun the following command to create the nftables.rules file\n\n```\nnft list ruleset > /etc/nftables.rules\n```\n\nAdd the following line to `/etc/nftables.conf`\n\n```\ninclude \"/etc/nftables.rules\"\n```"}],"props":[{"name":"label","value":"4.3"}],"title":"Configure nftables","controls":[{"id":"cisb-ubnt24.04lts-004.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"nftables provides a new in\\-kernel packet classification framework that is based on a network\\-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.\n\n**Notes:**\n\n- nftables is available in Linux kernel 3.13 and newer\n- Only one firewall utility should be installed and configured\n- Changing firewall settings while connected over the network can result in being locked out of the system"},{"id":"cisb-ubnt24.04lts-004.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host."},{"id":"cisb-ubnt24.04lts-004.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install `nftables`:\n\n```\n# apt install nftables\n```"},{"id":"cisb-ubnt24.04lts-004.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install `nftables`:\n\n```\n# apt install nftables\n```"},{"id":"cisb-ubnt24.04lts-004.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9"}]}],"props":[{"name":"label","value":"4.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.1_Ensure_nftables_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables is installed"},{"id":"cisb-ubnt24.04lts-004.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Uncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use."},{"id":"cisb-ubnt24.04lts-004.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Running both the `nftables` service and `ufw` may lead to conflict and unexpected results."},{"id":"cisb-ubnt24.04lts-004.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run **one** of the following to either remove `ufw` **or** disable `ufw` and mask `ufw.service`: \n\nRun the following command to remove `ufw`: \n\n**\\-OR\\-** \n\nRun the following commands to disable `ufw` and mask `ufw.service`: \n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`\n\n```\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n```\n# apt purge ufw\n```"},{"id":"cisb-ubnt24.04lts-004.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run **one** of the following to either remove `ufw` **or** disable `ufw` and mask `ufw.service`: \n\nRun the following command to remove `ufw`: \n\n**\\-OR\\-** \n\nRun the following commands to disable `ufw` and mask `ufw.service`: \n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`\n\n```\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n```\n# apt purge ufw\n```"},{"id":"cisb-ubnt24.04lts-004.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-7"}]}],"props":[{"name":"label","value":"4.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.2_Ensure_ufw_is_uninstalled_or_disabled_with_nftables"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw is uninstalled or disabled with nftables"},{"id":"cisb-ubnt24.04lts-004.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"nftables is a replacement for iptables, ip6tables, ebtables and arptables"},{"id":"cisb-ubnt24.04lts-004.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is possible to mix iptables and nftables. However, this increases complexity and also the chance to introduce errors. For simplicity flush out all iptables rules, and ensure it is not loaded"},{"id":"cisb-ubnt24.04lts-004.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to flush iptables: \n\nFor iptables: \n\nFor ip6tables:\n\n```\n# ip6tables -F\n```\n\n```\n# iptables -F\n```"},{"id":"cisb-ubnt24.04lts-004.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to flush iptables: \n\nFor iptables: \n\nFor ip6tables:\n\n```\n# ip6tables -F\n```\n\n```\n# iptables -F\n```"},{"id":"cisb-ubnt24.04lts-004.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.3_Ensure_iptables_are_flushed_with_nftables"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure iptables are flushed with nftables"},{"id":"cisb-ubnt24.04lts-004.003.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Tables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of five families."},{"id":"cisb-ubnt24.04lts-004.003.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"nftables doesn't have any default tables. Without a table being built, nftables will not filter network traffic."},{"id":"cisb-ubnt24.04lts-004.003.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to create a table in nftables \n\n*Example:* \n\nImpact: \n\nAdding rules to a running nftables can cause loss of connectivity to the system\n\n```\n# nft create table inet filter\n```\n\n```\n# nft create table inet\n```"},{"id":"cisb-ubnt24.04lts-004.003.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to create a table in nftables \n\n*Example:* \n\nImpact: \n\nAdding rules to a running nftables can cause loss of connectivity to the system\n\n```\n# nft create table inet filter\n```\n\n```\n# nft create table inet\n```"},{"id":"cisb-ubnt24.04lts-004.003.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.4_Ensure_a_nftables_table_exists"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure a nftables table exists"},{"id":"cisb-ubnt24.04lts-004.003.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Chains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets from the networking stack, a regular chain may be used as jump target and is used for better rule organization."},{"id":"cisb-ubnt24.04lts-004.003.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a base chain doesn't exist with a hook for input, forward, and delete, packets that would flow through those chains will not be touched by nftables."},{"id":"cisb-ubnt24.04lts-004.003.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to create the base chains: \n\n*Example:* \n\nImpact: \n\nIf configuring nftables over ssh, `creating` a `base chain` with a policy of `drop` will cause loss of connectivity. \n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop\n\n```\n# nft create chain inet filter input { type filter hook input priority 0 \\; }\n\n# nft create chain inet filter forward { type filter hook forward priority 0 \\; }\n\n# nft create chain inet filter output { type filter hook output priority 0 \\; }\n```\n\n```\n# nft create chain inet { type filter hook <(input|forward|output)> priority 0 \\; }\n```"},{"id":"cisb-ubnt24.04lts-004.003.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to create the base chains: \n\n*Example:* \n\nImpact: \n\nIf configuring nftables over ssh, `creating` a `base chain` with a policy of `drop` will cause loss of connectivity. \n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop\n\n```\n# nft create chain inet filter input { type filter hook input priority 0 \\; }\n\n# nft create chain inet filter forward { type filter hook forward priority 0 \\; }\n\n# nft create chain inet filter output { type filter hook output priority 0 \\; }\n```\n\n```\n# nft create chain inet { type filter hook <(input|forward|output)> priority 0 \\; }\n```"},{"id":"cisb-ubnt24.04lts-004.003.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"4.3.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.5_Ensure_nftables_base_chains_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables base chains exist"},{"id":"cisb-ubnt24.04lts-004.003.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network"},{"id":"cisb-ubnt24.04lts-004.003.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Loopback traffic is generated between processes on machine and is typically critical to the operation of the system. The loopback interface is the only place that loopback network traffic should be seen, all other interfaces should ignore traffic on this network as an anti\\-spoofing measure."},{"id":"cisb-ubnt24.04lts-004.003.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to implement the loopback rules: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nRun the following command to implement the IPv6 loopback rule:\n\n```\n# nft add rule inet filter input ip6 saddr ::1 counter drop\n```\n\n```\n# nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop\n```\n\n```\n# nft add rule inet filter input iif lo accept\n```"},{"id":"cisb-ubnt24.04lts-004.003.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to implement the loopback rules: \n\n**\\- IF \\-** IPv6 is enabled on the system: \n\nRun the following command to implement the IPv6 loopback rule:\n\n```\n# nft add rule inet filter input ip6 saddr ::1 counter drop\n```\n\n```\n# nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop\n```\n\n```\n# nft add rule inet filter input iif lo accept\n```"},{"id":"cisb-ubnt24.04lts-004.003.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.6_Ensure_nftables_loopback_traffic_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables loopback traffic is configured"},{"id":"cisb-ubnt24.04lts-004.003.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the firewall rules for new outbound, and established connections"},{"id":"cisb-ubnt24.04lts-004.003.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage."},{"id":"cisb-ubnt24.04lts-004.003.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure nftables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# nft add rule inet filter input ip protocol tcp ct state established accept\n\n# nft add rule inet filter input ip protocol udp ct state established accept\n\n# nft add rule inet filter output ip protocol tcp ct state new,related,established accept\n\n# nft add rule inet filter output ip protocol udp ct state new,related,established accept\n```"},{"id":"cisb-ubnt24.04lts-004.003.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure nftables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# nft add rule inet filter input ip protocol tcp ct state established accept\n\n# nft add rule inet filter input ip protocol udp ct state established accept\n\n# nft add rule inet filter output ip protocol tcp ct state new,related,established accept\n\n# nft add rule inet filter output ip protocol udp ct state new,related,established accept\n```"},{"id":"cisb-ubnt24.04lts-004.003.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.7_Ensure_nftables_outbound_and_established_connections_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure nftables outbound and established connections are configured"},{"id":"cisb-ubnt24.04lts-004.003.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Base chain policy is the default verdict that will be applied to packets reaching the end of the chain."},{"id":"cisb-ubnt24.04lts-004.003.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"There are two policies: accept (Default) and drop. If the policy is set to `accept`, the firewall will accept any packet that is not configured to be denied and the packet will continue transversing the network stack.\n\nIt is easier to allow list acceptable usage than to deny list unacceptable usage.\n\n**Note:**\n\n- Allow port 22(ssh) needs to be updated to only allow systems requiring ssh connectivity to connect, as per site policy.\n- Changing firewall settings while connected over network can result in being locked out of the system."},{"id":"cisb-ubnt24.04lts-004.003.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command for the base chains with the input, forward, and output hooks to implement a default DROP policy: \n\n*Example:* \n\nImpact: \n\nIf configuring nftables over ssh, creating a base chain with a policy of drop will cause loss of connectivity. \n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop\n\n```\n# nft chain inet filter input { policy drop \\; }\n\n# nft chain inet filter forward { policy drop \\; }\n\n# nft chain inet filter output { policy drop \\; }\n```\n\n```\n# nft chain { policy drop \\; }\n```"},{"id":"cisb-ubnt24.04lts-004.003.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command for the base chains with the input, forward, and output hooks to implement a default DROP policy: \n\n*Example:* \n\nImpact: \n\nIf configuring nftables over ssh, creating a base chain with a policy of drop will cause loss of connectivity. \n\nEnsure that a rule allowing ssh has been added to the base chain prior to setting the base chain's policy to drop\n\n```\n# nft chain inet filter input { policy drop \\; }\n\n# nft chain inet filter forward { policy drop \\; }\n\n# nft chain inet filter output { policy drop \\; }\n```\n\n```\n# nft chain { policy drop \\; }\n```"},{"id":"cisb-ubnt24.04lts-004.003.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"},{"name":"marking","class":"Reference","value":"Manual Page nft"}]}],"props":[{"name":"label","value":"4.3.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.8_Ensure_nftables_default_deny_firewall_policy"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables default deny firewall policy"},{"id":"cisb-ubnt24.04lts-004.003.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service"},{"id":"cisb-ubnt24.04lts-004.003.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The nftables service restores the nftables rules from the rules files referenced in the `/etc/nftables.conf` file during boot or the starting of the nftables service"},{"id":"cisb-ubnt24.04lts-004.003.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to enable the nftables service:\n\n```\n# systemctl enable nftables\n```"},{"id":"cisb-ubnt24.04lts-004.003.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to enable the nftables service:\n\n```\n# systemctl enable nftables\n```"},{"id":"cisb-ubnt24.04lts-004.003.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.9_Ensure_nftables_service_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables service is enabled"},{"id":"cisb-ubnt24.04lts-004.003.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.003.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.003.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames.\n\nThe nftables service reads the `/etc/nftables.conf` file for a nftables file or files to include in the nftables ruleset.\n\nA nftables ruleset containing the input, forward, and output base chains allow network traffic to be filtered.\n\n**Note:** Saving the script and following the instruction in the Configure nftables section overview will implement the rules in the configure nftable section, open port 22(ssh) from anywhere, and applies nftables ruleset on boot."},{"id":"cisb-ubnt24.04lts-004.003.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Changes made to nftables ruleset only affect the live system, you will also need to configure the nftables ruleset to apply on boot"},{"id":"cisb-ubnt24.04lts-004.003.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/nftables.conf` file and un\\-comment or add a line with `include ` for each nftables file you want included in the nftables ruleset on boot \n\n*Example:* \n\nAdd the line:\n\n```\ninclude \"/etc/nftables.rules\"\n```\n\n```\n# vi /etc/nftables.conf\n```"},{"id":"cisb-ubnt24.04lts-004.003.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/nftables.conf` file and un\\-comment or add a line with `include ` for each nftables file you want included in the nftables ruleset on boot \n\n*Example:* \n\nAdd the line:\n\n```\ninclude \"/etc/nftables.rules\"\n```\n\n```\n# vi /etc/nftables.conf\n```"},{"id":"cisb-ubnt24.04lts-004.003.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.003.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.3.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.3.10_Ensure_nftables_rules_are_permanent"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables rules are permanent"}]},{"id":"cisb-ubnt24.04lts-004.004_grp","parts":[{"id":"cisb-ubnt24.04lts-004.004_ovrvw","name":"overview","prose":"**If Uncomplicated Firewall (UFW) or nftables are being used in your environment, please follow the guidance in their respective section and pass\\-over the guidance in this section.**\n\nIPtables is an application that allows a system administrator to configure the IPv4 and IPv6 tables, chains and rules provided by the Linux kernel firewall. While several methods of configuration exist this section is intended only to ensure the resulting IPtables rules are in place, not how they are configured. If IPv6 is in use in your environment, similar settings should be applied to the IP6tables as well.\n\n**Note:**\n\n- Configuration of a live system's firewall directly over a remote connection will often result in being locked out.\n- `iptables` is being phased out, and support for `iptables` will be reduced over time. It is recommended to transition towards either `nftables` or `ufw` as the default firewall management tool."}],"props":[{"name":"label","value":"4.4"}],"title":"Configure iptables","groups":[{"id":"cisb-ubnt24.04lts-004.004.001_grp","parts":[{"id":"cisb-ubnt24.04lts-004.004.001_ovrvw","name":"overview","prose":"This section provides guidance for installing, enabling, removing, and disabling software packages necessary for using IPTables as the method for configuring and maintaining a Host Based Firewall on the system.\n\n**Note:** Using more than one method to configure and maintain a Host Based Firewall can cause unexpected results. If Uncomplicated Firewall (UFW) or NFTables are being used for configuration and maintenance, this section should be skipped and the guidance in their respective section followed."}],"props":[{"name":"label","value":"4.4.1"}],"title":"Configure iptables software","controls":[{"id":"cisb-ubnt24.04lts-004.004.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`iptables` is a utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall, implemented as different Netfilter modules, and the chains and rules it stores. Different kernel modules and programs are used for different protocols; `iptables` applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames."},{"id":"cisb-ubnt24.04lts-004.004.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A method of configuring and maintaining firewall rules is necessary to configure a Host Based Firewall."},{"id":"cisb-ubnt24.04lts-004.004.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install `iptables` and `iptables-persistent`\n\n```\n# apt install iptables iptables-persistent\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install `iptables` and `iptables-persistent`\n\n```\n# apt install iptables iptables-persistent\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.1.1_Ensure_iptables_packages_are_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure iptables packages are installed"},{"id":"cisb-ubnt24.04lts-004.004.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`nftables` is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables."},{"id":"cisb-ubnt24.04lts-004.004.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Running both `iptables` and `nftables` may lead to conflict."},{"id":"cisb-ubnt24.04lts-004.004.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove `nftables`: \n\n**\\- OR \\-** \n\nRun the following commands to stop and mask `nftables.service`:\n\n```\n# systemctl stop nftables.service\n# systemctl mask nftables.service\n```\n\n```\n# apt purge nftables\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove `nftables`: \n\n**\\- OR \\-** \n\nRun the following commands to stop and mask `nftables.service`:\n\n```\n# systemctl stop nftables.service\n# systemctl mask nftables.service\n```\n\n```\n# apt purge nftables\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, CM-7"}]}],"props":[{"name":"label","value":"4.4.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.1.2_Ensure_nftables_is_not_in_use_with_iptables"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nftables is not in use with iptables"},{"id":"cisb-ubnt24.04lts-004.004.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Uncomplicated Firewall (UFW) is a program for managing a netfilter firewall designed to be easy to use.\n\n- Uses a command\\-line interface consisting of a small number of simple commands\n- Uses iptables for configuration"},{"id":"cisb-ubnt24.04lts-004.004.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Running `iptables.persistent` with `ufw` enabled may lead to conflict and unexpected results."},{"id":"cisb-ubnt24.04lts-004.004.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove `ufw`: \n\n**\\- OR \\-** \n\nRun the following commands to disable ufw, and stop and mask `ufw.service`: \n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`\n\n```\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n```\n# apt purge ufw\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove `ufw`: \n\n**\\- OR \\-** \n\nRun the following commands to disable ufw, and stop and mask `ufw.service`: \n\n**Note:** `ufw disable` needs to be run before `systemctl mask ufw.service` in order to correctly disable `UFW`\n\n```\n# ufw disable\n# systemctl stop ufw.service\n# systemctl mask ufw.service\n```\n\n```\n# apt purge ufw\n```"},{"id":"cisb-ubnt24.04lts-004.004.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, CM-7"}]}],"props":[{"name":"label","value":"4.4.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.1.3_Ensure_ufw_is_not_in_use_with_iptables"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ufw is not in use with iptables"}]},{"id":"cisb-ubnt24.04lts-004.004.002_grp","parts":[{"id":"cisb-ubnt24.04lts-004.004.002_ovrvw","name":"overview","prose":"`iptables` is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built\\-in chains and may also contain user\\-defined chains.\n\nEach chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a 'target', which may be a jump to a user\\-defined chain in the same table.\n\n**Note:** This section broadly assumes starting with an empty `iptables` firewall ruleset (established by flushing the rules with `iptables -F`). Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot. Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot. The following script will implement the firewall rules of this section and open port 22(ssh) from anywhere:\n\n```\n#!/bin/bash\n\n# Flush IPtables rules\niptables -F\n\n# Ensure default deny firewall policy\niptables -P INPUT DROP\niptables -P OUTPUT DROP\niptables -P FORWARD DROP\n\n# Ensure loopback traffic is configured\niptables -A INPUT -i lo -j ACCEPT\niptables -A OUTPUT -o lo -j ACCEPT\niptables -A INPUT -s 127.0.0.0/8 -j DROP\n\n# Ensure outbound and established connections are configured\niptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\niptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n\n# Open inbound ssh(tcp port 22) connections\niptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT\n```"}],"props":[{"name":"label","value":"4.4.2"}],"title":"Configure IPv4 iptables","controls":[{"id":"cisb-ubnt24.04lts-004.004.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage."},{"id":"cisb-ubnt24.04lts-004.004.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to implement a default DROP policy:\n\n```\n# iptables -P INPUT DROP\n# iptables -P OUTPUT DROP\n# iptables -P FORWARD DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to implement a default DROP policy:\n\n```\n# iptables -P INPUT DROP\n# iptables -P OUTPUT DROP\n# iptables -P FORWARD DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.2.1_Ensure_iptables_default_deny_firewall_policy"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure iptables default deny firewall policy"},{"id":"cisb-ubnt24.04lts-004.004.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Loopback traffic is generated between processes on machine and is typically critical to the operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti\\-spoofing measure."},{"id":"cisb-ubnt24.04lts-004.004.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to implement the loopback rules:\n\n```\n# iptables -A INPUT -i lo -j ACCEPT\n# iptables -A OUTPUT -o lo -j ACCEPT\n# iptables -A INPUT -s 127.0.0.0/8 -j DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to implement the loopback rules:\n\n```\n# iptables -A INPUT -i lo -j ACCEPT\n# iptables -A OUTPUT -o lo -j ACCEPT\n# iptables -A INPUT -s 127.0.0.0/8 -j DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.2.2_Ensure_iptables_loopback_traffic_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure iptables loopback traffic is configured"},{"id":"cisb-ubnt24.04lts-004.004.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the firewall rules for new outbound, and established connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage."},{"id":"cisb-ubnt24.04lts-004.004.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# iptables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.2.3_Ensure_iptables_outbound_and_established_connections_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure iptables outbound and established connections are configured"},{"id":"cisb-ubnt24.04lts-004.004.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Any ports that have been opened on non\\-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy"},{"id":"cisb-ubnt24.04lts-004.004.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports."},{"id":"cisb-ubnt24.04lts-004.004.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```\n# iptables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```\n# iptables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.2.4_Ensure_iptables_firewall_rules_exist_for_all_open_ports"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure iptables firewall rules exist for all open ports"}]},{"id":"cisb-ubnt24.04lts-004.004.003_grp","parts":[{"id":"cisb-ubnt24.04lts-004.004.003_ovrvw","name":"overview","prose":"Ip6tables is used to set up, maintain, and inspect the tables of IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built\\-in chains and may also contain user\\-defined chains.\nEach chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. This is called a \\`target', which may be a jump to a user\\-defined chain in the same table.\n\nIf IPv6 in enabled on the system, the ip6tables should be configured.\n\n**Note:** This section broadly assumes starting with an empty ip6tables firewall ruleset (established by flushing the rules with ip6tables \\-F). Remediation steps included only affect the live system, you will also need to configure your default firewall configuration to apply on boot. Configuration of a live systems firewall directly over a remote connection will often result in being locked out. It is advised to have a known good firewall configuration set to run on boot and to configure an entire firewall structure in a script that is then run and tested before saving to boot.\n\nThe following script will implement the firewall rules of this section and open port 22(ssh) from anywhere:\n\n```\n#!/bin/bash\n\n# Flush ip6tables rules\nip6tables -F\n\n# Ensure default deny firewall policy\nip6tables -P INPUT DROP\nip6tables -P OUTPUT DROP\nip6tables -P FORWARD DROP\n\n# Ensure loopback traffic is configured\nip6tables -A INPUT -i lo -j ACCEPT\nip6tables -A OUTPUT -o lo -j ACCEPT\nip6tables -A INPUT -s ::1 -j DROP\n\n# Ensure outbound and established connections are configured\nip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\nip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\nip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\nip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n\n# Open inbound ssh(tcp port 22) connections\nip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT\n```"}],"props":[{"name":"label","value":"4.4.3"}],"title":"Configure IPv6 ip6tables","controls":[{"id":"cisb-ubnt24.04lts-004.004.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A default deny all policy on connections ensures that any unconfigured network usage will be rejected.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"With a default accept policy the firewall will accept any packet that is not configured to be denied. It is easier to allow list acceptable usage than to deny list unacceptable usage."},{"id":"cisb-ubnt24.04lts-004.004.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** IPv6 is enabled on your system: \n\nRun the following commands to implement a default DROP policy:\n\n```\n# ip6tables -P INPUT DROP\n# ip6tables -P OUTPUT DROP\n# ip6tables -P FORWARD DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** IPv6 is enabled on your system: \n\nRun the following commands to implement a default DROP policy:\n\n```\n# ip6tables -P INPUT DROP\n# ip6tables -P OUTPUT DROP\n# ip6tables -P FORWARD DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.3.1_Ensure_ip6tables_default_deny_firewall_policy"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ip6tables default deny firewall policy"},{"id":"cisb-ubnt24.04lts-004.004.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (::1).\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (::1) traffic should be seen, all other interfaces should ignore traffic on this network as an anti\\-spoofing measure."},{"id":"cisb-ubnt24.04lts-004.004.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to implement the loopback rules:\n\n```\n# ip6tables -A INPUT -i lo -j ACCEPT\n# ip6tables -A OUTPUT -o lo -j ACCEPT\n# ip6tables -A INPUT -s ::1 -j DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to implement the loopback rules:\n\n```\n# ip6tables -A INPUT -i lo -j ACCEPT\n# ip6tables -A OUTPUT -o lo -j ACCEPT\n# ip6tables -A INPUT -s ::1 -j DROP\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.3.2_Ensure_ip6tables_loopback_traffic_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ip6tables loopback traffic is configured"},{"id":"cisb-ubnt24.04lts-004.004.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the firewall rules for new outbound, and established IPv6 connections.\n\n**Note:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well"},{"id":"cisb-ubnt24.04lts-004.004.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If rules are not in place for new outbound, and established connections all packets will be dropped by the default policy preventing network usage."},{"id":"cisb-ubnt24.04lts-004.004.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure iptables in accordance with site policy. The following commands will implement a policy to allow all outbound connections and all established connections:\n\n```\n# ip6tables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT\n# ip6tables -A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.3.3_Ensure_ip6tables_outbound_and_established_connections_are_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure ip6tables outbound and established connections are configured"},{"id":"cisb-ubnt24.04lts-004.004.003.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-004.004.003.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-004.004.003.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Any ports that have been opened on non\\-loopback addresses need firewall rules to govern traffic.\n\n**Notes:**\n\n- Changing firewall settings while connected over network can result in being locked out of the system\n- Remediation will only affect the active system firewall, be sure to configure the default policy in your firewall management to apply on boot as well\n- The remediation command opens up the port to traffic from all sources. Consult iptables documentation and set any restrictions in compliance with site policy"},{"id":"cisb-ubnt24.04lts-004.004.003.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Without a firewall rule configured for open ports default firewall policy will drop all packets to these ports."},{"id":"cisb-ubnt24.04lts-004.004.003.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```\n# ip6tables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"For each port identified in the audit which does not have a firewall rule establish a proper rule for accepting inbound connections:\n\n```\n# ip6tables -A INPUT -p --dport -m state --state NEW -j ACCEPT\n```"},{"id":"cisb-ubnt24.04lts-004.004.003.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7ccf1517-16b4-42fc-a70b-924be9050aff"},{"rel":"reference","href":"#77d94858-1921-4a05-af04-24298cab9636"},{"rel":"reference","href":"#895d5a1f-ef32-4d37-8919-5ae503146e18"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-004.004.003.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CA-9, SC-7"}]}],"props":[{"name":"label","value":"4.4.3.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_4.4.3.4_Ensure_ip6tables_firewall_rules_exist_for_all_open_ports"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure ip6tables firewall rules exist for all open ports"}]}]}]},{"id":"cisb-ubnt24.04lts-005_grp","parts":[{"id":"cisb-ubnt24.04lts-005_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"5"}],"title":"Access Control","groups":[{"id":"cisb-ubnt24.04lts-005.001_grp","parts":[{"id":"cisb-ubnt24.04lts-005.001_ovrvw","name":"overview","prose":"Secure Shell (SSH) is a secure, encrypted replacement for common login services such as `telnet`, `ftp`, `rlogin`, `rsh`, and `rcp`. It is strongly recommended that sites abandon older clear\\-text login protocols and use SSH to prevent session hijacking and sniffing of sensitive data off the network.\n\nThe recommendations in this section only apply if the SSH daemon is installed on the system, **if remote access is not required the SSH daemon can be removed and this section skipped**.\n\n`sshd_config`:\n\n- The openSSH daemon configuration directives, `Include` and `Match`, may cause the audits in this section's recommendations to report incorrectly. It is recommended that these options only be used if they're needed and fully understood. If these options are configured in accordance with local site policy, they should be accounted for when following the recommendations in this section.\n- The default `Include` location is the `/etc/ssh/sshd_config.d` directory. This default has been accounted for in this section. If a file has an additional `Include` that isn't this default location, the files should be reviewed to verify that the recommended setting is not being over\\-ridden.\n- The audits of the running configuration in this section are run in the context of the root user, the local host name, and the local host's IP address. If a `Match` block exists that matches one of these criteria, the output of the audit will be from the match block. The respective matched criteria should be replaced with a non\\-matching substitution.\n- `Include`:\n - Include the specified configuration file(s).\n - Multiple pathnames may be specified and each pathname may contain glob(7) wildcards that will be expanded and processed in lexical order.\n - Files without absolute paths are assumed to be in `/etc/ssh/`.\n - An Include directive may appear inside a Match block to perform conditional inclusion.\n - Include the specified configuration file(s).\n - Multiple pathnames may be specified and each pathname may contain glob(7) wildcards that will be expanded and processed in lexical order.\n - Files without absolute paths are assumed to be in `/etc/ssh/`.\n - An Include directive may appear inside a Match block to perform conditional inclusion.\n- `Match`:\n - Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.\n - The arguments to Match are one or more criteria\\-pattern pairs or the single token All which matches all criteria. The available criteria are User, Group, Host, LocalAddress, LocalPort, and Address.\n - The match patterns may consist of single entries or comma\\-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh\\_config(5).\n - The patterns in an Address criteria may additionally contain addresses to match in CIDR address/masklen format, such as `192.0.2.0/24` or `2001:db8::/32`. Note that the mask length provided must be consistent with the address \\- it is an error to specify a mask length that is too long for the address or one with bits set in this host portion of the address. For example, `192.0.2.0/33` and `192.0.2.0/8`, respectively.\n - Only a subset of keywords may be used on the lines following a Match keyword. Available keywords are available in the ssh\\_config man page.\n - Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.\n - The arguments to Match are one or more criteria\\-pattern pairs or the single token All which matches all criteria. The available criteria are User, Group, Host, LocalAddress, LocalPort, and Address.\n - The match patterns may consist of single entries or comma\\-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh\\_config(5).\n - The patterns in an Address criteria may additionally contain addresses to match in CIDR address/masklen format, such as `192.0.2.0/24` or `2001:db8::/32`. Note that the mask length provided must be consistent with the address \\- it is an error to specify a mask length that is too long for the address or one with bits set in this host portion of the address. For example, `192.0.2.0/33` and `192.0.2.0/8`, respectively.\n - Only a subset of keywords may be used on the lines following a Match keyword. Available keywords are available in the ssh\\_config man page.\n- Once all configuration changes have been made to `/etc/ssh/sshd_config` or any included configuration files, the `sshd` configuration must be reloaded\n\nCommand to re\\-load the SSH daemon configuration:\n\n```\n# systemctl reload-or-restart sshd\n```\n\n`sshd` command:\n\n- `-T` \\- Extended test mode. Check the validity of the configuration file, output the effective configuration to stdout and then exit. Optionally, Match rules may be applied by specifying the connection parameters using one or more `-C` options.\n- `-C` \\- connection\\_spec. Specify the connection parameters to use for the \\-T extended test mode. If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output. The connection parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple `-C` options or as a comma\\-separated list. The keywords are `addr`, `user`, `host`, `laddr`, `lport`, and `rdomain` and correspond to source address, user, resolved source host name, local address, local port number and routing domain respectively."}],"props":[{"name":"label","value":"5.1"}],"title":"Configure SSH Server","controls":[{"id":"cisb-ubnt24.04lts-005.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The file `/etc/ssh/sshd_config`, and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory, contain configuration specifications for `sshd`."},{"id":"cisb-ubnt24.04lts-005.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"configuration specifications for `sshd` need to be protected from unauthorized changes by non\\-privileged users."},{"id":"cisb-ubnt24.04lts-005.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to set ownership and permissions on `/etc/ssh/sshd_config` and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory: \n\n**\\- IF \\-** other locations are listed in an `Include` statement, `*.conf` files in these locations access should also be modified.\n\n```\n#!/usr/bin/env bash\n\n{\n chmod u-x,og-rwx /etc/ssh/sshd_config\n chown root:root /etc/ssh/sshd_config\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n chmod u-x,og-rwx \"$l_file\"\n chown root:root \"$l_file\"\n fi\n done < <(find /etc/ssh/sshd_config.d -type f -print0 2>/dev/null)\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to set ownership and permissions on `/etc/ssh/sshd_config` and files ending in `.conf` in the `/etc/ssh/sshd_config.d` directory: \n\n**\\- IF \\-** other locations are listed in an `Include` statement, `*.conf` files in these locations access should also be modified.\n\n```\n#!/usr/bin/env bash\n\n{\n chmod u-x,og-rwx /etc/ssh/sshd_config\n chown root:root /etc/ssh/sshd_config\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n chmod u-x,og-rwx \"$l_file\"\n chown root:root \"$l_file\"\n fi\n done < <(find /etc/ssh/sshd_config.d -type f -print0 2>/dev/null)\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"5.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.1_Ensure_permissions_on_etcsshsshd_config_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/ssh/sshd_config are configured"},{"id":"cisb-ubnt24.04lts-005.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"An SSH private key is one of two files used in SSH public key authentication. In this authentication method, the possession of the private key is proof of identity. Only a private key that corresponds to a public key will be able to authenticate successfully. The private keys need to be stored and handled carefully, and no copies of the private key should be distributed."},{"id":"cisb-ubnt24.04lts-005.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If an unauthorized user obtains the private SSH host key file, the host could be impersonated"},{"id":"cisb-ubnt24.04lts-005.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to set mode, ownership, and group on the private SSH host key files:\n\n```\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ssh_group_name=\"$(awk -F: '($1 ~ /^(ssh_keys|_?ssh)$/) {print $1}' /etc/group)\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ \"$l_file_group\" = \"$l_ssh_group_name\" ] && l_pmask=\"0137\" || l_pmask=\"0177\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\:$l_maxperm\\\"\")\n if [ \"l_file_group\" = \"$l_ssh_group_name\" ]; then\n chmod u-x,g-wx,o-rwx \"$l_file\"\n else\n chmod u-x,go-rwx \"$l_file\"\n fi\n fi\n if [ \"$l_file_owner\" != \"root\" ]; then\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\")\n chown root \"$l_file\"\n fi\n if [[ ! \"$l_file_group\" =~ ($l_ssh_group_name|root) ]]; then\n [ -n \"$l_ssh_group_name\" ] && l_new_group=\"$l_ssh_group_name\" || l_new_group=\"root\"\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"$l_ssh_group_name\\\" or \\\"root\\\"\" \\\n \" Changing group ownership to \\\"$l_new_group\\\"\")\n chgrp \"$l_new_group\" \"$l_file\"\n fi\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \"Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done < <(stat -Lc '%#a:%U:%G' \"$l_file\")\n }\n while IFS= read -r -d $'\\0' l_file; do\n if ssh-keygen -lf &>/dev/null \"$l_file\"; then\n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?private\\h+key\\b' && f_file_access_fix\n fi\n done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \"\" \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to set mode, ownership, and group on the private SSH host key files:\n\n```\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=(); l_ssh_group_name=\"$(awk -F: '($1 ~ /^(ssh_keys|_?ssh)$/) {print $1}' /etc/group)\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ \"$l_file_group\" = \"$l_ssh_group_name\" ] && l_pmask=\"0137\" || l_pmask=\"0177\"\n l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n if [ $(( $l_file_mode & $l_pmask )) -gt 0 ]; then\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\:$l_maxperm\\\"\")\n if [ \"l_file_group\" = \"$l_ssh_group_name\" ]; then\n chmod u-x,g-wx,o-rwx \"$l_file\"\n else\n chmod u-x,go-rwx \"$l_file\"\n fi\n fi\n if [ \"$l_file_owner\" != \"root\" ]; then\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\")\n chown root \"$l_file\"\n fi\n if [[ ! \"$l_file_group\" =~ ($l_ssh_group_name|root) ]]; then\n [ -n \"$l_ssh_group_name\" ] && l_new_group=\"$l_ssh_group_name\" || l_new_group=\"root\"\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"$l_ssh_group_name\\\" or \\\"root\\\"\" \\\n \" Changing group ownership to \\\"$l_new_group\\\"\")\n chgrp \"$l_new_group\" \"$l_file\"\n fi\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \"Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done < <(stat -Lc '%#a:%U:%G' \"$l_file\")\n }\n while IFS= read -r -d $'\\0' l_file; do\n if ssh-keygen -lf &>/dev/null \"$l_file\"; then\n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?private\\h+key\\b' && f_file_access_fix\n fi\n done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \"\" \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"5.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.2_Ensure_permissions_on_SSH_private_host_key_files_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on SSH private host key files are configured"},{"id":"cisb-ubnt24.04lts-005.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"An SSH public key is one of two files used in SSH public key authentication. In this authentication method, a public key is a key that can be used for verifying digital signatures generated using a corresponding private key. Only a public key that corresponds to a private key will be able to authenticate successfully."},{"id":"cisb-ubnt24.04lts-005.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a public host key file is modified by an unauthorized user, the SSH service may be compromised."},{"id":"cisb-ubnt24.04lts-005.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to set mode, ownership, and group on the public SSH host key files:\n\n```\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n l_pmask=\"0133\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ $(( $l_file_mode & $l_pmask )) -gt 0 ] && \\\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\\"$l_maxperm\\\"\") && chmod u-x,go-wx \"$l_file\"\n [ \"$l_file_owner\" != \"root\" ] && \\\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\") && chown root \"$l_file\"\n [ \"$l_file_group\" != \"root\" ] && \\\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"root\\\"\" \\\n \" Changing group ownership to \\\"root\\\"\") && chgrp root \"$l_file\"\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done < <(stat -Lc '%#a:%U:%G' \"$l_file\")\n }\n while IFS= read -r -d $'\\0' l_file; do\n if ssh-keygen -lf &>/dev/null \"$l_file\"; then\n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?public\\h+key\\b' && f_file_access_fix\n fi\n done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to set mode, ownership, and group on the public SSH host key files:\n\n```\n#!/usr/bin/env bash\n\n{\n a_output=(); a_output2=()\n l_pmask=\"0133\"; l_maxperm=\"$( printf '%o' $(( 0777 & ~$l_pmask )) )\"\n f_file_access_fix()\n {\n while IFS=: read -r l_file_mode l_file_owner l_file_group; do\n a_out2=()\n [ $(( $l_file_mode & $l_pmask )) -gt 0 ] && \\\n a_out2+=(\" Mode: \\\"$l_file_mode\\\" should be mode: \\\"$l_maxperm\\\" or more restrictive\" \\\n \" updating to mode: \\\"$l_maxperm\\\"\") && chmod u-x,go-wx \"$l_file\"\n [ \"$l_file_owner\" != \"root\" ] && \\\n a_out2+=(\" Owned by: \\\"$l_file_owner\\\" should be owned by \\\"root\\\"\" \\\n \" Changing ownership to \\\"root\\\"\") && chown root \"$l_file\"\n [ \"$l_file_group\" != \"root\" ] && \\\n a_out2+=(\" Owned by group \\\"$l_file_group\\\" should be group owned by: \\\"root\\\"\" \\\n \" Changing group ownership to \\\"root\\\"\") && chgrp root \"$l_file\"\n if [ \"${#a_out2[@]}\" -gt \"0\" ]; then\n a_output2+=(\" - File: \\\"$l_file\\\"\" \"${a_out2[@]}\")\n else\n a_output+=(\" - File: \\\"$l_file\\\"\" \\\n \" Correct: mode: \\\"$l_file_mode\\\", owner: \\\"$l_file_owner\\\", and group owner: \\\"$l_file_group\\\" configured\")\n fi\n done < <(stat -Lc '%#a:%U:%G' \"$l_file\")\n }\n while IFS= read -r -d $'\\0' l_file; do\n if ssh-keygen -lf &>/dev/null \"$l_file\"; then\n file \"$l_file\" | grep -Piq -- '\\bopenssh\\h+([^#\\n\\r]+\\h+)?public\\h+key\\b' && f_file_access_fix\n fi\n done < <(find -L /etc/ssh -xdev -type f -print0 2>/dev/null)\n if [ \"${#a_output2[@]}\" -le \"0\" ]; then\n printf '%s\\n' \"\" \" - No access changes required\" \"\"\n else\n printf '%s\\n' \" - Remediation results:\" \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"5.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.3_Ensure_permissions_on_SSH_public_host_key_files_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on SSH public host key files are configured"},{"id":"cisb-ubnt24.04lts-005.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"There are several options available to limit which users and group can access the system via SSH. It is recommended that at least one of the following options be leveraged:\n\n- `AllowUsers`:\n - The `AllowUsers` variable gives the system administrator the option of allowing specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host.\n - The `AllowUsers` variable gives the system administrator the option of allowing specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by only allowing the allowed users to log in from a particular host, the entry can be specified in the form of user@host.\n- `AllowGroups`:\n - The `AllowGroups` variable gives the system administrator the option of allowing specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n - The `AllowGroups` variable gives the system administrator the option of allowing specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n- `DenyUsers`:\n - The `DenyUsers` variable gives the system administrator the option of denying specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host.\n - The `DenyUsers` variable gives the system administrator the option of denying specific users to `ssh` into the system. The list consists of space separated user names. Numeric user IDs are not recognized with this variable. If a system administrator wants to restrict user access further by specifically denying a user's access from a particular host, the entry can be specified in the form of user@host.\n- `DenyGroups`:\n - The `DenyGroups` variable gives the system administrator the option of denying specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable.\n - The `DenyGroups` variable gives the system administrator the option of denying specific groups of users to `ssh` into the system. The list consists of space separated group names. Numeric group IDs are not recognized with this variable."},{"id":"cisb-ubnt24.04lts-005.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Restricting which users can remotely access the system via SSH will help ensure that only authorized users access the system."},{"id":"cisb-ubnt24.04lts-005.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set one or more of the parameters above any `Include` and `Match` set statements as follows: \n\n**Note:** \n\n- First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a `.conf` file in a `Include` directory.\n- **Be advised** that these options are \"ANDed\" together. If both `AllowUsers` and `AllowGroups` are set, connections will be limited to the list of users that are also a member of an allowed group. It is recommended that only one be set for clarity and ease of administration.\n- It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user or group and forget to add it to the deny list.\n\n```\nAllowUsers\n - AND/OR -\nAllowGroups\n```"},{"id":"cisb-ubnt24.04lts-005.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set one or more of the parameters above any `Include` and `Match` set statements as follows: \n\n**Note:** \n\n- First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a `.conf` file in a `Include` directory.\n- **Be advised** that these options are \"ANDed\" together. If both `AllowUsers` and `AllowGroups` are set, connections will be limited to the list of users that are also a member of an allowed group. It is recommended that only one be set for clarity and ease of administration.\n- It is easier to manage an allow list than a deny list. In a deny list, you could potentially add a user or group and forget to add it to the deny list.\n\n```\nAllowUsers\n - AND/OR -\nAllowGroups\n```"},{"id":"cisb-ubnt24.04lts-005.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.4_Ensure_sshd_access_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd access is configured"},{"id":"cisb-ubnt24.04lts-005.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `Banner` parameter specifies a file whose contents must be sent to the remote user before authentication is permitted. By default, no banner is displayed."},{"id":"cisb-ubnt24.04lts-005.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Banners are used to warn connecting users of the particular site's policy regarding connection. Presenting a warning message prior to the normal user login may assist the prosecution of trespassers on the computer system."},{"id":"cisb-ubnt24.04lts-005.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `Banner` parameter above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. \n\nEdit the file being called by the `Banner` argument with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# printf '%s\\n' \"Authorized users only. All activity may be monitored and reported.\" > \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"\n```\n\n```\nBanner /etc/issue.net\n```"},{"id":"cisb-ubnt24.04lts-005.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `Banner` parameter above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. \n\nEdit the file being called by the `Banner` argument with the appropriate contents according to your site policy, remove any instances of `\\m` , `\\r` , `\\s` , `\\v` or references to the `OS platform` \n\n*Example:*\n\n```\n# printf '%s\\n' \"Authorized users only. All activity may be monitored and reported.\" > \"$(sshd -T | awk '$1 == \"banner\" {print $2}')\"\n```\n\n```\nBanner /etc/issue.net\n```"},{"id":"cisb-ubnt24.04lts-005.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"5.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.5_Ensure_sshd_Banner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd Banner is configured"},{"id":"cisb-ubnt24.04lts-005.001.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"This variable limits the ciphers that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved ciphers.\n- Ensure that ciphers used are in compliance with site policy.\n- The only \"strong\" ciphers currently FIPS 140 compliant are:\n - mailto:aes256-gcm@openssh.com\n - mailto:aes128-gcm@openssh.com\n - aes256\\-ctr\n - aes192\\-ctr\n - aes128\\-ctr\n - mailto:aes256-gcm@openssh.com\n - mailto:aes128-gcm@openssh.com\n - aes256\\-ctr\n - aes192\\-ctr\n - aes128\\-ctr"},{"id":"cisb-ubnt24.04lts-005.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Weak ciphers that are used for authentication to the cryptographic module cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.\n\n- The Triple DES ciphers, as used in SSH, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain clear text data via a birthday attack against a long\\-duration encrypted session, aka a \"Sweet32\" attack.\n- Error handling in the SSH protocol; Client and Server, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plain text data from an arbitrary block of cipher text in an SSH session via unknown vectors."},{"id":"cisb-ubnt24.04lts-005.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the /etc/ssh/sshd\\_config file and add/modify the `Ciphers` line to contain a comma separated list of the site unapproved (weak) Ciphers preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**\\- IF \\-** `CVE-2023-48795` has been addressed, and it meets local site policy, `chacha20-poly1305@openssh.com` may be removed from the list of excluded ciphers. \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nCiphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,chacha20-poly1305@openssh.com\n```"},{"id":"cisb-ubnt24.04lts-005.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the /etc/ssh/sshd\\_config file and add/modify the `Ciphers` line to contain a comma separated list of the site unapproved (weak) Ciphers preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**\\- IF \\-** `CVE-2023-48795` has been addressed, and it meets local site policy, `chacha20-poly1305@openssh.com` may be removed from the list of excluded ciphers. \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nCiphers -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,chacha20-poly1305@openssh.com\n```"},{"id":"cisb-ubnt24.04lts-005.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#a7df2870-fdbe-413f-bf4b-4a55f66ef459"},{"rel":"reference","href":"#da74b7a3-70ce-4fae-8831-357a58b6b583"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.006_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#b2044d33-016c-4ce1-8844-5c15f4213c96"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-8"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.6_Ensure_sshd_Ciphers_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd Ciphers are configured"},{"id":"cisb-ubnt24.04lts-005.001.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"**Note:** To clarify, the two settings described below are only meant for idle connections from a protocol perspective and are not meant to check if the user is active or not. An idle user does not mean an idle connection. SSH does not and never had, intentionally, the capability to drop idle users. In SSH versions before `8.2p1` there was a bug that caused these values to behave in such a manner that they were abused to disconnect idle users. This bug has been resolved in `8.2p1` and thus it can no longer be abused disconnect idle users.\n\nThe two options `ClientAliveInterval` and `ClientAliveCountMax` control the timeout of SSH sessions. Taken directly from `man 5 sshd_config`:\n\n- `ClientAliveInterval` Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client.\n- `ClientAliveCountMax` Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option en‐abled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become unresponsive.\nThe default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds. Setting a zero ClientAliveCountMax disables connection termination."},{"id":"cisb-ubnt24.04lts-005.001.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"In order to prevent resource exhaustion, appropriate values should be set for both `ClientAliveInterval` and `ClientAliveCountMax`. Specifically, looking at the source code, `ClientAliveCountMax` must be greater than zero in order to utilize the ability of SSH to drop idle connections. If connections are allowed to stay open indefinitely, this can potentially be used as a DDOS attack or simple resource exhaustion could occur over unreliable networks.\n\nThe example set here is a 45 second timeout. Consult your site policy for network timeouts and apply as appropriate."},{"id":"cisb-ubnt24.04lts-005.001.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `ClientAliveInterval` and `ClientAliveCountMax` parameters above any `Include` and `Match` entries according to site policy. \n\n*Example:* \n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nClientAliveInterval 15\nClientAliveCountMax 3\n```"},{"id":"cisb-ubnt24.04lts-005.001.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `ClientAliveInterval` and `ClientAliveCountMax` parameters above any `Include` and `Match` entries according to site policy. \n\n*Example:* \n\n**Note:** First occurrence of a option takes precedence, Match set statements withstanding. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nClientAliveInterval 15\nClientAliveCountMax 3\n```"},{"id":"cisb-ubnt24.04lts-005.001.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.7_Ensure_sshd_ClientAliveInterval_and_ClientAliveCountMax_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured"},{"id":"cisb-ubnt24.04lts-005.001.008_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `DisableForwarding` parameter disables all forwarding features, including X11, ssh\\-agent(1), TCP and StreamLocal. This option overrides all other forwarding\\-related options and may simplify restricted configurations.\n\n- X11Forwarding provides the ability to tunnel X11 traffic through the connection to enable remote graphic connections.\n- ssh\\-agent is a program to hold private keys used for public key authentication. Through use of environment variables the agent can be located and automatically used for authentication when logging in to other machines using ssh.\n- SSH port forwarding is a mechanism in SSH for tunneling application ports from the client to the server, or servers to clients. It can be used for adding encryption to legacy applications, going through firewalls, and some system administrators and IT professionals use it for opening backdoors into the internal network from their home machines."},{"id":"cisb-ubnt24.04lts-005.001.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Disable X11 forwarding unless there is an operational requirement to use X11 applications directly. There is a small risk that the remote X11 servers of users who are logged in via SSH with X11 forwarding could be compromised by other users on the X11 server. Note that even if X11 forwarding is disabled, users can always install their own forwarders.\n\nanyone with root privilege on the the intermediate server can make free use of ssh\\-agent to authenticate them to other servers\n\nLeaving port forwarding enabled can expose the organization to security risks and backdoors. SSH connections are protected with strong encryption. This makes their contents invisible to most deployed network monitoring and traffic filtering solutions. This invisibility carries considerable risk potential if it is used for malicious purposes such as data exfiltration. Cybercriminals or malware could exploit SSH to hide their unauthorized communications, or to exfiltrate stolen data from the target network."},{"id":"cisb-ubnt24.04lts-005.001.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `DisableForwarding` parameter to `yes` above any `Include` entry as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. \n\nImpact: \n\nSSH tunnels are widely used in many corporate environments. In some environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI\\-DSS, and other standards can be achieved without having to modify the applications.\n\n```\nDisableForwarding yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `DisableForwarding` parameter to `yes` above any `Include` entry as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location. \n\nImpact: \n\nSSH tunnels are widely used in many corporate environments. In some environments the applications themselves may have very limited native support for security. By utilizing tunneling, compliance with SOX, HIPAA, PCI\\-DSS, and other standards can be achieved without having to modify the applications.\n\n```\nDisableForwarding yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-7"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"sshd_config(5)"}]}],"props":[{"name":"label","value":"5.1.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.8_Ensure_sshd_DisableForwarding_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd DisableForwarding is enabled"},{"id":"cisb-ubnt24.04lts-005.001.009_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `GSSAPIAuthentication` parameter specifies whether user authentication based on GSSAPI is allowed"},{"id":"cisb-ubnt24.04lts-005.001.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, and should be disabled to reduce the attack surface of the system"},{"id":"cisb-ubnt24.04lts-005.001.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `GSSAPIAuthentication` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nGSSAPIAuthentication no\n```"},{"id":"cisb-ubnt24.04lts-005.001.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `GSSAPIAuthentication` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nGSSAPIAuthentication no\n```"},{"id":"cisb-ubnt24.04lts-005.001.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.9_Ensure_sshd_GSSAPIAuthentication_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd GSSAPIAuthentication is disabled"},{"id":"cisb-ubnt24.04lts-005.001.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `HostbasedAuthentication` parameter specifies if authentication is allowed through trusted hosts via the user of `.rhosts`, or `/etc/hosts.equiv`, along with successful public key client host authentication."},{"id":"cisb-ubnt24.04lts-005.001.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Even though the `.rhosts` files are ineffective if support is disabled in `/etc/pam.conf`, disabling the ability to use `.rhosts` files in SSH provides an additional layer of protection."},{"id":"cisb-ubnt24.04lts-005.001.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `HostbasedAuthentication` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nHostbasedAuthentication no\n```"},{"id":"cisb-ubnt24.04lts-005.001.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `HostbasedAuthentication` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nHostbasedAuthentication no\n```"},{"id":"cisb-ubnt24.04lts-005.001.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.10_Ensure_sshd_HostbasedAuthentication_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd HostbasedAuthentication is disabled"},{"id":"cisb-ubnt24.04lts-005.001.011_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.011_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.011_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `IgnoreRhosts` parameter specifies that `.rhosts` and `.shosts` files will not be used in `RhostsRSAAuthentication` or `HostbasedAuthentication`."},{"id":"cisb-ubnt24.04lts-005.001.011_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting this parameter forces users to enter a password when authenticating with SSH."},{"id":"cisb-ubnt24.04lts-005.001.011_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `IgnoreRhosts` parameter to `yes` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nIgnoreRhosts yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.011_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `IgnoreRhosts` parameter to `yes` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of a option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nIgnoreRhosts yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.011_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.011_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.11"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.11_Ensure_sshd_IgnoreRhosts_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd IgnoreRhosts is enabled"},{"id":"cisb-ubnt24.04lts-005.001.012_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.012_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.012_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Key exchange is any method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received\n\n**Notes:**\n\n- Kex algorithms have a higher preference the earlier they appear in the list\n- Some organizations may have stricter requirements for approved Key exchange algorithms\n- Ensure that Key exchange algorithms used are in compliance with site policy\n- The only Key Exchange Algorithms currently FIPS 140 approved are:\n - ecdh\\-sha2\\-nistp256\n - ecdh\\-sha2\\-nistp384\n - ecdh\\-sha2\\-nistp521\n - diffie\\-hellman\\-group\\-exchange\\-sha256\n - diffie\\-hellman\\-group16\\-sha512\n - diffie\\-hellman\\-group18\\-sha512\n - diffie\\-hellman\\-group14\\-sha256\n - ecdh\\-sha2\\-nistp256\n - ecdh\\-sha2\\-nistp384\n - ecdh\\-sha2\\-nistp521\n - diffie\\-hellman\\-group\\-exchange\\-sha256\n - diffie\\-hellman\\-group16\\-sha512\n - diffie\\-hellman\\-group18\\-sha512\n - diffie\\-hellman\\-group14\\-sha256"},{"id":"cisb-ubnt24.04lts-005.001.012_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Key exchange methods that are considered weak should be removed. A key exchange method may be weak because too few bits are used, or the hashing algorithm is considered too weak. Using weak algorithms could expose connections to man\\-in\\-the\\-middle attacks"},{"id":"cisb-ubnt24.04lts-005.001.012_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file and add/modify the `KexAlgorithms` line to contain a comma separated list of the site unapproved (weak) KexAlgorithms preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nKexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n```"},{"id":"cisb-ubnt24.04lts-005.001.012_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file and add/modify the `KexAlgorithms` line to contain a comma separated list of the site unapproved (weak) KexAlgorithms preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nKexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n```"},{"id":"cisb-ubnt24.04lts-005.001.012_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#a7df2870-fdbe-413f-bf4b-4a55f66ef459"},{"rel":"reference","href":"#da74b7a3-70ce-4fae-8831-357a58b6b583"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.012_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#f09227a7-d5f3-400a-9312-69e95680007a"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: SC-8"}]}],"props":[{"name":"label","value":"5.1.12"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.12_Ensure_sshd_KexAlgorithms_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd KexAlgorithms is configured"},{"id":"cisb-ubnt24.04lts-005.001.013_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.013_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.013_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `LoginGraceTime` parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this session the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access."},{"id":"cisb-ubnt24.04lts-005.001.013_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting the `LoginGraceTime` parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. It will also limit the number of concurrent unauthenticated connections While the recommended setting is 60 seconds (1 Minute), set the number based on site policy."},{"id":"cisb-ubnt24.04lts-005.001.013_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `LoginGraceTime` parameter to `60` seconds or less above any `Include` entry as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nLoginGraceTime 60\n```"},{"id":"cisb-ubnt24.04lts-005.001.013_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `LoginGraceTime` parameter to `60` seconds or less above any `Include` entry as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nLoginGraceTime 60\n```"},{"id":"cisb-ubnt24.04lts-005.001.013_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.13"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.13_Ensure_sshd_LoginGraceTime_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd LoginGraceTime is configured"},{"id":"cisb-ubnt24.04lts-005.001.014_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.014_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.014_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"SSH provides several logging levels with varying amounts of verbosity. The `DEBUG` options are specifically not recommended other than strictly for debugging SSH communications. These levels provide so much data that it is difficult to identify important security information, and may violate the privacy of users."},{"id":"cisb-ubnt24.04lts-005.001.014_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `INFO` level is the basic level that only records login activity of SSH users. In many situations, such as Incident Response, it is important to determine when a particular user was active on a system. The logout record can eliminate those users who disconnected, which helps narrow the field.\n\nThe `VERBOSE` level specifies that login and logout activity as well as the key fingerprint for any SSH key used for login will be logged. This information is important for SSH key management, especially in legacy environments."},{"id":"cisb-ubnt24.04lts-005.001.014_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `LogLevel` parameter to `VERBOSE` or `INFO` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nLogLevel VERBOSE\n - OR -\nLogLevel INFO\n```"},{"id":"cisb-ubnt24.04lts-005.001.014_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `LogLevel` parameter to `VERBOSE` or `INFO` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nLogLevel VERBOSE\n - OR -\nLogLevel INFO\n```"},{"id":"cisb-ubnt24.04lts-005.001.014_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.014_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#cea6fa9e-1d37-4033-91c2-6e9418c6edbd"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-12, SI-5"}]}],"props":[{"name":"label","value":"5.1.14"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.14_Ensure_sshd_LogLevel_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd LogLevel is configured"},{"id":"cisb-ubnt24.04lts-005.001.015_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.015_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.015_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"This variable limits the types of MAC algorithms that SSH can use during communication.\n\n**Notes:**\n\n- Some organizations may have stricter requirements for approved MACs.\n- Ensure that MACs used are in compliance with site policy.\n- The only \"strong\" MACs currently FIPS 140 approved are:\n - HMAC\\-SHA1\n - HMAC\\-SHA2\\-256\n - HMAC\\-SHA2\\-384\n - HMAC\\-SHA2\\-512\n - HMAC\\-SHA1\n - HMAC\\-SHA2\\-256\n - HMAC\\-SHA2\\-384\n - HMAC\\-SHA2\\-512"},{"id":"cisb-ubnt24.04lts-005.001.015_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"MD5 and 96\\-bit MAC algorithms are considered weak and have been shown to increase exploitability in SSH downgrade attacks. Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the SSH tunnel and capture credentials and information."},{"id":"cisb-ubnt24.04lts-005.001.015_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file and add/modify the `MACs` line to contain a comma separated list of the site unapproved (weak) MACs preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**\\- IF \\-** `CVE-2023-48795` has not been reviewed and addressed, the following `etm` MACs should be added to the exclude list: mailto:hmac-sha1-etm@openssh.com,mailto:hmac-sha2-256-etm@openssh.com,mailto:hmac-sha2-512-etm@openssh.com \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nMACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com\n```"},{"id":"cisb-ubnt24.04lts-005.001.015_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file and add/modify the `MACs` line to contain a comma separated list of the site unapproved (weak) MACs preceded with a `-` above any `Include` entries: \n\n*Example:* \n\n**\\- IF \\-** `CVE-2023-48795` has not been reviewed and addressed, the following `etm` MACs should be added to the exclude list: mailto:hmac-sha1-etm@openssh.com,mailto:hmac-sha2-256-etm@openssh.com,mailto:hmac-sha2-512-etm@openssh.com \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nMACs -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com\n```"},{"id":"cisb-ubnt24.04lts-005.001.015_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#364f5526-13a5-497e-9e7e-bebdcb36f30c"},{"rel":"reference","href":"#a7df2870-fdbe-413f-bf4b-4a55f66ef459"},{"rel":"reference","href":"#da74b7a3-70ce-4fae-8831-357a58b6b583"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.015_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#e431fca9-93ec-4b2f-9f6c-cd3648b9b790"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"},{"name":"marking","class":"Reference","value":"More information on SSH downgrade attacks can be found here: http://www.mitls.org/pages/attacks/SLOTH"}]}],"props":[{"name":"label","value":"5.1.15"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.15_Ensure_sshd_MACs_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd MACs are configured"},{"id":"cisb-ubnt24.04lts-005.001.016_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.016_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.016_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `MaxAuthTries` parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the `syslog` file detailing the login failure."},{"id":"cisb-ubnt24.04lts-005.001.016_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting the `MaxAuthTries` parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. While the recommended setting is 4, set the number based on site policy."},{"id":"cisb-ubnt24.04lts-005.001.016_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxAuthTries` parameter to `4` or less above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nMaxAuthTries 4\n```"},{"id":"cisb-ubnt24.04lts-005.001.016_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxAuthTries` parameter to `4` or less above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nMaxAuthTries 4\n```"},{"id":"cisb-ubnt24.04lts-005.001.016_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#5edafcb0-bd77-4520-a465-310bc53735ba"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.016_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.16"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.16_Ensure_sshd_MaxAuthTries_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd MaxAuthTries is configured"},{"id":"cisb-ubnt24.04lts-005.001.017_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.017_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.017_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `MaxSessions` parameter specifies the maximum number of open sessions permitted from a given connection."},{"id":"cisb-ubnt24.04lts-005.001.017_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"To protect a system from denial of service due to a large number of concurrent sessions, use the rate limiting function of MaxSessions to protect availability of sshd logins and prevent overwhelming the daemon."},{"id":"cisb-ubnt24.04lts-005.001.017_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxSessions` parameter to `10` or less above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nMaxSessions 10\n```"},{"id":"cisb-ubnt24.04lts-005.001.017_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxSessions` parameter to `10` or less above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nMaxSessions 10\n```"},{"id":"cisb-ubnt24.04lts-005.001.017_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.17"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.17_Ensure_sshd_MaxSessions_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd MaxSessions is configured"},{"id":"cisb-ubnt24.04lts-005.001.018_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.018_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.018_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `MaxStartups` parameter specifies the maximum number of concurrent unauthenticated connections to the SSH daemon."},{"id":"cisb-ubnt24.04lts-005.001.018_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"To protect a system from denial of service due to a large number of pending authentication connection attempts, use the rate limiting function of MaxStartups to protect availability of sshd logins and prevent overwhelming the daemon."},{"id":"cisb-ubnt24.04lts-005.001.018_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxStartups` parameter to `10:30:60` or more restrictive above any `Include` entries as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nMaxStartups 10:30:60\n```"},{"id":"cisb-ubnt24.04lts-005.001.018_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `MaxStartups` parameter to `10:30:60` or more restrictive above any `Include` entries as follows: \n\n**Note:** First occurrence of a option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nMaxStartups 10:30:60\n```"},{"id":"cisb-ubnt24.04lts-005.001.018_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.18"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.18_Ensure_sshd_MaxStartups_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd MaxStartups is configured"},{"id":"cisb-ubnt24.04lts-005.001.019_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.019_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.019_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `PermitEmptyPasswords` parameter specifies if the SSH server allows login to accounts with empty password strings."},{"id":"cisb-ubnt24.04lts-005.001.019_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Disallowing remote shell access to accounts that have an empty password reduces the probability of unauthorized access to the system."},{"id":"cisb-ubnt24.04lts-005.001.019_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/ssh/sshd_config` and set the `PermitEmptyPasswords` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nPermitEmptyPasswords no\n```"},{"id":"cisb-ubnt24.04lts-005.001.019_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/ssh/sshd_config` and set the `PermitEmptyPasswords` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nPermitEmptyPasswords no\n```"},{"id":"cisb-ubnt24.04lts-005.001.019_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.019_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.19"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.19_Ensure_sshd_PermitEmptyPasswords_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd PermitEmptyPasswords is disabled"},{"id":"cisb-ubnt24.04lts-005.001.020_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.020_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.020_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `PermitRootLogin` parameter specifies if the root user can log in using SSH. The default is `prohibit-password`."},{"id":"cisb-ubnt24.04lts-005.001.020_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Disallowing `root` logins over SSH requires system admins to authenticate using their own individual account, then escalating to `root`. This limits opportunity for non\\-repudiation and provides a clear audit trail in the event of a security incident."},{"id":"cisb-ubnt24.04lts-005.001.020_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `PermitRootLogin` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nPermitRootLogin no\n```"},{"id":"cisb-ubnt24.04lts-005.001.020_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `PermitRootLogin` parameter to `no` above any `Include` and `Match` entries as follows: \n\n**Note:** First occurrence of an option takes precedence, `Match` set statements withstanding. If `Include` locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in `Include` location.\n\n```\nPermitRootLogin no\n```"},{"id":"cisb-ubnt24.04lts-005.001.020_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.020_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5:AC-6"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.20"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.20_Ensure_sshd_PermitRootLogin_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd PermitRootLogin is disabled"},{"id":"cisb-ubnt24.04lts-005.001.021_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.021_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.021_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `PermitUserEnvironment` option allows users to present environment options to the SSH daemon."},{"id":"cisb-ubnt24.04lts-005.001.021_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Permitting users the ability to set environment variables through the SSH daemon could potentially allow users to bypass security controls (e.g. setting an execution path that has SSH executing trojan'd programs)"},{"id":"cisb-ubnt24.04lts-005.001.021_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `PermitUserEnvironment` parameter to `no` above any `Include` entries as follows: \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nPermitUserEnvironment no\n```"},{"id":"cisb-ubnt24.04lts-005.001.021_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `PermitUserEnvironment` parameter to `no` above any `Include` entries as follows: \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nPermitUserEnvironment no\n```"},{"id":"cisb-ubnt24.04lts-005.001.021_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1,CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.21"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.21_Ensure_sshd_PermitUserEnvironment_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd PermitUserEnvironment is disabled"},{"id":"cisb-ubnt24.04lts-005.001.022_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.001.022_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.001.022_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `UsePAM` directive enables the Pluggable Authentication Module (PAM) interface. If set to `yes` this will enable PAM authentication using `ChallengeResponseAuthentication` and `PasswordAuthentication` directives in addition to PAM account and session module processing for all authentication types."},{"id":"cisb-ubnt24.04lts-005.001.022_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"When `usePAM` is set to `yes`, PAM runs through account and session types properly. This is important if you want to restrict access to services based off of IP, time or other factors of the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server"},{"id":"cisb-ubnt24.04lts-005.001.022_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `UsePAM` parameter to `yes` above any `Include` entries as follows: \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nUsePAM yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.022_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/ssh/sshd_config` file to set the `UsePAM` parameter to `yes` above any `Include` entries as follows: \n\n**Note:** First occurrence of an option takes precedence. If Include locations are enabled, used, and order of precedence is understood in your environment, the entry may be created in a file in Include location.\n\n```\nUsePAM yes\n```"},{"id":"cisb-ubnt24.04lts-005.001.022_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.001.022_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"SSHD(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"SSHD_CONFIG(5)"}]}],"props":[{"name":"label","value":"5.1.22"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.1.22_Ensure_sshd_UsePAM_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sshd UsePAM is enabled"}]},{"id":"cisb-ubnt24.04lts-005.002_grp","parts":[{"id":"cisb-ubnt24.04lts-005.002_ovrvw","name":"overview","prose":"There are various tools which allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.\n\n**sudo**\n\nhttps://www.sudo.ws/\n\nThe invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy.\n\n`sudo` supports a plug\\-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug\\-ins to work seamlessly with the `sudo` front end. The default security policy is `sudoers`, which is configured via the file `/etc/sudoers` and any entries in `/etc/sudoers.d`.\n\n**pkexec**\n\nhttps://www.freedesktop.org/software/polkit/docs/0.105/pkexec.1.html\n\n`pkexec` allows an authorized user to execute *PROGRAM* as another user. If *username* is not specified, then the program will be executed as the administrative super user, `root`."}],"props":[{"name":"label","value":"5.2"}],"title":"Configure privilege escalation","controls":[{"id":"cisb-ubnt24.04lts-005.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`sudo` allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. The invoking user's real (not effective) user ID is used to determine the user name with which to query the security policy."},{"id":"cisb-ubnt24.04lts-005.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`sudo` supports a plug\\-in architecture for security policies and input/output logging. Third parties can develop and distribute their own policy and I/O logging plug\\-ins to work seamlessly with the `sudo` front end. The default security policy is `sudoers`, which is configured via the file `/etc/sudoers` and any entries in `/etc/sudoers.d`.\n\nThe security policy determines what privileges, if any, a user has to run `sudo`. The policy may require that users authenticate themselves with a password or another authentication mechanism. If authentication is required, `sudo` will exit if the user's password is not entered within a configurable time limit. This limit is policy\\-specific."},{"id":"cisb-ubnt24.04lts-005.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"First determine is LDAP functionality is required. If so, then install `sudo-ldap`, else install `sudo`. \n\n*Example:*\n\n```\n# apt install sudo\n```"},{"id":"cisb-ubnt24.04lts-005.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"First determine is LDAP functionality is required. If so, then install `sudo-ldap`, else install `sudo`. \n\n*Example:*\n\n```\n# apt install sudo\n```"},{"id":"cisb-ubnt24.04lts-005.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-6"},{"name":"marking","class":"Reference","value":"SUDO(8)"}]}],"props":[{"name":"label","value":"5.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.1_Ensure_sudo_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sudo is installed"},{"id":"cisb-ubnt24.04lts-005.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`sudo` can be configured to run only from a pseudo terminal (`pseudo-pty`)."},{"id":"cisb-ubnt24.04lts-005.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Attackers can run a malicious program using `sudo` which would fork a background process that remains even when the main program has finished executing."},{"id":"cisb-ubnt24.04lts-005.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the file `/etc/sudoers` with `visudo` or a file in `/etc/sudoers.d/` with `visudo -f ` and add the following line: \n\nEdit the file `/etc/sudoers` with `visudo` and any files in `/etc/sudoers.d/` with `visudo -f ` and remove any occurrence of `!use_pty` \n\n**Note:** \n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact: \n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files.\n\n```\nDefaults use_pty\n```"},{"id":"cisb-ubnt24.04lts-005.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the file `/etc/sudoers` with `visudo` or a file in `/etc/sudoers.d/` with `visudo -f ` and add the following line: \n\nEdit the file `/etc/sudoers` with `visudo` and any files in `/etc/sudoers.d/` with `visudo -f ` and remove any occurrence of `!use_pty` \n\n**Note:** \n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact: \n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files.\n\n```\nDefaults use_pty\n```"},{"id":"cisb-ubnt24.04lts-005.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#9091db95-46e6-432e-aa40-de4c5a398da8"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-6"},{"name":"marking","class":"Reference","value":"sudoers(5)"},{"name":"marking","class":"Reference","value":"VISUDO(8)"},{"name":"marking","class":"Reference","value":"SUDO(8)"}]}],"props":[{"name":"label","value":"5.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.2_Ensure_sudo_commands_use_pty"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sudo commands use pty"},{"id":"cisb-ubnt24.04lts-005.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"sudo can use a custom log file"},{"id":"cisb-ubnt24.04lts-005.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A sudo log file simplifies auditing of sudo commands"},{"id":"cisb-ubnt24.04lts-005.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the file `/etc/sudoers` or a file in `/etc/sudoers.d/` with `visudo` or `visudo -f ` and add the following line: \n\nExample: \n\n**Note:** \n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact: \n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files.\n\n```\nDefaults logfile=\"/var/log/sudo.log\"\n```"},{"id":"cisb-ubnt24.04lts-005.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the file `/etc/sudoers` or a file in `/etc/sudoers.d/` with `visudo` or `visudo -f ` and add the following line: \n\nExample: \n\n**Note:** \n\n- sudo will read each file in `/etc/sudoers.d`, skipping file names that end in `~` or contain a `.` character to avoid causing problems with package manager or editor temporary/backup files.\n- Files are parsed in sorted lexical order. That is, `/etc/sudoers.d/01_first` will be parsed before `/etc/sudoers.d/10_second`.\n- Be aware that because the sorting is lexical, not numeric, `/etc/sudoers.d/1_whoops` would be loaded after `/etc/sudoers.d/10_second`.\n- Using a consistent number of leading zeroes in the file names can be used to avoid such problems.\n\nImpact: \n\n**WARNING:** Editing the `sudo` configuration incorrectly can cause `sudo` to stop functioning. Always use `visudo` to modify `sudo` configuration files.\n\n```\nDefaults logfile=\"/var/log/sudo.log\"\n```"},{"id":"cisb-ubnt24.04lts-005.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-12"},{"name":"marking","class":"Reference","value":"sudoers(5)"},{"name":"marking","class":"Reference","value":"VISUDO(8)"},{"name":"marking","class":"Reference","value":"SUDO(8)"}]}],"props":[{"name":"label","value":"5.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.3_Ensure_sudo_log_file_exists"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sudo log file exists"},{"id":"cisb-ubnt24.04lts-005.002.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must be configured so that users must provide a password for privilege escalation."},{"id":"cisb-ubnt24.04lts-005.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Without (re\\-)authentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user (re\\-)authenticate."},{"id":"cisb-ubnt24.04lts-005.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Based on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file. \n\nRemove any line with occurrences of `NOPASSWD` tags in the file. \n\nImpact: \n\nThis will prevent automated processes from being able to elevate privileges."},{"id":"cisb-ubnt24.04lts-005.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Based on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file. \n\nRemove any line with occurrences of `NOPASSWD` tags in the file. \n\nImpact: \n\nThis will prevent automated processes from being able to elevate privileges."},{"id":"cisb-ubnt24.04lts-005.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-6"}]}],"props":[{"name":"label","value":"5.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.4_Ensure_users_must_provide_password_for_privilege_escalation"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure users must provide password for privilege escalation"},{"id":"cisb-ubnt24.04lts-005.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must be configured so that users must re\\-authenticate for privilege escalation."},{"id":"cisb-ubnt24.04lts-005.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Without re\\-authentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen operating systems provide the capability to escalate a functional capability, it is critical the user re\\-authenticate."},{"id":"cisb-ubnt24.04lts-005.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Configure the operating system to require users to reauthenticate for privilege escalation. \n\nBased on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file. \n\nRemove any occurrences of `!authenticate` tags in the file(s)."},{"id":"cisb-ubnt24.04lts-005.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Configure the operating system to require users to reauthenticate for privilege escalation. \n\nBased on the outcome of the audit procedure, use `visudo -f ` to edit the relevant sudoers file. \n\nRemove any occurrences of `!authenticate` tags in the file(s)."},{"id":"cisb-ubnt24.04lts-005.002.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-6"}]}],"props":[{"name":"label","value":"5.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.5_Ensure_re-authentication_for_privilege_escalation_is_not_disabled_globally"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure re-authentication for privilege escalation is not disabled globally"},{"id":"cisb-ubnt24.04lts-005.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`sudo` caches used credentials for a default of 15 minutes. This is for ease of use when there are multiple administrative tasks to perform. The timeout can be modified to suit local security policies.\n\nThis default is distribution specific. See audit section for further information."},{"id":"cisb-ubnt24.04lts-005.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a timeout value reduces the window of opportunity for unauthorized privileged access to another user."},{"id":"cisb-ubnt24.04lts-005.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"If the currently configured timeout is larger than 15 minutes, edit the file listed in the audit section with `visudo -f ` and modify the entry `timestamp_timeout=` to 15 minutes or less as per your site policy. The value is in minutes. This particular entry may appear on it's own, or on the same line as `env_reset`. See the following two examples:\n\n```\nDefaults timestamp_timeout=15\nDefaults env_reset\n```\n\n```\nDefaults env_reset, timestamp_timeout=15\n```"},{"id":"cisb-ubnt24.04lts-005.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"If the currently configured timeout is larger than 15 minutes, edit the file listed in the audit section with `visudo -f ` and modify the entry `timestamp_timeout=` to 15 minutes or less as per your site policy. The value is in minutes. This particular entry may appear on it's own, or on the same line as `env_reset`. See the following two examples:\n\n```\nDefaults timestamp_timeout=15\nDefaults env_reset\n```\n\n```\nDefaults env_reset, timestamp_timeout=15\n```"},{"id":"cisb-ubnt24.04lts-005.002.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6bdf43b6-91d2-4b67-8eae-bbaba76e7db5"},{"rel":"reference","href":"#6c04cc0a-fd22-4342-aafc-0beb38c4e6ce"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.006_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#cf266fbc-b182-4721-810b-4342db98fe7d"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-6"}]}],"props":[{"name":"label","value":"5.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.6_Ensure_sudo_authentication_timeout_is_configured_correctly"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure sudo authentication timeout is configured correctly"},{"id":"cisb-ubnt24.04lts-005.002.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.002.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.002.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `su` command allows a user to run a command or shell as another user. The program has been superseded by `sudo`, which allows for more granular control over privileged access. Normally, the `su` command can be executed by any user. By uncommenting the `pam_wheel.so` statement in `/etc/pam.d/su`, the `su` command will only allow users in a specific groups to execute `su`. This group should be empty to reinforce the use of `sudo` for privileged access."},{"id":"cisb-ubnt24.04lts-005.002.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Restricting the use of `su` , and using `sudo` in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via `sudo` , whereas `su` can only record that a user executed the `su` program."},{"id":"cisb-ubnt24.04lts-005.002.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create an empty group that will be specified for use of the `su` command. The group should be named according to site policy. \n\nExample: \n\nAdd the following line to the `/etc/pam.d/su` file, specifying the empty group:\n\n```\nauth required pam_wheel.so use_uid group=sugroup\n```\n\n```\n# groupadd sugroup\n```"},{"id":"cisb-ubnt24.04lts-005.002.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create an empty group that will be specified for use of the `su` command. The group should be named according to site policy. \n\nExample: \n\nAdd the following line to the `/etc/pam.d/su` file, specifying the empty group:\n\n```\nauth required pam_wheel.so use_uid group=sugroup\n```\n\n```\n# groupadd sugroup\n```"},{"id":"cisb-ubnt24.04lts-005.002.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.002.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"5.2.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.2.7_Ensure_access_to_the_su_command_is_restricted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure access to the su command is restricted"}]},{"id":"cisb-ubnt24.04lts-005.003_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"5.3"}],"title":"Pluggable Authentication Modules","groups":[{"id":"cisb-ubnt24.04lts-005.003.001_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.001_ovrvw","name":"overview","prose":"Updated versions of PAM include additional functionality"}],"props":[{"name":"label","value":"5.3.1"}],"title":"Configure PAM software packages","controls":[{"id":"cisb-ubnt24.04lts-005.003.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Updated versions of PAM include additional functionality"},{"id":"cisb-ubnt24.04lts-005.003.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"To ensure the system has full functionality and access to the options covered by this Benchmark the latest version of `libpam-runtime` should be installed on the system"},{"id":"cisb-ubnt24.04lts-005.003.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** the version of `libpam-runtime` on the system is less than version `1.5.3-5`: \n\nRun the following command to update to the latest version of `PAM`:\n\n```\n# apt upgrade libpam-runtime\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** the version of `libpam-runtime` on the system is less than version `1.5.3-5`: \n\nRun the following command to update to the latest version of `PAM`:\n\n```\n# apt upgrade libpam-runtime\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.1.1_Ensure_latest_version_of_pam_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure latest version of pam is installed"},{"id":"cisb-ubnt24.04lts-005.003.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Pluggable Authentication Modules for PAM"},{"id":"cisb-ubnt24.04lts-005.003.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"To ensure the system has full functionality and access to the PAM options covered by this Benchmark"},{"id":"cisb-ubnt24.04lts-005.003.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** the version of `libpam-modules` on the system is less than version `1.5.3-5`: \n\nRun the following command to update to the latest version of `PAM`:\n\n```\n# apt upgrade libpam-modules\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** the version of `libpam-modules` on the system is less than version `1.5.3-5`: \n\nRun the following command to update to the latest version of `PAM`:\n\n```\n# apt upgrade libpam-modules\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.1.2_Ensure_libpam-modules_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure libpam-modules is installed"},{"id":"cisb-ubnt24.04lts-005.003.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`libpwquality` provides common functions for password quality checking and scoring them based on their apparent randomness. The library also provides a function for generating random passwords with good pronounceability.\n\nThis module can be plugged into the password stack of a given service to provide some plug\\-in strength\\-checking for passwords. The code was originally based on `pam_cracklib` module and the module is backwards compatible with its options."},{"id":"cisb-ubnt24.04lts-005.003.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Strong passwords reduce the risk of systems being hacked through brute force methods."},{"id":"cisb-ubnt24.04lts-005.003.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install `libpam-pwquality`:\n\n```\n# apt install libpam-pwquality\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install `libpam-pwquality`:\n\n```\n# apt install libpam-pwquality\n```"},{"id":"cisb-ubnt24.04lts-005.003.001.003_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#c9ebb72d-1c99-4cee-a2a3-06299ef26243"}],"props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.1.3_Ensure_libpam-pwquality_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure libpam-pwquality is installed"}]},{"id":"cisb-ubnt24.04lts-005.003.002_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.002_ovrvw","name":"overview","prose":"`pam-auth-update` is a utility that permits configuring the central authentication policy for the system using pre\\-defined profiles as supplied by PAM module packages.\n\nProfiles \\- Shipped in the `/usr/share/pam-configs/` directory specify the modules, with options, to enable; the preferred ordering with respect to other profiles; and whether a profile should be enabled by default. Packages providing PAM modules register their profiles at install time by calling pam\\-auth\\-update \\-\\-package.\n\nSelection of profiles is done using the standard `debconf` interface. The profile selection question will be asked at `medium` priority when packages are added or removed, so no user interaction is required by default. Users may invoke `pam-auth-update` directly to change their authentication configuration.\n\nThe `pam-auth-update` script makes every effort to respect local changes to `/etc/pam.d/common-*.` Local modifications to the list of module options will be preserved, and additions of modules within the managed portion of the stack will cause pam\\-auth\\-update to treat the config files as locally modified and not make further changes to the config files unless given the `--force` option.\n\nIf the user specifies that `pam-auth-update` should override local configuration changes, the locally\\-modified files will be saved in /etc/pam.d/ with a suffix of `.pam-old`."}],"props":[{"name":"label","value":"5.3.2"}],"title":"Configure pam-auth-update profiles","controls":[{"id":"cisb-ubnt24.04lts-005.003.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`pam_unix` is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the `/etc/passwd` and if shadow is enabled, the `/etc/shadow` file as well.\n\nThe account component performs the task of establishing the status of the user's account and password based on the following shadow elements: `expire`, `last_change`, `max_change`, `min_change`, `warn_change`. In the case of the latter, it may offer advice to the user on changing their password or, through the `PAM_AUTHTOKEN_REQD` return, delay giving service to the user until they have established a new password. The entries listed above are documented in the shadow(5) manual page. Should the user's record not contain one or more of these entries, the corresponding shadow check is not performed.\n\nThe authentication component performs the task of checking the users credentials (password). The default action of this module is to not permit the user access to a service if their official password is blank."},{"id":"cisb-ubnt24.04lts-005.003.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The system should only provide access after performing authentication of a user."},{"id":"cisb-ubnt24.04lts-005.003.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to enable the `pam_unix` module: \n\n**Note:** If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead\n\n```\n# pam-auth-update --enable unix\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to enable the `pam_unix` module: \n\n**Note:** If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead\n\n```\n# pam-auth-update --enable unix\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5(1)"}]}],"props":[{"name":"label","value":"5.3.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.2.1_Ensure_pam_unix_module_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_unix module is enabled"},{"id":"cisb-ubnt24.04lts-005.003.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pam_faillock.so` module maintains a list of failed authentication attempts per user during a specified interval and locks the account in case there were more than the configured number of consecutive failed authentications (this is defined by the `deny` parameter in the faillock configuration). It stores the failure records into per\\-user files in the tally directory."},{"id":"cisb-ubnt24.04lts-005.003.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."},{"id":"cisb-ubnt24.04lts-005.003.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create two pam\\-auth\\-update profiles in `/usr/share/pam-configs/`: \n\n1. Create the `faillock` profile in `/usr/share/pam-configs/` with the following lines:\n\n*Example Script:* \n\n1. Create the `faillock_notify` profile in `/usr/share/pam-configs/` with the following lines:\n\n*Example Script:* \n\nRun the following command to update the `common-auth` and `common-account` PAM files with the new profiles: \n\n*Example:* \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead\n\n```\n# pam-auth-update --enable faillock\n# pam-auth-update --enable faillock_notify\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock_notify\n}\n```\n\n```\nName: Notify of failed login attempts and reset count upon success\nDefault: yes\nPriority: 1024\nAuth-Type: Primary\nAuth:\n requisite pam_faillock.so preauth\nAccount-Type: Primary\nAccount:\n required pam_faillock.so\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock\n}\n```\n\n```\nName: Enable pam_faillock to deny access\nDefault: yes\nPriority: 0\nAuth-Type: Primary\nAuth:\n [default=die] pam_faillock.so authfail\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create two pam\\-auth\\-update profiles in `/usr/share/pam-configs/`: \n\n1. Create the `faillock` profile in `/usr/share/pam-configs/` with the following lines:\n\n*Example Script:* \n\n1. Create the `faillock_notify` profile in `/usr/share/pam-configs/` with the following lines:\n\n*Example Script:* \n\nRun the following command to update the `common-auth` and `common-account` PAM files with the new profiles: \n\n*Example:* \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_faillock` module, enable that module instead\n\n```\n# pam-auth-update --enable faillock\n# pam-auth-update --enable faillock_notify\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Notify of failed login attempts and reset count upon success' 'Default: yes' 'Priority: 1024' 'Auth-Type: Primary' 'Auth:' ' requisite pam_faillock.so preauth' 'Account-Type: Primary' 'Account:' ' required pam_faillock.so')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock_notify\n}\n```\n\n```\nName: Notify of failed login attempts and reset count upon success\nDefault: yes\nPriority: 1024\nAuth-Type: Primary\nAuth:\n requisite pam_faillock.so preauth\nAccount-Type: Primary\nAccount:\n required pam_faillock.so\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Enable pam_faillock to deny access' 'Default: yes' 'Priority: 0' 'Auth-Type: Primary' 'Auth:' ' [default=die] pam_faillock.so authfail')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/faillock\n}\n```\n\n```\nName: Enable pam_faillock to deny access\nDefault: yes\nPriority: 0\nAuth-Type: Primary\nAuth:\n [default=die] pam_faillock.so authfail\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#730f8d10-e772-4c7d-b2cf-8a730890b5e8"},{"rel":"reference","href":"#c5c18b06-cb1f-4be4-b612-b50ea3fdf080"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.2.2_Ensure_pam_faillock_module_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_faillock module is enabled"},{"id":"cisb-ubnt24.04lts-005.003.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pam_pwquality.so` module performs password quality checking. This module can be plugged into the password stack of a given service to provide strength\\-checking for passwords. The code was originally based on pam\\_cracklib module and the module is backwards compatible with its options.\n\nThe action of this module is to prompt the user for a password and check its strength against a system dictionary and a set of rules for identifying poor choices.\n\nThe first action is to prompt for a single password, check its strength and then, if it is considered strong, prompt for the password a second time (to verify that it was typed correctly on the first occasion). All being well, the password is passed on to subsequent modules to be installed as the new authentication token."},{"id":"cisb-ubnt24.04lts-005.003.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a unique, complex passwords helps to increase the time and resources required to compromise the password."},{"id":"cisb-ubnt24.04lts-005.003.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile: \n\nOutput should be similar to: \n\n**\\- IF \\-** similar output is returned: \n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile: \n\n*Example:* \n\n**\\- IF \\-** similar output is **NOT** returned: \n\nCreate a pam\\-auth\\-update profile in `/usr/share/pam-configs/` with the following lines: \n\n*Example:* \n\nRun the following command to update `/etc/pam.d/common-password` with the `pwquality` profile: \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwquality` module, enable that module instead\n\n```\n# pam-auth-update --enable pwquality\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Pwquality password strength checking' 'Default: yes' 'Priority: 1024' 'Conflicts: cracklib' 'Password-Type: Primary' 'Password:' ' requisite pam_pwquality.so retry=3')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwquality\n}\n```\n\n```\nName: Pwquality password strength checking\nDefault: yes\nPriority: 1024\nConflicts: cracklib\nPassword-Type: Primary\nPassword:\n requisite pam_pwquality.so retry=3\n```\n\n```\n# pam-auth-update pwquality\n```\n\n```\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\n```\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n```\n\n```\n# grep -P -- '\\bpam_pwquality\\.so\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile: \n\nOutput should be similar to: \n\n**\\- IF \\-** similar output is returned: \n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile: \n\n*Example:* \n\n**\\- IF \\-** similar output is **NOT** returned: \n\nCreate a pam\\-auth\\-update profile in `/usr/share/pam-configs/` with the following lines: \n\n*Example:* \n\nRun the following command to update `/etc/pam.d/common-password` with the `pwquality` profile: \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwquality` module, enable that module instead\n\n```\n# pam-auth-update --enable pwquality\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: Pwquality password strength checking' 'Default: yes' 'Priority: 1024' 'Conflicts: cracklib' 'Password-Type: Primary' 'Password:' ' requisite pam_pwquality.so retry=3')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwquality\n}\n```\n\n```\nName: Pwquality password strength checking\nDefault: yes\nPriority: 1024\nConflicts: cracklib\nPassword-Type: Primary\nPassword:\n requisite pam_pwquality.so retry=3\n```\n\n```\n# pam-auth-update pwquality\n```\n\n```\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\n```\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n/usr/share/pam-configs/pwquality: requisite pam_pwquality.so retry=3\n```\n\n```\n# grep -P -- '\\bpam_pwquality\\.so\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.2.3_Ensure_pam_pwquality_module_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_pwquality module is enabled"},{"id":"cisb-ubnt24.04lts-005.003.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pam_pwhistory.so` module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.\n\nThis module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with `NIS` or `LDAP`, since the old passwords are stored on the local machine and are not available on another machine for password history checking."},{"id":"cisb-ubnt24.04lts-005.003.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a unique, complex passwords helps to increase the time and resources required to compromise the password."},{"id":"cisb-ubnt24.04lts-005.003.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile: \n\nOutput should be similar to: \n\n**\\- IF \\-** similar output is returned: \n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile: \n\n*Example:* \n\n**\\- IF \\-** similar output is **NOT** returned: \n\nCreate a `pwhistory` profile in `/usr/share/pam-configs/` with the following lines: \n\n*Example Script:* \n\nRun the following command to update `/etc/pam.d/common-password` with the `pwhistory` profile: \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwhistory` module, enable that module instead\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: pwhistory password history checking' 'Default: yes' 'Priority: 1024' 'Password-Type: Primary' 'Password:' ' requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwhistory\n}\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\n```\n# pam-auth-update pwhistory\n```\n\n```\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\n```\n/usr/share/pam-configs/pwhistory: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\n```\n# grep -P -- '\\bpam_pwhistory\\.so\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to verify the `pam_pwquality.so` line exists in a `pam-auth-update` profile: \n\nOutput should be similar to: \n\n**\\- IF \\-** similar output is returned: \n\nRun the following command to update `/etc/pam.d/common-password` with the returned profile: \n\n*Example:* \n\n**\\- IF \\-** similar output is **NOT** returned: \n\nCreate a `pwhistory` profile in `/usr/share/pam-configs/` with the following lines: \n\n*Example Script:* \n\nRun the following command to update `/etc/pam.d/common-password` with the `pwhistory` profile: \n\n**Note:** \n\n- The name used for the file must be used in the `pam-auth-update --enable` command\n- The `Name:` line should be easily recognizable and understood\n- The `Priority:` Line is important as it effects the order of the lines in the `/etc/pam.d/` files\n- If a site specific custom profile is being used in your environment to configure PAM that includes the configuration for the `pam_pwhistory` module, enable that module instead\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n#!/usr/bin/env bash\n\n{\n arr=('Name: pwhistory password history checking' 'Default: yes' 'Priority: 1024' 'Password-Type: Primary' 'Password:' ' requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok')\n printf '%s\\n' \"${arr[@]}\" > /usr/share/pam-configs/pwhistory\n}\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\n```\n# pam-auth-update pwhistory\n```\n\n```\n# pam-auth-update --enable {PROFILE_NAME}\n```\n\n```\n/usr/share/pam-configs/pwhistory: requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok\n```\n\n```\n# grep -P -- '\\bpam_pwhistory\\.so\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.2.4_Ensure_pam_pwhistory_module_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_pwhistory module is enabled"}]},{"id":"cisb-ubnt24.04lts-005.003.003_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.003_ovrvw","name":"overview","prose":"Pluggable Authentication Modules (PAM) uses arguments to pass information to a pluggable module during authentication for a particular module type. These arguments allow the PAM configuration files for particular programs to use a common PAM module but in different ways.\n\nInvalid arguments are ignored and do not otherwise affect the success or failure of the PAM module. When an invalid argument is passed, an error is usually written to `/var/log/messages` file. However, since the reporting method is controlled by the PAM module, the module must be written correctly to log the error to this file.\n\n**Note:** If custom PAM files are being used, for this section's remediation, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped"}],"props":[{"name":"label","value":"5.3.3"}],"title":"Configure PAM Arguments","groups":[{"id":"cisb-ubnt24.04lts-005.003.003.001_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.003.001_ovrvw","name":"overview","prose":"`pam_faillock.so` provides a way to configure the default settings for locking the user after multiple failed authentication attempts.\n\nOptions:\n\n- `` \\- The directory where the user files with the failure records are kept. The default is /var/run/faillock. Note: These files will disappear after reboot on systems configured with directory /var/run/faillock mounted on virtual memory.\n- `audit` \\- Will log the user name into the system log if the user is not found.\n- `silent` \\- Don't print informative messages to the user. Please note that when this option is not used there will be difference in the authentication behavior for users which exist on the system and non\\-existing users.\n- `no_log_info` \\- Don't log informative messages via syslog(3).\n- `local_users_only` \\- Only track failed user authentications attempts for local users in /etc/passwd and ignore centralized (AD, IdM, LDAP, etc.) users. The faillock(8) command will also no longer track user failed authentication attempts. Enabling this option will prevent a double\\-lockout scenario where a user is locked out locally and in the centralized mechanism.\n- `nodelay` \\- Don't enforce a delay after authentication failures.\n- `deny=` \\- Deny access if the number of consecutive authentication failures for this user during the recent interval exceeds **. The default is 3.\n- `fail_interval=n` \\- The length of the interval during which the consecutive authentication failures must happen for the user account lock out is n seconds. The default is 900 (15 minutes).\n- `unlock_time=n` \\- The access will be re\\-enabled after n seconds after the lock out. The value 0 has the same meaning as value never \\- the access will not be re\\-enabled without resetting the faillock entries by the faillock(8) command. The default is 600 (10 minutes). Note that the default directory that pam\\_faillock uses is usually cleared on system boot so the access will be also re\\-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option. Also note that it is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers.\n- `even_deny_root` \\- Root account can become locked as well as regular accounts.\n- `root_unlock_time=n` \\- This option implies even\\_deny\\_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock\\_time option.\n- `admin_group=name` \\- If a group name is specified with this option, members of the group will be handled by this module the same as the root account (the options even\\_deny\\_root and root\\_unlock\\_time will apply to them. By default the option is not set."}],"props":[{"name":"label","value":"5.3.3.1"}],"title":"Configure pam_faillock module","controls":[{"id":"cisb-ubnt24.04lts-005.003.003.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `deny=` option will deny access if the number of consecutive authentication failures for this user during the recent interval exceeds **."},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Locking out user IDs after *n* unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create or edit the following line in `/etc/security/faillock.conf` setting the `deny` option to `5` or less: \n\nRun the following command: \n\nEdit any returned files and remove the `deny=` arguments from the `pam_faillock.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?deny\\b' /usr/share/pam-configs/*\n```\n\n```\ndeny = 5\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create or edit the following line in `/etc/security/faillock.conf` setting the `deny` option to `5` or less: \n\nRun the following command: \n\nEdit any returned files and remove the `deny=` arguments from the `pam_faillock.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?deny\\b' /usr/share/pam-configs/*\n```\n\n```\ndeny = 5\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#730f8d10-e772-4c7d-b2cf-8a730890b5e8"},{"rel":"reference","href":"#c5c18b06-cb1f-4be4-b612-b50ea3fdf080"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.3.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.1_Ensure_password_failed_attempts_lockout_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password failed attempts lockout is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`unlock_time=` \\- The access will be re\\-enabled after ** seconds after the lock out. The value `0` has the same meaning as value never \\- the access will not be re\\-enabled without resetting the faillock entries by the faillock(8) command.\n\n**Note:**\n\n- The default directory that pam\\_faillock uses is usually cleared on system boot so the access will be also re\\-enabled after system reboot. If that is undesirable a different tally directory must be set with the dir option.\n- It is usually undesirable to permanently lock out users as they can become easily a target of denial of service attack unless the usernames are random and kept secret to potential attackers.\n- The maximum configurable value for `unlock_time` is `604800`"},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Locking out user IDs after *n* unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set password unlock time to conform to site policy. `unlock_time` should be `0` (never), or `900` seconds or greater. \n\nEdit `/etc/security/faillock.conf` and update or add the following line: \n\nRun the following command: remove the `unlock_time` argument from the `pam_faillock.so` module in the PAM files: \n\nEdit any returned files and remove the `unlock_time=` argument from the `pam_faillock.so` line(s): \n\nImpact: \n\nUse of `unlock_time=0` may allow an attacker to cause denial of service to legitimate users. This will also require a systems administrator with elevated privileges to unlock the account.\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?unlock_time\\b' /usr/share/pam-configs/*\n```\n\n```\nunlock_time = 900\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set password unlock time to conform to site policy. `unlock_time` should be `0` (never), or `900` seconds or greater. \n\nEdit `/etc/security/faillock.conf` and update or add the following line: \n\nRun the following command: remove the `unlock_time` argument from the `pam_faillock.so` module in the PAM files: \n\nEdit any returned files and remove the `unlock_time=` argument from the `pam_faillock.so` line(s): \n\nImpact: \n\nUse of `unlock_time=0` may allow an attacker to cause denial of service to legitimate users. This will also require a systems administrator with elevated privileges to unlock the account.\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?unlock_time\\b' /usr/share/pam-configs/*\n```\n\n```\nunlock_time = 900\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#730f8d10-e772-4c7d-b2cf-8a730890b5e8"},{"rel":"reference","href":"#c5c18b06-cb1f-4be4-b612-b50ea3fdf080"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.3.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.2_Ensure_password_unlock_time_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password unlock time is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`even_deny_root` \\- Root account can become locked as well as regular accounts\n\n`root_unlock_time=n` \\- This option implies even\\_deny\\_root option. Allow access after n seconds to root account after the account is locked. In case the option is not specified the value is the same as of the unlock\\_time option."},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Locking out user IDs after n unsuccessful consecutive login attempts mitigates brute force password attacks against your systems."},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/security/faillock.conf`: \n\n- Remove or update any line containing `root_unlock_time`, **\\- OR \\-** set it to a value of `60` or more\n- Update or add the following line:\n\nRun the following command: \n\nEdit any returned files and remove the `even_deny_root` and `root_unlock_time` arguments from the `pam_faillock.so` line(s): \n\nImpact: \n\nUse of `unlock_time=0` or `root_unlock_time=0` may allow an attacker to cause denial of service to legitimate users.\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?(even_deny_root|root_unlock_time)' /usr/share/pam-configs/*\n```\n\n```\neven_deny_root\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/security/faillock.conf`: \n\n- Remove or update any line containing `root_unlock_time`, **\\- OR \\-** set it to a value of `60` or more\n- Update or add the following line:\n\nRun the following command: \n\nEdit any returned files and remove the `even_deny_root` and `root_unlock_time` arguments from the `pam_faillock.so` line(s): \n\nImpact: \n\nUse of `unlock_time=0` or `root_unlock_time=0` may allow an attacker to cause denial of service to legitimate users.\n\n```\n# grep -Pl -- '\\bpam_faillock\\.so\\h+([^#\\n\\r]+\\h+)?(even_deny_root|root_unlock_time)' /usr/share/pam-configs/*\n```\n\n```\neven_deny_root\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#730f8d10-e772-4c7d-b2cf-8a730890b5e8"},{"rel":"reference","href":"#c5c18b06-cb1f-4be4-b612-b50ea3fdf080"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.3.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.1.3_Ensure_password_failed_attempts_lockout_includes_root_account"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password failed attempts lockout includes root account"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002_ovrvw","name":"overview","prose":"The `pam_pwquality.so` module checks the strength of passwords. It performs checks such as making sure a password is not a dictionary word, it is a certain length, contains a mix of characters (e.g. alphabet, numeric, other) and more.\n\nThese checks are configurable by either:\n\n- use of the module arguments\n- modifying the `/etc/security/pwquality.conf` configuration file\n- creating a `.conf` file in the `/etc/security/pwquality.conf.d/` directory.\n\n**Note:** The module arguments override the settings in the `/etc/security/pwquality.conf` configuration file. Settings in the `/etc/security/pwquality.conf` configuration file override settings in a `.conf` file in the `/etc/security/pwquality.conf.d/` directory.\n\nThe possible options in the file are:\n\n- `difok` \\- Number of characters in the new password that must not be present in the old password. (default 1). The special value of 0 disables all checks of similarity of the new password with the old password except the new password being exactly the same as the old one.\n- `minlen` \\- Minimum acceptable size for the new password (plus one if credits are not disabled which is the default). (See pam\\_pwquality(8).) Cannot be set to lower value than 6. (default 8)\n- `dcredit` \\- The maximum credit for having digits in the new password. If less than 0 it is the minimum number of digits in the new password. (default 0)\n- `ucredit` \\- The maximum credit for having uppercase characters in the new password. If less than 0 it is the minimum number of uppercase characters in the new password. (default 0)\n- `lcredit` \\- The maximum credit for having lowercase characters in the new password. If less than 0 it is the minimum number of lowercase characters in the new password. (default 0)\n- `ocredit` \\- The maximum credit for having other characters in the new password. If less than 0 it is the minimum number of other characters in the new password. (default 0)\n- `minclass` \\- The minimum number of required classes of characters for the new password (digits, uppercase, lowercase, others). (default 0)\n- `maxrepeat` \\- The maximum number of allowed same consecutive characters in the new password. The check is disabled if the value is 0. (default 0)\n- `maxsequence` \\- The maximum length of monotonic character sequences in the new password. Examples of such sequence are '12345' or 'fedcb'. Note that most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password. The check is disabled if the value is 0. (default 0)\n- `maxclassrepeat` \\- The maximum number of allowed consecutive characters of the same class in the new password. The check is disabled if the value is 0. (default 0)\n- `gecoscheck` \\- If nonzero, check whether the words longer than 3 characters from the GECOS field of the user's passwd(5) entry are contained in the new password. The check is disabled if the value is 0. (default 0)\n- `dictcheck` \\- If nonzero, check whether the password (with possible modifications) matches a word in a dictionary. Currently the dictionary check is performed\nusing the cracklib library. (default 1)\n- `usercheck=` \\- If nonzero, check whether the password (with possible modifications) contains the user name in some form. It is not performed for user names\nshorter than 3 characters. (default 1)\n- `usersubstr=` \\- If greater than 3 (due to the minimum length in usercheck), check whether the password contains a substring of at least N length in some form.\n(default 0)\n- `enforcing=` \\- If nonzero, reject the password if it fails the checks, otherwise only print the warning. This setting applies only to the pam\\_pwquality module\nand possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1). (default 1)\n- `badwords` \\- Space separated list of words that must not be contained in the password. These are additional words to the cracklib dictionary check. This setting can be also used by applications to emulate the gecos check for user accounts that are not created yet.\n- `dictpath` \\- Path to the cracklib dictionaries. Default is to use the cracklib default.\n- `retry=` \\- Prompt user at most N times before returning with error. The default is 1.\n- `enforce_for_root` \\- The module will return error on failed check even if the user changing the password is root. This option is off by default which means that just the message about the failed check is printed but root can change the password anyway. Note that root is not asked for an old password so the checks that compare the old and new password are not performed.\n- `local_users_only` \\- The module will not test the password quality for users that are not present in the /etc/passwd file. The module still asks for the password so the following modules in the stack can use the use\\_authtok option. This option is off by default."}],"props":[{"name":"label","value":"5.3.3.2"}],"title":"Configure pam_pwquality module","controls":[{"id":"cisb-ubnt24.04lts-005.003.003.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pwquality` `difok` option sets the number of characters in a password that must not be present in the old password."},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute\\-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `difok` to `2` or more. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `difok` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?difok\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*difok\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"difok = 2\" > /etc/security/pwquality.conf.d/50-pwdifok.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `difok` to `2` or more. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `difok` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?difok\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*difok\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"difok = 2\" > /etc/security/pwquality.conf.d/50-pwdifok.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.1_Ensure_password_number_of_changed_characters_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password number of changed characters is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The minimum password length setting determines the lowers number of characters that make up a password for a user account. There are many different theories about how to determine the best password length for an organization, but perhaps \"passphrase\" is a better term than \"password\".\n\nThe `minlen` option sets the minimum acceptable size for the new password (plus one if credits are not disabled which is the default). Cannot be set to lower value than 6."},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords."},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set password length of `14` or more characters. Ensure that password length conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `minlen` argument from the `pam_pwquality.so` line(s): \n\nImpact: \n\nIn general, it is true that longer passwords are better (harder to crack), but it is also true that forced password length requirements can cause user behavior that is predictable and undesirable. For example, requiring users to have a minimum 16\\-character password may cause them to choose repeating patterns like fourfourfourfour or passwordpassword that meet the requirement but aren’t hard to guess. Additionally, length requirements increase the chances that users will adopt other insecure practices, like writing them down, re\\-using them or storing them unencrypted in their documents. \n\nHaving a reasonable minimum length with no maximum character limit increases the resulting\naverage password length used (and therefore the strength).6\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?minlen\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minlen\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minlen = 14\" > /etc/security/pwquality.conf.d/50-pwlength.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set password length of `14` or more characters. Ensure that password length conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `minlen` argument from the `pam_pwquality.so` line(s): \n\nImpact: \n\nIn general, it is true that longer passwords are better (harder to crack), but it is also true that forced password length requirements can cause user behavior that is predictable and undesirable. For example, requiring users to have a minimum 16\\-character password may cause them to choose repeating patterns like fourfourfourfour or passwordpassword that meet the requirement but aren’t hard to guess. Additionally, length requirements increase the chances that users will adopt other insecure practices, like writing them down, re\\-using them or storing them unencrypted in their documents. \n\nHaving a reasonable minimum length with no maximum character limit increases the resulting\naverage password length used (and therefore the strength).6\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?minlen\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minlen\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minlen = 14\" > /etc/security/pwquality.conf.d/50-pwlength.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5(1)"},{"name":"marking","class":"Reference","value":"CIS Password Policy Guide"},{"name":"marking","class":"Reference","value":"pam_pwquality(8)"}]}],"props":[{"name":"label","value":"5.3.3.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.2_Ensure_minimum_password_length_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure minimum password length is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Password complexity can be set through:\n\n- `minclass` \\- The minimum number of classes of characters required in a new password. (digits, uppercase, lowercase, others). e.g. `minclass = 4` requires digits, uppercase, lower case, and special characters.\n- `dcredit` \\- The maximum credit for having digits in the new password. If less than `0` it is the minimum number of digits in the new password. e.g. `dcredit = -1` requires at least one digit\n- `ucredit` \\- The maximum credit for having uppercase characters in the new password. If less than `0` it is the minimum number of uppercase characters in the new password. e.g. `ucredit = -1` requires at least one uppercase character\n- `ocredit` \\- The maximum credit for having other characters in the new password. If less than `0` it is the minimum number of other characters in the new password. e.g. `ocredit = -1` requires at least one special character\n- `lcredit` \\- The maximum credit for having lowercase characters in the new password. If less than `0` it is the minimum number of lowercase characters in the new password. e.g. `lcredit = -1` requires at least one lowercase character"},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Strong passwords protect systems from being hacked through brute force methods.\n\nRequiring at least one non\\-alphabetic character increases the search space beyond pure dictionary words, which makes the resulting password harder to crack.\n\nForcing users to choose an excessively complex password, e.g. some combination of upper\\-case, lower\\-case, numbers, and special characters, has a negative impact. It places an extra burden on users and many will use predictable patterns (for example, a capital letter in the first position, followed by lowercase letters, then one or two numbers, and a “special character” at the end). Attackers know this, so dictionary attacks will often contain these common patterns and use the most common substitutions like, $ for s, @ for a, 1 for l, 0 for o."},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and remove the `minclass`, `dcredit`, `ucredit`, `lcredit`, and `ocredit` arguments from the `pam_pwquality.so` line(s) \n\nCreate or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line(s) to set complexity according to local site policy: \n\n- `minclass = _N_`\n- `dcredit = _N_` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ucredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ocredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `lcredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n\n*Example 1 \\- Set `minclass = 3`:* \n\n*Example 2 \\- set `dcredit = -1`, `ucredit = -1`, and `lcredit = -1`:* \n\nImpact: \n\nPasswords that are too complex in nature make it harder for users to remember, leading to bad practices. In addition, composition requirements provide no defense against common attack types such as social engineering or insecure storage of passwords\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '%s\\n' \"dcredit = -1\" \"ucredit = -1\" \"lcredit = -1\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minclass = 3\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?(minclass|[dulo]credit)\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and remove the `minclass`, `dcredit`, `ucredit`, `lcredit`, and `ocredit` arguments from the `pam_pwquality.so` line(s) \n\nCreate or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line(s) to set complexity according to local site policy: \n\n- `minclass = _N_`\n- `dcredit = _N_` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ucredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `ocredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n- `lcredit = -1` \\# Value should be either `0` or a number proceeded by a minus (`-`) symbol\n\n*Example 1 \\- Set `minclass = 3`:* \n\n*Example 2 \\- set `dcredit = -1`, `ucredit = -1`, and `lcredit = -1`:* \n\nImpact: \n\nPasswords that are too complex in nature make it harder for users to remember, leading to bad practices. In addition, composition requirements provide no defense against common attack types such as social engineering or insecure storage of passwords\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '%s\\n' \"dcredit = -1\" \"ucredit = -1\" \"lcredit = -1\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*minclass\\s*=/# &/' /etc/security/pwquality.conf\n sed -ri 's/^\\s*[dulo]credit\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"minclass = 3\" > /etc/security/pwquality.conf.d/50-pwcomplexity.conf\n}\n```\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?(minclass|[dulo]credit)\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.003_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#85a64565-1750-4c8b-a048-d250eb673bad"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"},{"name":"marking","class":"Reference","value":"PWQUALITY.CONF(5)"},{"name":"marking","class":"Reference","value":"pam_pwquality(8)"}]}],"props":[{"name":"label","value":"5.3.3.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.3_Ensure_password_complexity_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure password complexity is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pwquality` `maxrepeat` option sets the maximum number of allowed same consecutive characters in a new password."},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute\\-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxrepeat` to `3` or less and not `0`. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `maxrepeat` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxrepeat\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxrepeat\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxrepeat = 3\" > /etc/security/pwquality.conf.d/50-pwrepeat.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxrepeat` to `3` or less and not `0`. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `maxrepeat` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxrepeat\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxrepeat\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxrepeat = 3\" > /etc/security/pwquality.conf.d/50-pwrepeat.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.4_Ensure_password_same_consecutive_characters_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password same consecutive characters is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pwquality` `maxsequence` option sets the maximum length of monotonic character sequences in the new password. Examples of such sequence are `12345` or `fedcb`. The check is disabled if the value is `0`.\n\n**Note:** Most such passwords will not pass the simplicity check unless the sequence is only a minor part of the password."},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute\\-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxsequence` to `3` or less and not `0`. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `maxsequence` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxsequence\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxsequence\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxsequence = 3\" > /etc/security/pwquality.conf.d/50-pwmaxsequence.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Create or modify a file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory or the file `/etc/security/pwquality.conf` and add or modify the following line to set `maxsequence` to `3` or less and not `0`. Ensure setting conforms to local site policy: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `maxsequence` argument from the `pam_pwquality.so` line(s):\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?maxsequence\\b' /usr/share/pam-configs/*\n```\n\n```\n#!/usr/bin/env bash\n\n{\n sed -ri 's/^\\s*maxsequence\\s*=/# &/' /etc/security/pwquality.conf\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s' \"maxsequence = 3\" > /etc/security/pwquality.conf.d/50-pwmaxsequence.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.5_Ensure_password_maximum_sequential_characters_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password maximum sequential characters is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pwquality` `dictcheck` option sets whether to check for the words from the `cracklib` dictionary."},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the operating system allows the user to select passwords based on dictionary words, this increases the chances of password compromise by increasing the opportunity for successful guesses, and brute\\-force attacks."},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit any file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and/or the file `/etc/security/pwquality.conf` and comment out or remove any instance of `dictcheck = 0`: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `dictcheck` argument from the `pam_pwquality.so` line(s)\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?dictcheck\\b' /usr/share/pam-configs/*\n```\n\n```\n# sed -ri 's/^\\s*dictcheck\\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit any file ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and/or the file `/etc/security/pwquality.conf` and comment out or remove any instance of `dictcheck = 0`: \n\n*Example:* \n\nRun the following command: \n\nEdit any returned files and remove the `dictcheck` argument from the `pam_pwquality.so` line(s)\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?dictcheck\\b' /usr/share/pam-configs/*\n```\n\n```\n# sed -ri 's/^\\s*dictcheck\\s*=/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.6_Ensure_password_dictionary_check_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password dictionary check is enabled"},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `pam_pwquality` module can be configured to either reject a password if it fails the checks, or only print a warning.\n\nThis is configured by setting the `enforcing=` argument. If nonzero, a password will be rejected if it fails the checks, otherwise only a warning message will be provided.\n\nThis setting applies only to the pam\\_pwquality module and possibly other applications that explicitly change their behavior based on it. It does not affect pwmake(1) and pwscore(1)."},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Strong passwords help protect systems from password attacks. Types of password attacks include dictionary attacks, which attempt to use common words and phrases, and brute force attacks, which try every possible combination of characters. Also attackers may try to obtain the account database so they can use tools to discover the accounts and passwords."},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and remove the `enforcing=0` argument from the `pam_pwquality.so` line(s) \n\nEdit `/etc/security/pwquality.conf` and all files ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and remove or comment out any line containing the `enforcing = 0` argument: \n\n*Example:*\n\n```\n# sed -ri 's/^\\s*enforcing\\s*=\\s*0/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?enforcing=0\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and remove the `enforcing=0` argument from the `pam_pwquality.so` line(s) \n\nEdit `/etc/security/pwquality.conf` and all files ending in `.conf` in the `/etc/security/pwquality.conf.d/` directory and remove or comment out any line containing the `enforcing = 0` argument: \n\n*Example:*\n\n```\n# sed -ri 's/^\\s*enforcing\\s*=\\s*0/# &/' /etc/security/pwquality.conf /etc/security/pwquality.conf.d/*.conf\n```\n\n```\n# grep -Pl -- '\\bpam_pwquality\\.so\\h+([^#\\n\\r]+\\h+)?enforcing=0\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"},{"name":"marking","class":"Reference","value":"PWQUALITY.CONF(5)"},{"name":"marking","class":"Reference","value":"pam_pwquality(8)"}]}],"props":[{"name":"label","value":"5.3.3.2.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.7_Ensure_password_quality_checking_is_enforced"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password quality checking is enforced"},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.002.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"If the `pwquality` `enforce_for_root` option is enabled, the module will return error on failed check even if the user changing the password is root.\n\nThis option is off by default which means that just the message about the failed check is printed but root can change the password anyway.\n\n**Note:** The root is not asked for an old password so the checks that compare the old and new password are not performed."},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute\\-force attacks.\n\nPassword complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised."},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or add the following line in a `*.conf` file in `/etc/security/pwquality.conf.d` or in `/etc/security/pwquality.conf`: \n\n*Example:*\n\n```\n#!/urs/bin/env bash\n\n{\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s\\n' \"enforce_for_root\" > /etc/security/pwquality.conf.d/50-pwroot.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or add the following line in a `*.conf` file in `/etc/security/pwquality.conf.d` or in `/etc/security/pwquality.conf`: \n\n*Example:*\n\n```\n#!/urs/bin/env bash\n\n{\n [ ! -d /etc/security/pwquality.conf.d/ ] && mkdir /etc/security/pwquality.conf.d/\n printf '\\n%s\\n' \"enforce_for_root\" > /etc/security/pwquality.conf.d/50-pwroot.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.002.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.2.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.2.8_Ensure_password_quality_is_enforced_for_the_root_user"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password quality is enforced for the root user"}]},{"id":"cisb-ubnt24.04lts-005.003.003.003_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.003.003_ovrvw","name":"overview","prose":"`pam_pwhistory` \\- PAM module to remember last passwords\n\n`pam_history.so` module \\- This module saves the last passwords for each user in order to force password change history and keep the user from alternating between the same password too frequently.\n\nThis module does not work together with kerberos. In general, it does not make much sense to use this module in conjunction with `NIS` or `LDAP`, since the old passwords are stored on the local machine and are not available on another machine for password history checking.\n\nOptions:\n\n- `debug` \\- Turns on debugging via syslog(3).\n- `use_authtok` \\- When password changing enforce the module to use the new password provided by a previously stacked password module (this is used in the example of the stacking of the `pam_passwdqc module` documented below).\n- `enforce_for_root` \\- If this option is set, the check is enforced for root, too.\n- `remember=` \\- The last ** passwords for each user are saved. The default is `10`. Value of `0` makes the module to keep the existing contents of the opasswd file unchanged.\n- `retry=` \\- Prompt user at most ** times before returning with error. The default is `1`.\n- `authtok_type=` \\- See pam\\_get\\_authtok(3) for more details.\n\n*Examples:*\n\n```\nAn example password section would be:\n\n #%PAM-1.0\n password required pam_pwhistory.so\n password required pam_unix.so use_authtok\n\nIn combination with pam_passwdqc:\n\n #%PAM-1.0\n password required pam_passwdqc.so config=/etc/passwdqc.conf\n password required pam_pwhistory.so use_authtok\n password required pam_unix.so use_authtok\n```"}],"props":[{"name":"label","value":"5.3.3.3"}],"title":"Configure pam_pwhistory module","controls":[{"id":"cisb-ubnt24.04lts-005.003.003.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/security/opasswd` file stores the users' old passwords and can be checked to ensure that users are not recycling recent passwords. The number of passwords remembered is set via the remember argument value in set for the `pam_pwhistory` module.\n\n- remember= \\- `` is the number of old passwords to remember"},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password.\n\n**Note:** These change only apply to accounts configured on the local system."},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and edit or add the `remember=` argument, with a value of `24` or more, that meets local site policy to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes remember=**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and edit or add the `remember=` argument, with a value of `24` or more, that meets local site policy to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes remember=**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5(1)"}]}],"props":[{"name":"label","value":"5.3.3.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.1_Ensure_password_history_remember_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password history remember is configured"},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"If the `pwhistory` `enforce_for_root` option is enabled, the module will enforce password history for the root user as well"},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password\n\n**Note:** These change only apply to accounts configured on the local system."},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and add the `enforce_for_root` argument to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes enforce_for_root**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and add the `enforce_for_root` argument to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes enforce_for_root**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.2_Ensure_password_history_is_enforced_for_the_root_user"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password history is enforced for the root user"},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`use_authtok` \\- When password changing enforce the module to set the new password to the one provided by a previously stacked password module"},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`use_authtok` allows multiple pam modules to confirm a new password before it is accepted."},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and add the `use_authtok` argument to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes use_authtok**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and add the `use_authtok` argument to the `pam_pwhistory` line in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable pwhistory\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: pwhistory password history checking\nDefault: yes\nPriority: 1024\nPassword-Type: Primary\nPassword:\n requisite pam_pwhistory.so remember=24 enforce_for_root try_first_pass use_authtok # <- **ensure line includes use_authtok**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_pwhistory\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#446a0b78-3e00-4ef4-97b1-8081d2891ae7"},{"rel":"reference","href":"#d3620a46-f77d-4ee8-8713-ee9895a9aa39"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.3.3_Ensure_pam_pwhistory_includes_use_authtok"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_pwhistory includes use_authtok"}]},{"id":"cisb-ubnt24.04lts-005.003.003.004_grp","parts":[{"id":"cisb-ubnt24.04lts-005.003.003.004_ovrvw","name":"overview","prose":"The `pam_unix.so` module is the standard Unix authentication module. It uses standard calls from the system's libraries to retrieve and set account information as well as authentication. Usually this is obtained from the `/etc/passwd` and the `/etc/shadow` file as well if shadow is enabled."}],"props":[{"name":"label","value":"5.3.3.4"}],"title":"Configure pam_unix module","controls":[{"id":"cisb-ubnt24.04lts-005.003.003.004.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.004.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `nullok` argument overrides the default action of `pam_unix.so` to not permit the user access to a service if their official password is blank."},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Using a strong password is essential to helping protect personal and sensitive information from unauthorized access"},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any files returned and remove the `nullok` argument for the `pam_unix` lines \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:* \n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass # <- **ensure line does not include nullok nullok**\nAuth-Initial:\n [success=end default=ignore] pam_unix.so # <- **ensure line does not include nullok nullok**\nAccount-Type: Primary\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt\n```\n\n```\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?nullok\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any files returned and remove the `nullok` argument for the `pam_unix` lines \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:* \n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass # <- **ensure line does not include nullok nullok**\nAuth-Initial:\n [success=end default=ignore] pam_unix.so # <- **ensure line does not include nullok nullok**\nAccount-Type: Primary\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt\n```\n\n```\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?nullok\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.004.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.3.4.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.1_Ensure_pam_unix_does_not_include_nullok"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_unix does not include nullok"},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.004.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `remember=n` argument saves the last n passwords for each user in `/etc/security/opasswd` in order to force password change history and keep the user from alternating between the same password too frequently. The MD5 password hash algorithm is used for storing the old passwords. Instead of this option the `pam_pwhistory` module should be used. The `pam_pwhistory` module saves the last n passwords for each user in `/etc/security/opasswd` using the password hash algorithm set on the `pam_unix` module. This allows for the `yescrypt` or `sha512` hash algorithm to be used."},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `remember=n` argument should be removed to ensure a strong password hashing algorithm is being used. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user's old passwords stored in `/etc/security/opasswd`."},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any files returned and remove the `remember=__` argument for the `pam_unix` lines \n\n*Example output:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:* \n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\n[success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5 # **<- remove remember=**\n[success=end default=ignore] pam_unix.so obscure yescrypt remember=5 # **<- remove remember=**\n\n```\n\n```\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?remember\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any files returned and remove the `remember=__` argument for the `pam_unix` lines \n\n*Example output:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:* \n\n**Note:** If custom files are being used, the corresponding files in `/etc/pam.d/` would need to be edited directly, and the `pam-auth-update --enable ` command skipped\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\n[success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5 # **<- remove remember=**\n[success=end default=ignore] pam_unix.so obscure yescrypt remember=5 # **<- remove remember=**\n\n```\n\n```\n# grep -PH -- '^\\h*([^#\\n\\r]+\\h+)?pam_unix\\.so\\h+([^#\\n\\r]+\\h+)?remember\\b' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.004.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.3.3.4.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.2_Ensure_pam_unix_does_not_include_remember"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_unix does not include remember"},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.004.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A cryptographic hash function converts an arbitrary\\-length input into a fixed length output. Password hashing performs a one\\-way transformation of a password, turning the password into another string, called the hashed password.\n\nThe `pam_unix` module can be configured to use one of the following hashing algorithms for user's passwords:\n\n- `md5` \\- When a user changes their password next, encrypt it with the `MD5` algorithm.\n- `bigcrypt` \\- When a user changes their password next, encrypt it with the `DEC C2` algorithm.\n- `sha256` \\- When a user changes their password next, encrypt it with the `SHA256` algorithm. The `SHA256` algorithm must be supported by the crypt(3) function.\n- `sha512` \\- When a user changes their password next, encrypt it with the `SHA512` algorithm. The `SHA512` algorithm must be supported by the crypt(3) function.\n- `blowfish` \\- When a user changes their password next, encrypt it with the `blowfish` algorithm. The `blowfish` algorithm must be supported by the crypt(3) function.\n- `gost_yescrypt` \\- When a user changes their password next, encrypt it with the `gost-yescrypt` algorithm. The `gost-yescrypt` algorithm must be supported by the crypt(3) function.\n- `yescrypt` \\- When a user changes their password next, encrypt it with the `yescrypt` algorithm. The `yescrypt` algorithm must be supported by the crypt(3) function."},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `SHA-512` and `yescrypt` algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local user passwords.\n\n**Note:** These changes only apply to the local system."},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files and edit or add a strong hashing algorithm, either sha512 or yescrypt, that meets local site policy to the `pam_unix` lines in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files and edit or add a strong hashing algorithm, either sha512 or yescrypt, that meets local site policy to the `pam_unix` lines in the `Password` section: \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **ensure hashing algorithm is either sha512 or yescrypt**\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#446a0b78-3e00-4ef4-97b1-8081d2891ae7"},{"rel":"reference","href":"#d3620a46-f77d-4ee8-8713-ee9895a9aa39"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.004.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.4.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.3_Ensure_pam_unix_includes_a_strong_password_hashing_algorithm"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_unix includes a strong password hashing algorithm"},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.003.003.004.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`use_authtok` \\- When password changing enforce the module to set the new password to the one provided by a previously stacked password module"},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`use_authtok` allows multiple pam modules to confirm a new password before it is accepted."},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command: \n\nEdit any returned files add `use_authtok` to the `pam_unix` line in the `Password` section under `Password:` subsection: \n\n**Note:** The if the file's `Password` section includes a `Password-Initial:` subsection, `use_authtok` should not be added to the `pam_unix` line in the `Password-Initial:` subsection \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure line includes use_authtok**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **Password-Initial: subsection does not include use_authtok\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command: \n\nEdit any returned files add `use_authtok` to the `pam_unix` line in the `Password` section under `Password:` subsection: \n\n**Note:** The if the file's `Password` section includes a `Password-Initial:` subsection, `use_authtok` should not be added to the `pam_unix` line in the `Password-Initial:` subsection \n\n*Example File:* \n\nRun the following command to update the files in the `/etc/pam.d/` directory: \n\n*Example:*\n\n```\n# pam-auth-update --enable unix\n```\n\n```\n# pam-auth-update --enable\n```\n\n```\nName: Unix authentication\nDefault: yes\nPriority: 256\nAuth-Type: Primary # <- Start of \"Auth\" section\nAuth:\n [success=end default=ignore] pam_unix.so try_first_pass\nAuth-Initial:\n [success=end default=ignore] pam_unix.so\nAccount-Type: Primary # <- Start of \"Account\" section\nAccount:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nAccount-Initial:\n [success=end new_authtok_reqd=done default=ignore] pam_unix.so\nSession-Type: Additional # <- Start of \"Session\" section\nSession:\n required pam_unix.so\nSession-Initial:\n required pam_unix.so\nPassword-Type: Primary # <- Start of \"Password\" section\nPassword:\n [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt # <- **ensure line includes use_authtok**\nPassword-Initial:\n [success=end default=ignore] pam_unix.so obscure yescrypt # <- **Password-Initial: subsection does not include use_authtok\n```\n\n```\n# awk '/Password-Type:/{ f = 1;next } /-Type:/{ f = 0 } f {if (/pam_unix\\.so/) print FILENAME}' /usr/share/pam-configs/*\n```"},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#446a0b78-3e00-4ef4-97b1-8081d2891ae7"},{"rel":"reference","href":"#d3620a46-f77d-4ee8-8713-ee9895a9aa39"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.003.003.004.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.3.3.4.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.3.3.4.4_Ensure_pam_unix_includes_use_authtok"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure pam_unix includes use_authtok"}]}]}]},{"id":"cisb-ubnt24.04lts-005.004_grp","parts":[{"id":"cisb-ubnt24.04lts-005.004_ovrvw","name":"overview","prose":"This section provides guidance on setting up secure defaults for system and user accounts and their environment."}],"props":[{"name":"label","value":"5.4"}],"title":"User Accounts and Environment","groups":[{"id":"cisb-ubnt24.04lts-005.004.001_grp","parts":[{"id":"cisb-ubnt24.04lts-005.004.001_ovrvw","name":"overview","prose":"While a majority of the password control parameters have been moved to PAM, some parameters are still available through the shadow password suite. Any changes made to `/etc/login.defs `will only be applied if the `usermod `command is used. If user IDs are added a different way, use the `chage `command to effect changes to individual user IDs."}],"props":[{"name":"label","value":"5.4.1"}],"title":"Configure shadow password suite parameters","controls":[{"id":"cisb-ubnt24.04lts-005.004.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `PASS_MAX_DAYS` parameter in `/etc/login.defs` allows an administrator to force passwords to expire once they reach a defined age.\n\n`PASS_MAX_DAYS` ** \\- The maximum number of days a password may be used. If the password is older than this, a password change will be forced. If not specified, \\-1 will be assumed (which disables the restriction)."},{"id":"cisb-ubnt24.04lts-005.004.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The window of opportunity for an attacker to leverage compromised credentials or successfully compromise credentials via an online brute force attack is limited by the age of the password. Therefore, reducing the maximum age of a password also reduces an attacker's window of opportunity.\n\nWe recommend a yearly password change. This is primarily because for all their good intentions users will share credentials across accounts. Therefore, even if a breach is publicly identified, the user may not see this notification, or forget they have an account on that site. This could leave a shared credential vulnerable indefinitely. Having an organizational policy of a 1\\-year (annual) password expiration is a reasonable compromise to mitigate this with minimal user burden."},{"id":"cisb-ubnt24.04lts-005.004.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the `PASS_MAX_DAYS` parameter to conform to site policy in `/etc/login.defs` : \n\nModify user parameters for all users with a password set to match: \n\nEdit `/etc/login.defs` and set `PASS_MAX_DAYS` to a value greater than `0` that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a maximum age no greater than `365` or less than `1` that follows local site policy: \n\n*Example:* \n\n**Warning:** If a password has been set at system install or kickstart, the `last change date` field is not set, In this case, setting `PASS_MAX_DAYS` will immediately expire the password. One possible solution is to populate the `last change date` field through a command like: `chage -d \"$(date +%Y-%m-%d)\" root` \n\nImpact: \n\nThe password expiration must be greater than the minimum days between password changes or users will be unable to change their password. \n\nExcessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous one (incrementing a number used in the password for\nexample). Also, password expiration requirements offer no containment benefits because attackers will often use credentials as soon as they compromise them. Instead, immediate password changes should be based on key events including, but not limited to: \n\n- Indication of compromise\n- Change of user roles\n- When a user leaves the organization.\n\nNot only does changing passwords every few weeks or months frustrate the user, but it’s also been suggested that it does more harm than good, because it could lead to bad practices by the user such as adding a character to the end of their existing password.\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($5 > 365 || $5 < 1)system (\"chage --maxdays 365 \" $1)}' /etc/shadow\n```\n\n```\n# chage --maxdays\n```\n\n```\nPASS_MAX_DAYS 365\n```\n\n```\n# chage --maxdays 365\n```\n\n```\nPASS_MAX_DAYS 365\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the `PASS_MAX_DAYS` parameter to conform to site policy in `/etc/login.defs` : \n\nModify user parameters for all users with a password set to match: \n\nEdit `/etc/login.defs` and set `PASS_MAX_DAYS` to a value greater than `0` that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a maximum age no greater than `365` or less than `1` that follows local site policy: \n\n*Example:* \n\n**Warning:** If a password has been set at system install or kickstart, the `last change date` field is not set, In this case, setting `PASS_MAX_DAYS` will immediately expire the password. One possible solution is to populate the `last change date` field through a command like: `chage -d \"$(date +%Y-%m-%d)\" root` \n\nImpact: \n\nThe password expiration must be greater than the minimum days between password changes or users will be unable to change their password. \n\nExcessive password expiration requirements do more harm than good, because these requirements make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous one (incrementing a number used in the password for\nexample). Also, password expiration requirements offer no containment benefits because attackers will often use credentials as soon as they compromise them. Instead, immediate password changes should be based on key events including, but not limited to: \n\n- Indication of compromise\n- Change of user roles\n- When a user leaves the organization.\n\nNot only does changing passwords every few weeks or months frustrate the user, but it’s also been suggested that it does more harm than good, because it could lead to bad practices by the user such as adding a character to the end of their existing password.\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($5 > 365 || $5 < 1)system (\"chage --maxdays 365 \" $1)}' /etc/shadow\n```\n\n```\n# chage --maxdays\n```\n\n```\nPASS_MAX_DAYS 365\n```\n\n```\n# chage --maxdays 365\n```\n\n```\nPASS_MAX_DAYS 365\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"CIS Password Policy Guide"}]}],"props":[{"name":"label","value":"5.4.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.1_Ensure_password_expiration_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password expiration is configured"},{"id":"cisb-ubnt24.04lts-005.004.001.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`PASS_MIN_DAYS` <*N*\\> \\- The minimum number of days allowed between password changes. Any password changes attempted sooner than this will be rejected. If not specified, 0 will be assumed (which disables the restriction)."},{"id":"cisb-ubnt24.04lts-005.004.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Users may have favorite passwords that they like to use because they are easy to remember and they believe that their password choice is secure from compromise. Unfortunately, passwords are compromised and if an attacker is targeting a specific individual user account, with foreknowledge of data about that user, reuse of old, potentially compromised passwords, may cause a security breach.\n\nBy restricting the frequency of password changes, an administrator can prevent users from repeatedly changing their password in an attempt to circumvent password reuse controls"},{"id":"cisb-ubnt24.04lts-005.004.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/login.defs` and set `PASS_MIN_DAYS` to a value greater than `0` that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a minimum days greater than zero that follows local site policy: \n\n*Example:* \n\nImpact: \n\nIf a users password is set by other personnel as a procedure in dealing with a lost or expired password, the user should be forced to update this \"set\" password with their own password. e.g. force \"change at next logon\". \n\nIf it is not possible to have a user set their own password immediately, and this recommendation or local site procedure may cause a user to continue using a third party generated password, `PASS_MIN_DAYS` for the effected user should be temporally changed to `0`, to allow a user to change their password immediately. \n\nFor applications where the user is not using the password at console, the ability to \"change at next logon\" may be limited. This may cause a user to continue to use a password created by other personnel.\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($4 < 1)system (\"chage --mindays 1 \" $1)}' /etc/shadow\n```\n\n```\n# chage --mindays\n```\n\n```\nPASS_MIN_DAYS 1\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/login.defs` and set `PASS_MIN_DAYS` to a value greater than `0` that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a minimum days greater than zero that follows local site policy: \n\n*Example:* \n\nImpact: \n\nIf a users password is set by other personnel as a procedure in dealing with a lost or expired password, the user should be forced to update this \"set\" password with their own password. e.g. force \"change at next logon\". \n\nIf it is not possible to have a user set their own password immediately, and this recommendation or local site procedure may cause a user to continue using a third party generated password, `PASS_MIN_DAYS` for the effected user should be temporally changed to `0`, to allow a user to change their password immediately. \n\nFor applications where the user is not using the password at console, the ability to \"change at next logon\" may be limited. This may cause a user to continue to use a password created by other personnel.\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($4 < 1)system (\"chage --mindays 1 \" $1)}' /etc/shadow\n```\n\n```\n# chage --mindays\n```\n\n```\nPASS_MIN_DAYS 1\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"CIS Password Policy Guide"}]}],"props":[{"name":"label","value":"5.4.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.2_Ensure_minimum_password_days_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure minimum password days is configured"},{"id":"cisb-ubnt24.04lts-005.004.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `PASS_WARN_AGE` parameter in `/etc/login.defs` allows an administrator to notify users that their password will expire in a defined number of days.\n\n`PASS_WARN_AGE` ** \\- The number of days warning given before a password expires. A zero means warning is given only upon the day of expiration, a negative value means no warning is given. If not specified, no warning will be provided."},{"id":"cisb-ubnt24.04lts-005.004.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Providing an advance warning that a password will be expiring gives users time to think of a secure password. Users caught unaware may choose a simple password or write it down where it may be discovered."},{"id":"cisb-ubnt24.04lts-005.004.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/login.defs` and set `PASS_WARN_AGE` to a value of `7` or more that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a minimum warning to `7` or more days that follows local site policy: \n\n*Example:*\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($6 < 7)system (\"chage --warndays 7 \" $1)}' /etc/shadow\n```\n\n```\n# chage --warndays\n```\n\n```\nPASS_WARN_AGE 7\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/login.defs` and set `PASS_WARN_AGE` to a value of `7` or more that follows local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a minimum warning to `7` or more days that follows local site policy: \n\n*Example:*\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($6 < 7)system (\"chage --warndays 7 \" $1)}' /etc/shadow\n```\n\n```\n# chage --warndays\n```\n\n```\nPASS_WARN_AGE 7\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#8a85f869-e272-4c01-ba04-61b477317829"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.4.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.3_Ensure_password_expiration_warning_days_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure password expiration warning days is configured"},{"id":"cisb-ubnt24.04lts-005.004.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"A cryptographic hash function converts an arbitrary\\-length input into a fixed length output. Password hashing performs a one\\-way transformation of a password, turning the password into another string, called the hashed password.\n\n`ENCRYPT_METHOD` (string) \\- This defines the system default encryption algorithm for encrypting passwords (if no algorithm are specified on the command line). It can take one of these values:\n\n- `MD5` \\- MD5\\-based algorithm will be used for encrypting password\n- `SHA256` \\- SHA256\\-based algorithm will be used for encrypting password\n- `SHA512` \\- SHA512\\-based algorithm will be used for encrypting password\n- `BCRYPT` \\- BCRYPT\\-based algorithm will be used for encrypting password\n- `YESCRYPT` \\- YESCRYPT\\-based algorithm will be used for encrypting password\n- `DES` \\- DES\\-based algorithm will be used for encrypting password (default)\n\n**Note:**\n\n- This parameter overrides the deprecated `MD5_CRYPT_ENAB` variable.\n- This parameter will only affect the generation of group passwords.\n- The generation of user passwords is done by PAM and subject to the PAM configuration.\n- It is recommended to set this variable consistently with the PAM configuration."},{"id":"cisb-ubnt24.04lts-005.004.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `SHA-512` and `yescrypt` algorithms provide a stronger hash than other algorithms used by Linux for password hash generation. A stronger hash provides additional protection to the system by increasing the level of effort needed for an attacker to successfully determine local group passwords."},{"id":"cisb-ubnt24.04lts-005.004.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/login.defs` and set the `ENCRYPT_METHOD` to `SHA512` or `YESCRYPT`: \n\n*Example:* \n\n**Note:** \n\n- This only effects local groups' passwords created after updating the file to use `sha512` or `yescrypt`.\n- If it is determined that the password algorithm being used is not `sha512` or `yescrypt`, once it is changed, it is recommended that all group passwords be updated to use the stronger hashing algorithm.\n- It is recommended that the chosen hashing algorithm is consistent across `/etc/login.defs` and the PAM configuration\n\n```\nENCRYPT_METHOD YESCRYPT\n```\n\n```\nENCRYPT_METHOD\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/login.defs` and set the `ENCRYPT_METHOD` to `SHA512` or `YESCRYPT`: \n\n*Example:* \n\n**Note:** \n\n- This only effects local groups' passwords created after updating the file to use `sha512` or `yescrypt`.\n- If it is determined that the password algorithm being used is not `sha512` or `yescrypt`, once it is changed, it is recommended that all group passwords be updated to use the stronger hashing algorithm.\n- It is recommended that the chosen hashing algorithm is consistent across `/etc/login.defs` and the PAM configuration\n\n```\nENCRYPT_METHOD YESCRYPT\n```\n\n```\nENCRYPT_METHOD\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#446a0b78-3e00-4ef4-97b1-8081d2891ae7"},{"rel":"reference","href":"#d3620a46-f77d-4ee8-8713-ee9895a9aa39"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"5.4.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.4_Ensure_strong_password_hashing_algorithm_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure strong password hashing algorithm is configured"},{"id":"cisb-ubnt24.04lts-005.004.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"User accounts that have been inactive for over a given period of time can be automatically disabled.\n\n`INACTIVE` \\- Defines the number of days after the password exceeded its maximum age where the user is expected to replace this password.\n\nThe value is stored in the shadow password file. An input of `0` will disable an expired password with no delay. An input of `-1` will blank the respective field in the shadow password file."},{"id":"cisb-ubnt24.04lts-005.004.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Inactive accounts pose a threat to system security since the users are not logging in to notice failed login attempts or other anomalies."},{"id":"cisb-ubnt24.04lts-005.004.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set the default password inactivity period to 45 days or less that meets local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a inactive age of `45` days or less that follows local site policy: \n\n*Example:*\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($7 > 45 || $7 < 0)system (\"chage --inactive 45 \" $1)}' /etc/shadow\n```\n\n```\n# chage --inactive\n```\n\n```\n# useradd -D -f 45\n```\n\n```\n# useradd -D -f\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set the default password inactivity period to 45 days or less that meets local site policy: \n\n*Example:* \n\nRun the following command to modify user parameters for all users with a password set to a inactive age of `45` days or less that follows local site policy: \n\n*Example:*\n\n```\n# awk -F: '($2~/^\\$.+\\$/) {if($7 > 45 || $7 < 0)system (\"chage --inactive 45 \" $1)}' /etc/shadow\n```\n\n```\n# chage --inactive\n```\n\n```\n# useradd -D -f 45\n```\n\n```\n# useradd -D -f\n```"},{"id":"cisb-ubnt24.04lts-005.004.001.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"CIS Password Policy Guide"}]}],"props":[{"name":"label","value":"5.4.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.5_Ensure_inactive_password_lock_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure inactive password lock is configured"},{"id":"cisb-ubnt24.04lts-005.004.001.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"All users should have a password change date in the past."},{"id":"cisb-ubnt24.04lts-005.004.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a user's recorded password change date is in the future, then they could bypass any set password expiration."},{"id":"cisb-ubnt24.04lts-005.004.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate."},{"id":"cisb-ubnt24.04lts-005.004.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Investigate any users with a password change date in the future and correct them. Locking the account, expiring the password, or resetting the password manually may be appropriate."},{"id":"cisb-ubnt24.04lts-005.004.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.001.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.4.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.1.6_Ensure_all_users_last_password_change_date_is_in_the_past"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure all users last password change date is in the past"}]},{"id":"cisb-ubnt24.04lts-005.004.002_grp","parts":[{"id":"cisb-ubnt24.04lts-005.004.002_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"5.4.2"}],"title":"Configure root and system accounts and environment","controls":[{"id":"cisb-ubnt24.04lts-005.004.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Any account with UID 0 has superuser privileges on the system."},{"id":"cisb-ubnt24.04lts-005.004.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"This access must be limited to only the default `root` account and only from the system console. Administrative access must be through an unprivileged account using an approved mechanism as noted in Item 5.6 Ensure access to the su command is restricted."},{"id":"cisb-ubnt24.04lts-005.004.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to change the `root` account UID to `0`: \n\nModify any users other than `root` with UID `0` and assign them a new UID.\n\n```\n# usermod -u 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to change the `root` account UID to `0`: \n\nModify any users other than `root` with UID `0` and assign them a new UID.\n\n```\n# usermod -u 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"5.4.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.1_Ensure_root_is_the_only_UID_0_account"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure root is the only UID 0 account"},{"id":"cisb-ubnt24.04lts-005.004.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `usermod` command can be used to specify which group the `root` account belongs to. This affects permissions of files that are created by the `root` account."},{"id":"cisb-ubnt24.04lts-005.004.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Using GID 0 for the `root` account helps prevent `root` \\-owned files from accidentally becoming accessible to non\\-privileged users."},{"id":"cisb-ubnt24.04lts-005.004.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set the `root` user's GID to `0`: \n\nRun the following command to set the `root` group's GID to `0`: \n\nRemove any users other than the `root` user with GID 0 or assign them a new GID if appropriate.\n\n```\n# groupmod -g 0 root\n```\n\n```\n# usermod -g 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set the `root` user's GID to `0`: \n\nRun the following command to set the `root` group's GID to `0`: \n\nRemove any users other than the `root` user with GID 0 or assign them a new GID if appropriate.\n\n```\n# groupmod -g 0 root\n```\n\n```\n# usermod -g 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"5.4.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.2_Ensure_root_is_the_only_GID_0_account"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure root is the only GID 0 account"},{"id":"cisb-ubnt24.04lts-005.004.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `groupmod` command can be used to specify which group the `root` group belongs to. This affects permissions of files that are group owned by the `root` group."},{"id":"cisb-ubnt24.04lts-005.004.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Using GID 0 for the `root` group helps prevent `root` group owned files from accidentally becoming accessible to non\\-privileged users."},{"id":"cisb-ubnt24.04lts-005.004.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set the `root` group's GID to `0`: \n\nRemove any groups other than the `root` group with GID 0 or assign them a new GID if appropriate.\n\n```\n# groupmod -g 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set the `root` group's GID to `0`: \n\nRemove any groups other than the `root` group with GID 0 or assign them a new GID if appropriate.\n\n```\n# groupmod -g 0 root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"5.4.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.3_Ensure_group_root_is_the_only_GID_0_group"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure group root is the only GID 0 group"},{"id":"cisb-ubnt24.04lts-005.004.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"There are a number of methods to access the root account directly. Without a password set any user would be able to gain access and thus control over the entire system."},{"id":"cisb-ubnt24.04lts-005.004.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to `root` should be secured at all times."},{"id":"cisb-ubnt24.04lts-005.004.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set a password for the `root` user: \n\n**\\- OR \\-** \n\nRun the following command to lock the `root` user account: \n\nImpact: \n\nIf there are any automated processes that relies on access to the root account without authentication, they will fail after remediation.\n\n```\n# usermod -L root\n```\n\n```\n# passwd root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set a password for the `root` user: \n\n**\\- OR \\-** \n\nRun the following command to lock the `root` user account: \n\nImpact: \n\nIf there are any automated processes that relies on access to the root account without authentication, they will fail after remediation.\n\n```\n# usermod -L root\n```\n\n```\n# passwd root\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.4.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.4_Ensure_root_account_access_is_controlled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure root account access is controlled"},{"id":"cisb-ubnt24.04lts-005.004.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `root` user can execute any command on the system and could be fooled into executing programs unintentionally if the `PATH` is not set correctly."},{"id":"cisb-ubnt24.04lts-005.004.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Including the current working directory (.) or other writable directory in `root`'s executable path makes it likely that an attacker can gain superuser access by forcing an administrator operating as `root` to execute a Trojan horse program."},{"id":"cisb-ubnt24.04lts-005.004.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Correct or justify any: \n\n- Locations that are not directories\n- Empty directories (`::`)\n- Trailing (`:`)\n- Current working directory (`.`)\n- Non `root` owned directories\n- Directories that less restrictive than mode `0755`"},{"id":"cisb-ubnt24.04lts-005.004.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Correct or justify any: \n\n- Locations that are not directories\n- Empty directories (`::`)\n- Trailing (`:`)\n- Current working directory (`.`)\n- Non `root` owned directories\n- Directories that less restrictive than mode `0755`"},{"id":"cisb-ubnt24.04lts-005.004.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"5.4.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.5_Ensure_root_path_integrity"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure root path integrity"},{"id":"cisb-ubnt24.04lts-005.004.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The user file\\-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value \\- Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value \\- Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\n**root user Shell Configuration Files:**\n\n- `/root/.bash_profile` \\- Is executed to configure the root users' shell before the initial command prompt. **Is only read by login shells.**\n- `/root/.bashrc` \\- Is executed for interactive shells. **only read by a shell that's both interactive and non\\-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n1. `/root/.bash_profile`\n2. `/root/.bashrc`\n3. The system default umask"},{"id":"cisb-ubnt24.04lts-005.004.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a secure value for `umask` ensures that users make a conscious choice about their file permissions. A permissive `umask` value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users."},{"id":"cisb-ubnt24.04lts-005.004.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/root/.bash_profile` and `/root/.bashrc` and remove, comment out, or update any line with `umask` to be `0027` or more restrictive."},{"id":"cisb-ubnt24.04lts-005.004.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/root/.bash_profile` and `/root/.bashrc` and remove, comment out, or update any line with `umask` to be `0027` or more restrictive."},{"id":"cisb-ubnt24.04lts-005.004.002.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"5.4.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.6_Ensure_root_user_umask_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure root user umask is configured"},{"id":"cisb-ubnt24.04lts-005.004.002.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell."},{"id":"cisb-ubnt24.04lts-005.004.002.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the `nologin` shell. This prevents the account from potentially being used to run any commands."},{"id":"cisb-ubnt24.04lts-005.004.002.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set the shell for any service accounts returned by the audit to `nologin`: \n\n*Example script:*\n\n```\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n awk -v pat=\"$l_valid_shells\" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'\"$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\"' || $3 == 65534) && $(NF) ~ pat) {system (\"usermod -s '\"$(command -v nologin)\"' \" $1)}' /etc/passwd\n}\n```\n\n```\n# usermod -s $(command -v nologin)\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set the shell for any service accounts returned by the audit to `nologin`: \n\n*Example script:*\n\n```\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n awk -v pat=\"$l_valid_shells\" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'\"$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\"' || $3 == 65534) && $(NF) ~ pat) {system (\"usermod -s '\"$(command -v nologin)\"' \" $1)}' /etc/passwd\n}\n```\n\n```\n# usermod -s $(command -v nologin)\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-2(5), AC-3, AC-11, MP-2"}]}],"props":[{"name":"label","value":"5.4.2.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.7_Ensure_system_accounts_do_not_have_a_valid_login_shell"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure system accounts do not have a valid login shell"},{"id":"cisb-ubnt24.04lts-005.004.002.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.002.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.002.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell."},{"id":"cisb-ubnt24.04lts-005.004.002.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the `nologin` shell. This prevents the account from potentially being used to run any commands."},{"id":"cisb-ubnt24.04lts-005.004.002.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to lock any non\\-root accounts without a valid login shell returned by the audit: \n\n*Example script:*:\n\n```\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($(awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n while IFS= read -r l_user; do\n passwd -S \"$l_user\" | awk '$2 !~ /^L/ {system (\"usermod -L \" $1)}'\n done < <(awk -v pat=\"$l_valid_shells\" -F: '($1 != \"root\" && $(NF) !~ pat) {print $1}' /etc/passwd)\n}\n```\n\n```\n# usermod -L\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to lock any non\\-root accounts without a valid login shell returned by the audit: \n\n*Example script:*:\n\n```\n#!/usr/bin/env bash\n\n{\n l_valid_shells=\"^($(awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n while IFS= read -r l_user; do\n passwd -S \"$l_user\" | awk '$2 !~ /^L/ {system (\"usermod -L \" $1)}'\n done < <(awk -v pat=\"$l_valid_shells\" -F: '($1 != \"root\" && $(NF) !~ pat) {print $1}' /etc/passwd)\n}\n```\n\n```\n# usermod -L\n```"},{"id":"cisb-ubnt24.04lts-005.004.002.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.002.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-2(5), AC-3, AC-11, MP-2"}]}],"props":[{"name":"label","value":"5.4.2.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.2.8_Ensure_accounts_without_a_valid_login_shell_are_locked"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure accounts without a valid login shell are locked"}]},{"id":"cisb-ubnt24.04lts-005.004.003_grp","parts":[{"id":"cisb-ubnt24.04lts-005.004.003_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"5.4.3"}],"title":"Configure user default environment","controls":[{"id":"cisb-ubnt24.04lts-005.004.003.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs.\n\nBe aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file."},{"id":"cisb-ubnt24.04lts-005.004.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A user can use `chsh` to change their configured shell.\n\nIf a user has a shell configured that isn't in in `/etc/shells`, then the system assumes that they're somehow restricted. In the case of `chsh` it means that the user cannot change that value.\n\nOther programs might query that list and apply similar restrictions.\n\nBy putting `nologin` in `/etc/shells`, any user that has `nologin` as its shell is considered a full, unrestricted user. This is not the expected behavior for `nologin`."},{"id":"cisb-ubnt24.04lts-005.004.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/shells` and remove any lines that include `nologin`"},{"id":"cisb-ubnt24.04lts-005.004.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/shells` and remove any lines that include `nologin`"},{"id":"cisb-ubnt24.04lts-005.004.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"},{"name":"marking","class":"Reference","value":"shells(5)"}]}],"props":[{"name":"label","value":"5.4.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.3.1_Ensure_nologin_is_not_listed_in_etcshells"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure nologin is not listed in /etc/shells"},{"id":"cisb-ubnt24.04lts-005.004.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`TMOUT` is an environmental setting that determines the timeout of a shell in seconds.\n\n- TMOUT=*n* \\- Sets the shell timeout to *n* seconds. A setting of `TMOUT=0` disables timeout.\n- readonly TMOUT\\- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run\\-time.\n- export TMOUT \\- exports the TMOUT variable\n\n**System Wide Shell Configuration Files:**\n\n- `/etc/profile` \\- used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive *login* shells, or shells executed with the \\-\\-login parameter.**\n- `/etc/profile.d` \\- `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n- `/etc/bashrc` \\- System wide version of `.bashrc`. In Fedora derived distributions, `/etc/bashrc` also invokes /etc/profile.d/\\*.sh if *non\\-login* shell, but redirects output to `/dev/null` if *non\\-interactive.* **Is only executed for *interactive* shells or if `BASH_ENV` is set to `/etc/bashrc`.**"},{"id":"cisb-ubnt24.04lts-005.004.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session."},{"id":"cisb-ubnt24.04lts-005.004.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Review `/etc/bashrc`, `/etc/profile`, and all files ending in `*.sh` in the `/etc/profile.d/` directory and remove or edit all `TMOUT=_n_` entries to follow local site policy. `TMOUT` should not exceed 900 or be equal to `0`. \n\nConfigure `TMOUT` in **one** of the following files: \n\n- A file in the `/etc/profile.d/` directory ending in `.sh`\n- `/etc/profile`\n- `/etc/bashrc`\n\n*`TMOUT` configuration examples:* \n\n- As multiple lines:\n\n- As a single line:\n\n```\nreadonly TMOUT=900 ; export TMOUT\n```\n\n```\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\n```"},{"id":"cisb-ubnt24.04lts-005.004.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Review `/etc/bashrc`, `/etc/profile`, and all files ending in `*.sh` in the `/etc/profile.d/` directory and remove or edit all `TMOUT=_n_` entries to follow local site policy. `TMOUT` should not exceed 900 or be equal to `0`. \n\nConfigure `TMOUT` in **one** of the following files: \n\n- A file in the `/etc/profile.d/` directory ending in `.sh`\n- `/etc/profile`\n- `/etc/bashrc`\n\n*`TMOUT` configuration examples:* \n\n- As multiple lines:\n\n- As a single line:\n\n```\nreadonly TMOUT=900 ; export TMOUT\n```\n\n```\nTMOUT=900\nreadonly TMOUT\nexport TMOUT\n```"},{"id":"cisb-ubnt24.04lts-005.004.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#cf7d770e-dfe9-4d35-9ff2-f09c88ca1443"},{"rel":"reference","href":"#9b7007f5-27f9-4e2e-a63f-1546ed368515"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"5.4.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.3.2_Ensure_default_user_shell_timeout_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure default user shell timeout is configured"},{"id":"cisb-ubnt24.04lts-005.004.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-005.004.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-005.004.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The user file\\-creation mode mask (`umask`) is used to determine the file permission for newly created directories and files. In Linux, the default permissions for any newly created directory is 0777 (`rwxrwxrwx`), and for any newly created file it is 0666 (`rw-rw-rw-`). The `umask` modifies the default Linux permissions by restricting (masking) these permissions. The `umask` is not simply subtracted, but is processed bitwise. Bits set in the `umask` are cleared in the resulting file mode.\n\n`umask` can be set with either `Octal` or `Symbolic` values:\n\n- `Octal` (Numeric) Value \\- Represented by either three or four digits. ie `umask 0027` or `umask 027`. If a four digit umask is used, the first digit is ignored. The remaining three digits effect the resulting permissions for user, group, and world/other respectively.\n- `Symbolic` Value \\- Represented by a comma separated list for User `u`, group `g`, and world/other `o`. The permissions listed are not masked by `umask`. ie a `umask` set by `umask u=rwx,g=rx,o=` is the `Symbolic` equivalent of the `Octal` `umask 027`. This `umask` would set a newly created directory with file mode `drwxr-x---` and a newly created file with file mode `rw-r-----`.\n\nThe default `umask` can be set to use the `pam_umask` module or in a `System Wide Shell Configuration File`. The user creating the directories or files has the discretion of changing the permissions via the chmod command, or choosing a different default `umask` by adding the `umask` command into a `User Shell Configuration File`, ( `.bash_profile` or `.bashrc`), in their home directory.\n\n**Setting the default umask:**\n\n- pam\\_umask module:\n - will set the umask according to the system default in `/etc/login.defs` and user settings, solving the problem of different `umask` settings with different shells, display managers, remote sessions etc.\n - `umask=` value in the `/etc/login.defs` file is interpreted as Octal\n - Setting `USERGROUPS_ENAB` to yes in `/etc/login.defs` (default):\n - will enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 \\-\\> 002, 077 \\-\\> 007) for non\\-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n - userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n - will enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 \\-\\> 002, 077 \\-\\> 007) for non\\-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n - userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n - will set the umask according to the system default in `/etc/login.defs` and user settings, solving the problem of different `umask` settings with different shells, display managers, remote sessions etc.\n - `umask=` value in the `/etc/login.defs` file is interpreted as Octal\n - Setting `USERGROUPS_ENAB` to yes in `/etc/login.defs` (default):\n - will enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 \\-\\> 002, 077 \\-\\> 007) for non\\-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n - userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n - will enable setting of the `umask` group bits to be the same as owner bits. (examples: 022 \\-\\> 002, 077 \\-\\> 007) for non\\-root users, if the `uid` is the same as `gid`, and `username` is the same as the ``\n - userdel will remove the user's group if it contains no more members, and useradd will create by default a group with the name of the user\n- `System Wide Shell Configuration File`:\n - `/etc/profile` \\- used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive *login* shells, or shells executed with the \\-\\-login parameter.**\n - `/etc/profile.d` \\- `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n - `/etc/bashrc` \\- System wide version of `.bashrc`. In Fedora derived distributions, `etc/bashrc` also invokes /etc/profile.d/\\*.sh if *non\\-login* shell, but redirects output to `/dev/null` if *non\\-interactive.* **Is only executed for *interactive* shells or if `BASH_ENV` is set to `/etc/bashrc`.**\n - `/etc/profile` \\- used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the `.bash_profile`, however this file is used to set an initial PATH or PS1 for all shell users of the system. **is only executed for interactive *login* shells, or shells executed with the \\-\\-login parameter.**\n - `/etc/profile.d` \\- `/etc/profile` will execute the scripts within `/etc/profile.d/*.sh`. It is recommended to place your configuration in a shell script within `/etc/profile.d` to set your own system wide environmental variables.\n - `/etc/bashrc` \\- System wide version of `.bashrc`. In Fedora derived distributions, `etc/bashrc` also invokes /etc/profile.d/\\*.sh if *non\\-login* shell, but redirects output to `/dev/null` if *non\\-interactive.* **Is only executed for *interactive* shells or if `BASH_ENV` is set to `/etc/bashrc`.**\n\n**User Shell Configuration Files:**\n\n- `~/.bash_profile` \\- Is executed to configure your shell before the initial command prompt. **Is only read by login shells.**\n- `~/.bashrc` \\- Is executed for interactive shells. **only read by a shell that's both interactive and non\\-login**\n\n`umask` is set by order of precedence. If `umask` is set in multiple locations, this order of precedence will determine the system's default `umask`.\n\n**Order of precedence:**\n\n1. A file in `/etc/profile.d/` ending in `.sh` \\- This will override any other system\\-wide `umask` setting\n2. In the file `/etc/profile`\n3. On the `pam_umask.so` module in `/etc/pam.d/postlogin`\n4. In the file `/etc/login.defs`\n5. In the file `/etc/default/login`"},{"id":"cisb-ubnt24.04lts-005.004.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Setting a secure default value for `umask` ensures that users make a conscious choice about their file permissions. A permissive `umask` value could result in directories or files with excessive permissions that can be read and/or written to by unauthorized users."},{"id":"cisb-ubnt24.04lts-005.004.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script and perform the instructions in the output to set the default umask to `027` or more restrictive: \n\n**Notes:** \n\n- This method only applies to bash and shell. If other shells are supported on the system, it is recommended that their configuration files also are checked\n- If the `pam_umask.so` module is going to be used to set `umask`, ensure that it's not being overridden by another setting. Refer to the PAM\\_UMASK(8) man page for more information\n\n```\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_out=\"\"\n file_umask_chk()\n {\n if grep -Psiq -- '^\\h*umask\\h+(0?[0-7][2-7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\\h*#.*)?$' \"$l_file\"; then\n l_out=\"$l_out\\n - umask is set correctly in \\\"$l_file\\\"\"\n elif grep -Psiq -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0-6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\\b)))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - \\\"$l_file\\\"\"\n fi\n }\n while IFS= read -r -d $'\\0' l_file; do\n file_umask_chk\n done < <(find /etc/profile.d/ -type f -name '*.sh' -print0)\n [ -n \"$l_out\" ] && l_output=\"$l_out\"\n l_file=\"/etc/profile\" && file_umask_chk\n l_file=\"/etc/bashrc\" && file_umask_chk\n l_file=\"/etc/bash.bashrc\" && file_umask_chk\n l_file=\"/etc/pam.d/postlogin\"\n if grep -Psiq '^\\h*session\\h+[^#\\n\\r]+\\h+pam_umask\\.so\\h+([^#\\n\\r]+\\h+)?umask=(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - \\\"$l_file\\\"\"\n fi\n l_file=\"/etc/login.defs\" && file_umask_chk\n l_file=\"/etc/default/login\" && file_umask_chk\n if [ -z \"$l_output2\" ]; then\n echo -e \" - No files contain a UMASK that is not restrictive enough\\n No UMASK updates required to existing files\"\n else\n echo -e \"\\n - UMASK is not restrictive enough in the following file(s):$l_output2\\n\\n- Remediation Procedure:\\n - Update these files and comment out the UMASK line\\n or update umask to be \\\"0027\\\" or more restrictive\"\n fi\n if [ -n \"$l_output\" ]; then\n echo -e \"$l_output\"\n else\n echo -e \" - Configure UMASK in a file in the \\\"/etc/profile.d/\\\" directory ending in \\\".sh\\\"\\n\\n Example Command (Hash to represent being run at a root prompt):\\n\\n# printf '%s\\\\\\n' \\\"umask 027\\\" > /etc/profile.d/50-systemwide_umask.sh\\n\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.004.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script and perform the instructions in the output to set the default umask to `027` or more restrictive: \n\n**Notes:** \n\n- This method only applies to bash and shell. If other shells are supported on the system, it is recommended that their configuration files also are checked\n- If the `pam_umask.so` module is going to be used to set `umask`, ensure that it's not being overridden by another setting. Refer to the PAM\\_UMASK(8) man page for more information\n\n```\n#!/usr/bin/env bash\n\n{\n l_output=\"\" l_output2=\"\" l_out=\"\"\n file_umask_chk()\n {\n if grep -Psiq -- '^\\h*umask\\h+(0?[0-7][2-7]7|u(=[rwx]{0,3}),g=([rx]{0,2}),o=)(\\h*#.*)?$' \"$l_file\"; then\n l_out=\"$l_out\\n - umask is set correctly in \\\"$l_file\\\"\"\n elif grep -Psiq -- '^\\h*umask\\h+(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b|[0-7][0-7][0-6]\\b)|(u=[rwx]{1,3},)?(((g=[rx]?[rx]?w[rx]?[rx]?\\b)(,o=[rwx]{1,3})?)|((g=[wrx]{1,3},)?o=[wrx]{1,3}\\b)))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - \\\"$l_file\\\"\"\n fi\n }\n while IFS= read -r -d $'\\0' l_file; do\n file_umask_chk\n done < <(find /etc/profile.d/ -type f -name '*.sh' -print0)\n [ -n \"$l_out\" ] && l_output=\"$l_out\"\n l_file=\"/etc/profile\" && file_umask_chk\n l_file=\"/etc/bashrc\" && file_umask_chk\n l_file=\"/etc/bash.bashrc\" && file_umask_chk\n l_file=\"/etc/pam.d/postlogin\"\n if grep -Psiq '^\\h*session\\h+[^#\\n\\r]+\\h+pam_umask\\.so\\h+([^#\\n\\r]+\\h+)?umask=(([0-7][0-7][01][0-7]\\b|[0-7][0-7][0-7][0-6]\\b)|([0-7][01][0-7]\\b))' \"$l_file\"; then\n l_output2=\"$l_output2\\n - \\\"$l_file\\\"\"\n fi\n l_file=\"/etc/login.defs\" && file_umask_chk\n l_file=\"/etc/default/login\" && file_umask_chk\n if [ -z \"$l_output2\" ]; then\n echo -e \" - No files contain a UMASK that is not restrictive enough\\n No UMASK updates required to existing files\"\n else\n echo -e \"\\n - UMASK is not restrictive enough in the following file(s):$l_output2\\n\\n- Remediation Procedure:\\n - Update these files and comment out the UMASK line\\n or update umask to be \\\"0027\\\" or more restrictive\"\n fi\n if [ -n \"$l_output\" ]; then\n echo -e \"$l_output\"\n else\n echo -e \" - Configure UMASK in a file in the \\\"/etc/profile.d/\\\" directory ending in \\\".sh\\\"\\n\\n Example Command (Hash to represent being run at a root prompt):\\n\\n# printf '%s\\\\\\n' \\\"umask 027\\\" > /etc/profile.d/50-systemwide_umask.sh\\n\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-005.004.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-005.004.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"5.4.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_5.4.3.3_Ensure_default_user_umask_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure default user umask is configured"}]}]}]},{"id":"cisb-ubnt24.04lts-006_grp","parts":[{"id":"cisb-ubnt24.04lts-006_ovrvw","name":"overview","prose":"The items in this section describe how to configure logging, log monitoring, and auditing, using tools included in most distributions.\n\nIt is recommended that `rsyslog `be used for logging (with `logwatch `providing summarization) and `auditd` be used for auditing (with `aureport `providing summarization) to automatically monitor logs for intrusion attempts and other suspicious system behavior.\n\nIn addition to the local log files created by the steps in this section, it is also recommended that sites collect copies of their system logs on a secure, centralized log server via an encrypted connection. Not only does centralized logging help sites correlate events that may be occurring on multiple systems, but having a second copy of the system log information may be critical after a system compromise where the attacker has modified the local log files on the affected system(s). If a log correlation system is deployed, configure it to process the logs described in this section.\n\nBecause it is often necessary to correlate log information from many different systems (particularly after a security incident) it is recommended that the time be synchronized among systems and devices connected to the local network. The standard Internet protocol for time synchronization is the Network Time Protocol (NTP), which is supported by most network\\-ready devices. Reference manual page for more information on configuring chrony.\n\nIt is important that all logs described in this section be monitored on a regular basis and correlated to determine trends. A seemingly innocuous entry in one log could be more significant when compared to an entry in another log.\n\n**Note on log file permissions:** There really isn't a \"one size fits all\" solution to the permissions on log files. Many sites utilize group permissions so that administrators who are in a defined security group, such as \"wheel\" do not have to elevate privileges to root in order to read log files. Also, if a third party log aggregation tool is used, it may need to have group permissions to read the log files, which is preferable to having it run setuid to root. Therefore, there are two remediation and audit steps for log file permissions. One is for systems that do not have a secured group method implemented that only permits root to read the log files (`root:root 600`). The other is for sites that do have such a setup and are designated as `root:securegrp 640 `where `securegrp` is the defined security group (in some cases `wheel`)."}],"props":[{"name":"label","value":"6"}],"title":"Logging and Auditing","groups":[{"id":"cisb-ubnt24.04lts-006.001_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001_ovrvw","name":"overview","prose":"Logging services should be configured to prevent information leaks and to aggregate logs on a remote server so that they can be reviewed in the event of a system compromise. A centralized log server provides a single point of entry for further analysis, monitoring and filtering.\n\n**Security principals for logging**\n\n- Ensure transport layer security is implemented between the client and the log server.\n- Ensure that logs are rotated as per the environment requirements.\n- Ensure all locally generated logs have the appropriate permissions.\n- Ensure all security logs are sent to a remote log server.\n- Ensure the required events are logged.\n\n**What is covered**\n\nThis section will cover the minimum best practices for the usage of **either** `rsyslog` **\\- OR \\-** `journald`. The recommendations are written such that each is wholly independent of each other and **only one is implemented**.\n\n- If your organization makes use of an enterprise wide logging system completely outside of `rsyslog` or `journald`, then the following recommendations do not directly apply. However, the principals of the recommendations should be followed regardless of what solution is implemented. If the enterprise solution incorporates either of these tools, careful consideration should be given to the following recommendations to determine exactly what applies.\n- Should your organization make use of both `rsyslog` and `journald`, take care how the recommendations may or may not apply to you.\n\n**What is not covered**\n\n- Enterprise logging systems not utilizing `rsyslog` or `journald`. As logging is very situational and dependent on the local environment, not everything can be covered here.\n- Transport layer security should be applied to all remote logging functionality. Both `rsyslog` and `journald` supports secure transport and should be configured as such.\n- The log server. There are a multitude of reasons for a centralized log server (and keeping a short period logging on the local system), but the log server is out of scope for these recommendations."}],"props":[{"name":"label","value":"6.1"}],"title":"System Logging","groups":[{"id":"cisb-ubnt24.04lts-006.001.001_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001.001_ovrvw","name":"overview","prose":"`systemd-journald` is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources:\n\n- Kernel log messages, via kmsg\n- Simple system log messages, via the libc syslog call\n- Structured system log messages via the native Journal API\n- Standard output and standard error of service units\n- Audit records, originating from the kernel audit subsystem\n\nThe daemon will implicitly collect numerous metadata fields for each log messages in a secure and unfakeable way. See systemd.journal\\-fields man page for more information about the collected metadata.\n\nThe journal service stores log data either persistently below `/var/log/journal` or in a volatile way below `/run/log/journal/`. By default, log data is stored persistently if `/var/log/journal/` exists during boot, with an implicit fallback to volatile storage. Use `Storage=` in `journald.conf` to configure where log data is placed, independently of the existence of `/var/log/journal/`.\n\nOn systems where `/var/log/journal/` does not exist but where persistent logging is desired, and the default `journald.conf` is used, it is sufficient to create the directory and ensure it has the correct access modes and ownership.\n\n**Note:** `systemd-journald.service` must be configured appropriately for either `journald` **\\- OR \\-** `rsyslog` to operate effectively."}],"props":[{"name":"label","value":"6.1.1"}],"title":"Configure systemd-journald service","controls":[{"id":"cisb-ubnt24.04lts-006.001.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Ensure that the `systemd-journald` service is enabled to allow capturing of logging events."},{"id":"cisb-ubnt24.04lts-006.001.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the `systemd-journald` service is not enabled to start on boot, the system will not capture logging events."},{"id":"cisb-ubnt24.04lts-006.001.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to unmask and start `systemd-journald.service`\n\n```\n# systemctl unmask systemd-journald.service\n# systemctl start systemd-journald.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to unmask and start `systemd-journald.service`\n\n```\n# systemctl unmask systemd-journald.service\n# systemctl start systemd-journald.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7 AU-12"}]}],"props":[{"name":"label","value":"6.1.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.1.1_Ensure_journald_service_is_enabled_and_active"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure journald service is enabled and active"},{"id":"cisb-ubnt24.04lts-006.001.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files."},{"id":"cisb-ubnt24.04lts-006.001.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected."},{"id":"cisb-ubnt24.04lts-006.001.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"If the default configuration is not appropriate for the site specific requirements, copy `/usr/lib/tmpfiles.d/systemd.conf` to `/etc/tmpfiles.d/systemd.conf` and modify as required. Recommended mode for logfiles is `0640` or more restrictive."},{"id":"cisb-ubnt24.04lts-006.001.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"If the default configuration is not appropriate for the site specific requirements, copy `/usr/lib/tmpfiles.d/systemd.conf` to `/etc/tmpfiles.d/systemd.conf` and modify as required. Recommended mode for logfiles is `0640` or more restrictive."},{"id":"cisb-ubnt24.04lts-006.001.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, AU-2, AU-12, MP-2, SI-5"}]}],"props":[{"name":"label","value":"6.1.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.1.2_Ensure_journald_log_file_access_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure journald log file access is configured"},{"id":"cisb-ubnt24.04lts-006.001.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/systemd/journald.conf` is the configuration file used to specify how logs generated by Journald should be rotated."},{"id":"cisb-ubnt24.04lts-006.001.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files."},{"id":"cisb-ubnt24.04lts-006.001.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/systemd/journald.conf` or a file ending in `.conf` the `/etc/systemd/journald.conf.d/` directory. Set the following parameters in the `[Journal]` section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters. \n\n*Example Configuration*: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** \n\n- If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten\n- Logfile size and configuration to move logfiles to a remote log server should be accounted for when configuring these settings\n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n{\n a_settings=(\"SystemMaxUse=1G\" \"SystemKeepFree=500M\" \"RuntimeMaxUse=200M\" \"RuntimeKeepFree=50M\" \"MaxFileSec=1month\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\n[Journal]\nSystemMaxUse=1G\nSystemKeepFree=500M\nRuntimeMaxUse=200M\nRuntimeKeepFree=50M\nMaxFileSec=1month\n```"},{"id":"cisb-ubnt24.04lts-006.001.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/systemd/journald.conf` or a file ending in `.conf` the `/etc/systemd/journald.conf.d/` directory. Set the following parameters in the `[Journal]` section to ensure logs are rotated according to site policy. The settings should be carefully understood as there are specific edge cases and prioritization of parameters. \n\n*Example Configuration*: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** \n\n- If these settings appear in a canonically later file, or later in the same file, the setting will be overwritten\n- Logfile size and configuration to move logfiles to a remote log server should be accounted for when configuring these settings\n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n{\n a_settings=(\"SystemMaxUse=1G\" \"SystemKeepFree=500M\" \"RuntimeMaxUse=200M\" \"RuntimeKeepFree=50M\" \"MaxFileSec=1month\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\n[Journal]\nSystemMaxUse=1G\nSystemKeepFree=500M\nRuntimeMaxUse=200M\nRuntimeKeepFree=50M\nMaxFileSec=1month\n```"},{"id":"cisb-ubnt24.04lts-006.001.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7, AU-12"}]}],"props":[{"name":"label","value":"6.1.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.1.3_Ensure_journald_log_file_rotation_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure journald log file rotation is configured"},{"id":"cisb-ubnt24.04lts-006.001.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Best practices recommend that a single centralized logging system be used for log management, choose a single service either `rsyslog` **\\- OR \\-** `journald` to be used as a single centralized logging system."},{"id":"cisb-ubnt24.04lts-006.001.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Configuring only one logging service either `rsyslog` **\\- OR \\-** `journald` avoids redundancy, optimizes resources, simplifies configuration and management, and ensures consistency."},{"id":"cisb-ubnt24.04lts-006.001.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"1. Determine whether to use `journald` **\\- OR \\-** `rsyslog` depending on site needs\n2. Configure `systemd-jounald.service`\n3. Configure only **ONE** either `journald` **\\- OR \\-** `rsyslog` and complete the recommendations in that subsection\n4. Return to this recommendation to ensure only one logging system is in use\n\nImpact: \n\nTransitioning from one logging service to another can be complex and time consuming, it involves reconfiguration and may result in data loss if not managed and reconfigured correctly."},{"id":"cisb-ubnt24.04lts-006.001.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"1. Determine whether to use `journald` **\\- OR \\-** `rsyslog` depending on site needs\n2. Configure `systemd-jounald.service`\n3. Configure only **ONE** either `journald` **\\- OR \\-** `rsyslog` and complete the recommendations in that subsection\n4. Return to this recommendation to ensure only one logging system is in use\n\nImpact: \n\nTransitioning from one logging service to another can be complex and time consuming, it involves reconfiguration and may result in data loss if not managed and reconfigured correctly."},{"id":"cisb-ubnt24.04lts-006.001.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"6.1.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.1.4_Ensure_only_one_logging_system_is_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure only one logging system is in use"}]},{"id":"cisb-ubnt24.04lts-006.001.002_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001.002_ovrvw","name":"overview","prose":"Included in the systemd suite is a journaling service called systemd\\-journald.service for the collection and storage of logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sources such as:\n\nClassic RFC3164 BSD syslog via the /dev/log socket\nSTDOUT/STDERR of programs via StandardOutput=journal \\+ StandardError=journal in service files (both of which are default settings)\nKernel log messages via the /dev/kmsg device node\nAudit records via the kernel’s audit subsystem\nStructured log messages via journald’s native protocol\nAny changes made to the systemd\\-journald configuration will require a re\\-start of systemd\\-journald\n\n**Note:**\n\n**\\- IF \\-** `rsyslog` will be used for remote logging on the system this subsection can be skipped"}],"props":[{"name":"label","value":"6.1.2"}],"title":"Configure journald","groups":[{"id":"cisb-ubnt24.04lts-006.001.002.001_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001.002.001_ovrvw","name":"overview","prose":"The `systemd-journal-remote` package includes `systemd-journal-upload`.\n\n`systemd-journal-upload` will upload journal entries to the URL specified with \\-\\-url=. This program reads journal entries from one or more journal files, similarly to journalctl.\n\n`systemd-journal-upload` transfers the raw content of journal file and uses HTTP as a transport protocol.\n\n`systemd-journal-upload.service` is a system service that uses `systemd-journal-upload` to upload journal entries to a server. It uses the configuration in `journal-upload.conf`.\n\n**Note:**\n\n- **\\- IF \\-** `rsyslog` is in use this subsection can be skipped.\n- `systemd-journal-remote` package is part of the `universe` component, this may impact support and update frequency which should be considered when assessing organizational risk."}],"props":[{"name":"label","value":"6.1.2.1"}],"title":"Configure systemd-journal-remote","controls":[{"id":"cisb-ubnt24.04lts-006.001.002.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald `systemd-journal-remote` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install `systemd-journal-remote`:\n\n```\n# apt install systemd-journal-remote\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install `systemd-journal-remote`:\n\n```\n# apt install systemd-journal-remote\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7 AU-12"}]}],"props":[{"name":"label","value":"6.1.2.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.1_Ensure_systemd-journal-remote_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure systemd-journal-remote is installed"},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host."},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `/etc/systemd/journal-upload.conf` file or a file in `/etc/systemd/journal-upload.conf.d` ending in `.conf` and ensure the following lines are set in the `[Upload]` section per your environment: \n\n*Example settings:* \n\n*Example script to create systemd drop\\-in configuration file:* \n\nRun the following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journal-upload\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"URL=192.168.50.42\" \"ServerKeyFile=/etc/ssl/private/journal-upload.pem\" \\\n \"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem\" \"TrustedCertificateFile=/etc/ssl/ca/trusted.pem\")\n [ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/\n if grep -Psq -- '^\\h*\\[Upload\\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n fi\n}\n```\n\n```\n[Upload]\nURL=192.168.50.42\nServerKeyFile=/etc/ssl/private/journal-upload.pem\nServerCertificateFile=/etc/ssl/certs/journal-upload.pem\nTrustedCertificateFile=/etc/ssl/ca/trusted.pem\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `/etc/systemd/journal-upload.conf` file or a file in `/etc/systemd/journal-upload.conf.d` ending in `.conf` and ensure the following lines are set in the `[Upload]` section per your environment: \n\n*Example settings:* \n\n*Example script to create systemd drop\\-in configuration file:* \n\nRun the following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journal-upload\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"URL=192.168.50.42\" \"ServerKeyFile=/etc/ssl/private/journal-upload.pem\" \\\n \"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem\" \"TrustedCertificateFile=/etc/ssl/ca/trusted.pem\")\n [ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/\n if grep -Psq -- '^\\h*\\[Upload\\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf\n fi\n}\n```\n\n```\n[Upload]\nURL=192.168.50.42\nServerKeyFile=/etc/ssl/private/journal-upload.pem\nServerCertificateFile=/etc/ssl/certs/journal-upload.pem\nTrustedCertificateFile=/etc/ssl/ca/trusted.pem\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12"}]}],"props":[{"name":"label","value":"6.1.2.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.2_Ensure_systemd-journal-upload_authentication_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure systemd-journal-upload authentication is configured"},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald `systemd-journal-upload` supports the ability to send log events it gathers to a remote log host."},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to unmask, enable and start `systemd-journal-upload`:\n\n```\n# systemctl unmask systemd-journal-upload.service\n# systemctl --now enable systemd-journal-upload.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to unmask, enable and start `systemd-journal-upload`:\n\n```\n# systemctl unmask systemd-journal-upload.service\n# systemctl --now enable systemd-journal-upload.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12"}]}],"props":[{"name":"label","value":"6.1.2.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.3_Ensure_systemd-journal-upload_is_enabled_and_active"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure systemd-journal-upload is enabled and active"},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Journald `systemd-journal-remote` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts.\n\n**Note:**\n\n- The same package, `systemd-journal-remote`, is used for both sending logs to remote hosts and receiving incoming logs.\n- With regards to receiving logs, there are two services; `systemd-journal-remote.socket` and `systemd-journal-remote.service`."},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to stop and mask `systemd-journal-remote.socket` and systemd\\-journal\\-remote.service:\n\n```\n# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service\n# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to stop and mask `systemd-journal-remote.socket` and systemd\\-journal\\-remote.service:\n\n```\n# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service\n# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7 AU-12"}]}],"props":[{"name":"label","value":"6.1.2.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.1.4_Ensure_systemd-journal-remote_service_is_not_in_use"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure systemd-journal-remote service is not in use"}]}],"controls":[{"id":"cisb-ubnt24.04lts-006.001.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Data from `journald` should be kept in the confines of the service and not forwarded to other services."},{"id":"cisb-ubnt24.04lts-006.001.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** `journald` is the method for capturing logs, all logs of the system should be handled by `journald` and not forwarded to other logging mechanisms.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=no\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nForwardToSyslog=no\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=no\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nForwardToSyslog=no\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-6, AU-7, AU-12"}]}],"props":[{"name":"label","value":"6.1.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.2_Ensure_journald_ForwardToSyslog_is_disabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure journald ForwardToSyslog is disabled"},{"id":"cisb-ubnt24.04lts-006.001.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The journald system includes the capability of compressing overly large files to avoid filling up the system with logs or making the logs unmanageably large."},{"id":"cisb-ubnt24.04lts-006.001.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Uncompressed large files may unexpectedly fill a filesystem leading to resource unavailability. Compressing logs prior to write can prevent sudden, unexpected filesystem impacts.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Compress=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nCompress=yes\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Compress=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nCompress=yes\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-4"}]}],"props":[{"name":"label","value":"6.1.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.3_Ensure_journald_Compress_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure journald Compress is configured"},{"id":"cisb-ubnt24.04lts-006.001.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Data from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss due to a reboot."},{"id":"cisb-ubnt24.04lts-006.001.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Writing log data to disk will provide the ability to forensically reconstruct events which may have impacted the operations or security of a system even after a system crash or reboot.\n\n**Note:** This recommendation **only applies if `journald` is the chosen method for client side logging**. Do not apply this recommendation if `rsyslog` is used."},{"id":"cisb-ubnt24.04lts-006.001.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Storage=persistent\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nStorage=persistent\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure rsyslog\" section followed. \n\n**\\- IF \\-** `journald` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in /etc/systemd/journald.conf.d/ ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service:\n\n```\n# systemctl reload-or-restart systemd-journald\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"Storage=persistent\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nStorage=persistent\n```"},{"id":"cisb-ubnt24.04lts-006.001.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-12"}]}],"props":[{"name":"label","value":"6.1.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.2.4_Ensure_journald_Storage_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure journald Storage is configured"}]},{"id":"cisb-ubnt24.04lts-006.001.003_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001.003_ovrvw","name":"overview","prose":"The `rsyslog` software package may be used instead of the default `journald` logging mechanism.\n\nRsyslog has evolved over several decades. For this reason it supports three different configuration formats (“languages”):\n\n- `basic` \\- previously known as the `sysklogd` format, this is the format best used to express basic things, such as where the statement fits on a single line.\n - It stems back to the original syslog.conf format, in use now for several decades.\n - The most common use case is matching on facility/severity and writing matching messages to a log file.\n - It stems back to the original syslog.conf format, in use now for several decades.\n - The most common use case is matching on facility/severity and writing matching messages to a log file.\n- `advanced` \\- previously known as the `RainerScript` format, this format was first available in rsyslog v6 and is the current, best and most precise format for non\\-trivial use cases where more than one line is needed.\n - Prior to v7, there was a performance impact when using this format that encouraged use of the basic format for best results. Current versions of rsyslog do not suffer from this (historical) performance impact.\n - This new style format is specifically targeted towards more advanced use cases like forwarding to remote hosts that might be partially offline.\n - Prior to v7, there was a performance impact when using this format that encouraged use of the basic format for best results. Current versions of rsyslog do not suffer from this (historical) performance impact.\n - This new style format is specifically targeted towards more advanced use cases like forwarding to remote hosts that might be partially offline.\n- `obsolete legacy` \\- previously known simply as the `legacy` format, this format is exactly what its name implies: it is obsolete and should not be used when writing new configurations. It was created in the early days (up to rsyslog version 5) where we expected that rsyslog would extend sysklogd just mildly. Consequently, it was primarily aimed at small additions to the original sysklogd format.\n - Practice has shown that it was notoriously hard to use for more advanced use cases, and thus we replaced it with the advanced format.\n - In essence, everything that needs to be written on a single line that starts with a dollar sign is legacy format. Users of this format are encouraged to migrate to the basic or advanced formats.\n - Practice has shown that it was notoriously hard to use for more advanced use cases, and thus we replaced it with the advanced format.\n - In essence, everything that needs to be written on a single line that starts with a dollar sign is legacy format. Users of this format are encouraged to migrate to the basic or advanced formats.\n\n**Note:** This section only applies if `rsyslog` is the chosen method for client side logging. Do not apply this section if `journald` is used."}],"props":[{"name":"label","value":"6.1.3"}],"title":"Configure rsyslog","controls":[{"id":"cisb-ubnt24.04lts-006.001.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `rsyslog` software is recommended in environments where `journald` does not meet operation requirements."},{"id":"cisb-ubnt24.04lts-006.001.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The security enhancements of `rsyslog` such as connection\\-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server) justify installing and configuring the package."},{"id":"cisb-ubnt24.04lts-006.001.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to install `rsyslog`:\n\n```\n# apt install rsyslog\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to install `rsyslog`:\n\n```\n# apt install rsyslog\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12"}]}],"props":[{"name":"label","value":"6.1.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.1_Ensure_rsyslog_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsyslog is installed"},{"id":"cisb-ubnt24.04lts-006.001.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Once the `rsyslog` package is installed, ensure that the service is enabled."},{"id":"cisb-ubnt24.04lts-006.001.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If the `rsyslog` service is not enabled to start on boot, the system will not capture logging events."},{"id":"cisb-ubnt24.04lts-006.001.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `rsyslog` is being used for logging on the system: \n\nRun the following commands to unmask, enable, and start `rsyslog.service`:\n\n```\n# systemctl unmask rsyslog.service\n# systemctl enable rsyslog.service\n# systemctl start rsyslog.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `rsyslog` is being used for logging on the system: \n\nRun the following commands to unmask, enable, and start `rsyslog.service`:\n\n```\n# systemctl unmask rsyslog.service\n# systemctl enable rsyslog.service\n# systemctl start rsyslog.service\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12"}]}],"props":[{"name":"label","value":"6.1.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.2_Ensure_rsyslog_service_is_enabled_and_active"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsyslog service is enabled and active"},{"id":"cisb-ubnt24.04lts-006.001.003.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Data from `systemd-journald` may be stored in volatile memory or persisted locally on the server. Utilities exist to accept remote export of `systemd-journald` logs, however, use of the `rsyslog` service provides a consistent means of log collection and export."},{"id":"cisb-ubnt24.04lts-006.001.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"**\\- IF \\-** `rsyslog` is the preferred method for capturing logs, all logs of the system should be sent to it for further processing.\n\n**Note:** This recommendation **only applies if `rsyslog` is the chosen method for client side logging**. Do not apply this recommendation if `systemd-journald` is used."},{"id":"cisb-ubnt24.04lts-006.001.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**\\- IF \\-** `Journald` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure Journald\" section followed. \n\n**\\- IF \\-** `rsyslog` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service: \n\nRestart `systemd-journald.service`:\n\n```\n# systemctl reload-or-restart systemd-journald.service\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nForwardToSyslog=yes\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**\\- IF \\-** `Journald` is the preferred method for capturing logs, this section and Recommendation should be skipped and the \"Configure Journald\" section followed. \n\n**\\- IF \\-** `rsyslog` is the preferred method for capturing logs: \n\nSet the following parameter in the `[Journal]` section in `/etc/systemd/journald.conf` or a file in `/etc/systemd/journald.conf.d/` ending in `.conf`: \n\n*Example script to create systemd drop\\-in configuration file:* \n\n**Note:** If this setting appears in a canonically later file, or later in the same file, the setting will be overwritten \n\nRun to following command to update the parameters in the service: \n\nRestart `systemd-journald.service`:\n\n```\n# systemctl reload-or-restart systemd-journald.service\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_settings=(\"ForwardToSyslog=yes\")\n [ ! -d /etc/systemd/journald.conf.d/ ] && mkdir /etc/systemd/journald.conf.d/\n if grep -Psq -- '^\\h*\\[Journal\\]' /etc/systemd/journald.conf.d/60-journald.conf; then\n printf '%s\\n' \"\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n else\n printf '%s\\n' \"\" \"[Journal]\" \"${a_settings[@]}\" >> /etc/systemd/journald.conf.d/60-journald.conf\n fi\n}\n```\n\n```\nForwardToSyslog=yes\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#56efab4b-cc6a-4644-ae29-8bf5ef04239c"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"},{"rel":"reference","href":"#938bb5d4-f89c-42ad-a774-ea82b61ce067"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"JOURNALD.CONF(5)"},{"name":"marking","class":"Reference","value":"SYSTEMD-JOURNALD.SERVICE(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, AU-2, AU-4, AU-12, MP-2"}]}],"props":[{"name":"label","value":"6.1.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.3_Ensure_journald_is_configured_to_send_logs_to_rsyslog"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure journald is configured to send logs to rsyslog"},{"id":"cisb-ubnt24.04lts-006.001.003.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`rsyslog` will create logfiles that do not already exist on the system.\n\nThe `global()` configuration object `umask`, available in rsyslog 8.26.0\\+, sets the rsyslogd process’ umask. If not specified, the system\\-provided default is used. The value given must always be a 4\\-digit octal number, with the initial digit being zero.\n\nThe legacy `$umask` parameter sets the `rsyslogd` process' umask. If not specified, the system\\-provided default is used. The value given must always be a 4\\-digit octal number, with the initial digit being zero.\n\nThe legacy `$FileCreateMode` parameter allows the setting of the mode with which `rsyslogd` creates new files. If not specified, the value `0644` is used. The value given must always be a 4\\-digit octal number, with the initial digit being zero. Please note that the actual permission depend on `rsyslogd` process `umask`. If in doubt, use `$umask 0000` right at the beginning of the configuration file to remove any restrictions.\n\nThe legacy `$FileCreateMode` may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next `$FileCreateMode` parameter. Order of lines is vitally important."},{"id":"cisb-ubnt24.04lts-006.001.003.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected."},{"id":"cisb-ubnt24.04lts-006.001.003.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit either `/etc/rsyslog.conf` or a dedicated `.conf` file in `/etc/rsyslog.d/` and set `$FileCreateMode` to `0640` or more restrictive: \n\n*Example script to create a drop\\-in configuration file in the default include location:* \n\nReload the service:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslog.d/\n printf '%s\\n' \"\" \"\\$FileCreateMode 0640\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```\n\n```\n$FileCreateMode 0640\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit either `/etc/rsyslog.conf` or a dedicated `.conf` file in `/etc/rsyslog.d/` and set `$FileCreateMode` to `0640` or more restrictive: \n\n*Example script to create a drop\\-in configuration file in the default include location:* \n\nReload the service:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n#!/usr/bin/env bash\n\n{\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslog.d/\n printf '%s\\n' \"\" \"\\$FileCreateMode 0640\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```\n\n```\n$FileCreateMode 0640\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#9091db95-46e6-432e-aa40-de4c5a398da8"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.004_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#d3fb7d51-e3ac-4daa-a809-feba8099d5ee"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, AC-6, MP-2"},{"name":"marking","class":"Reference","value":"RSYSLOG.CONF(5)"}]}],"props":[{"name":"label","value":"6.1.3.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.4_Ensure_rsyslog_log_file_creation_mode_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsyslog log file creation mode is configured"},{"id":"cisb-ubnt24.04lts-006.001.003.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `rsyslog` and configuration files specifies rules for logging and which files are to be used to log certain classes of messages."},{"id":"cisb-ubnt24.04lts-006.001.003.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A great deal of important security\\-related information is sent via `rsyslog` (e.g., successful and failed su attempts, failed login attempts, root login attempts, etc.)."},{"id":"cisb-ubnt24.04lts-006.001.003.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the following lines in the configuration file(s) returned by the audit as appropriate for your environment. \n\n**Note:** The below configuration is shown for example purposes only. Due care should be given to how the organization wishes to store log data. \n\nRun the following command to reload the `rsyslogd` configuration:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n*.emerg :omusrmsg:*\nauth,authpriv.* /var/log/secure\nmail.* -/var/log/mail\nmail.info -/var/log/mail.info\nmail.warning -/var/log/mail.warn\nmail.err /var/log/mail.err\ncron.* /var/log/cron\n*.=warning;*.=err -/var/log/warn\n*.crit /var/log/warn\n*.*;mail.none;news.none -/var/log/messages\nlocal0,local1.* -/var/log/localmessages\nlocal2,local3.* -/var/log/localmessages\nlocal4,local5.* -/var/log/localmessages\nlocal6,local7.* -/var/log/localmessages\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the following lines in the configuration file(s) returned by the audit as appropriate for your environment. \n\n**Note:** The below configuration is shown for example purposes only. Due care should be given to how the organization wishes to store log data. \n\nRun the following command to reload the `rsyslogd` configuration:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n*.emerg :omusrmsg:*\nauth,authpriv.* /var/log/secure\nmail.* -/var/log/mail\nmail.info -/var/log/mail.info\nmail.warning -/var/log/mail.warn\nmail.err /var/log/mail.err\ncron.* /var/log/cron\n*.=warning;*.=err -/var/log/warn\n*.crit /var/log/warn\n*.*;mail.none;news.none -/var/log/messages\nlocal0,local1.* -/var/log/localmessages\nlocal2,local3.* -/var/log/localmessages\nlocal4,local5.* -/var/log/localmessages\nlocal6,local7.* -/var/log/localmessages\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7, AU-12"},{"name":"marking","class":"Reference","value":"See the rsyslog.conf(5) man page for more information."}]}],"props":[{"name":"label","value":"6.1.3.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.5_Ensure_rsyslog_logging_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure rsyslog logging is configured"},{"id":"cisb-ubnt24.04lts-006.001.003.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`rsyslog` supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management."},{"id":"cisb-ubnt24.04lts-006.001.003.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system."},{"id":"cisb-ubnt24.04lts-006.001.003.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit the `rsyslog` configuration and add the following line (where `loghost.example.com` is the name of your central log host). The `target` directive may either be a fully qualified domain name or an IP address. \n\n*Example script to create a drop\\-in configuration file:* \n\nRun the following command to reload `rsyslog.service`:\n\n```\n# systemctl reload-or-restart rsyslog.service\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_parameters=('*.* action(type=\"omfwd\" target=\"loghost.example.com\" port=\"514\" protocol=\"tcp\"' \\\n ' action.resumeRetryCount=\"100\"' ' queue.type=\"LinkedList\" queue.size=\"1000\")')\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslod.d/\n printf '%s\\n' \"\" \"${a_parameters[@]}\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit the `rsyslog` configuration and add the following line (where `loghost.example.com` is the name of your central log host). The `target` directive may either be a fully qualified domain name or an IP address. \n\n*Example script to create a drop\\-in configuration file:* \n\nRun the following command to reload `rsyslog.service`:\n\n```\n# systemctl reload-or-restart rsyslog.service\n```\n\n```\n#!/usr/bin/env bash\n\n{\n a_parameters=('*.* action(type=\"omfwd\" target=\"loghost.example.com\" port=\"514\" protocol=\"tcp\"' \\\n ' action.resumeRetryCount=\"100\"' ' queue.type=\"LinkedList\" queue.size=\"1000\")')\n [ ! -d \"/etc/rsyslog.d/\" ] && mkdir /etc/rsyslod.d/\n printf '%s\\n' \"\" \"${a_parameters[@]}\" >> /etc/rsyslog.d/60-rsyslog.conf\n}\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.006_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#d3fb7d51-e3ac-4daa-a809-feba8099d5ee"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-6"},{"name":"marking","class":"Reference","value":"See the rsyslog.conf(5) man page for more information."}]}],"props":[{"name":"label","value":"6.1.3.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.6_Ensure_rsyslog_is_configured_to_send_logs_to_a_remote_log_host"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure rsyslog is configured to send logs to a remote log host"},{"id":"cisb-ubnt24.04lts-006.001.003.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`rsyslog` supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts."},{"id":"cisb-ubnt24.04lts-006.001.003.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a client is configured to also receive data, thus turning it into a server, the client system is acting outside its operational boundary."},{"id":"cisb-ubnt24.04lts-006.001.003.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Unless the system's primary function is to serve as a logfile server , modify the files returned by the Audit Procedure and remove the specific lines highlighted by the audit. Verify none of the following entries are present in the `rsyslog` configuration. \n\n**advanced format** \n\n**deprecated legacy format** \n\nReload the service:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n$ModLoad imtcp\n$InputTCPServerRun\n```\n\n```\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Unless the system's primary function is to serve as a logfile server , modify the files returned by the Audit Procedure and remove the specific lines highlighted by the audit. Verify none of the following entries are present in the `rsyslog` configuration. \n\n**advanced format** \n\n**deprecated legacy format** \n\nReload the service:\n\n```\n# systemctl reload-or-restart rsyslog\n```\n\n```\n$ModLoad imtcp\n$InputTCPServerRun\n```\n\n```\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")\n```"},{"id":"cisb-ubnt24.04lts-006.001.003.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#fb274140-ae9f-4906-8368-cf3834a627ef"},{"rel":"reference","href":"#5eec8a4f-8bc3-4a46-8d7b-8afec033db20"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.007_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#c2689211-d61e-42eb-a1c7-d22d241de36f"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-7, AU-12, CM-6"}]}],"props":[{"name":"label","value":"6.1.3.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.7_Ensure_rsyslog_is_not_configured_to_receive_logs_from_a_remote_client"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure rsyslog is not configured to receive logs from a remote client"},{"id":"cisb-ubnt24.04lts-006.001.003.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.003.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.003.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The system includes the capability of rotating log files regularly to avoid filling up the system with logs or making the logs unmanageably large. The file `/etc/logrotate.d/rsyslog` is the configuration file used to rotate log files created by `rsyslog`."},{"id":"cisb-ubnt24.04lts-006.001.003.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"By keeping the log files smaller and more manageable, a system administrator can easily archive these files to another system and spend less time looking through inordinately large log files."},{"id":"cisb-ubnt24.04lts-006.001.003.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/logrotate.conf`, or the appropriate configuration file provided by the script in the Audit Procedure, as necessary to ensure logs are rotated according to site policy."},{"id":"cisb-ubnt24.04lts-006.001.003.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/logrotate.conf`, or the appropriate configuration file provided by the script in the Audit Procedure, as necessary to ensure logs are rotated according to site policy."},{"id":"cisb-ubnt24.04lts-006.001.003.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.003.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-8"}]}],"props":[{"name":"label","value":"6.1.3.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.3.8_Ensure_logrotate_is_configured"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure logrotate is configured"}]},{"id":"cisb-ubnt24.04lts-006.001.004_grp","parts":[{"id":"cisb-ubnt24.04lts-006.001.004_ovrvw","name":"overview","prose":""}],"props":[{"name":"label","value":"6.1.4"}],"title":"Configure Logfiles","controls":[{"id":"cisb-ubnt24.04lts-006.001.004.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.001.004.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.001.004.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Log files contain information from many services on the the local system, or in the event of a centralized log server, others systems logs as well.\n\nIn general log files are found in `/var/log/`, although application can be configured to store logs elsewhere. Should your application store logs in another, ensure to run the same test on that location."},{"id":"cisb-ubnt24.04lts-006.001.004.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important that log files have the correct permissions to ensure that sensitive data is protected and that only the appropriate users / groups have access to them."},{"id":"cisb-ubnt24.04lts-006.001.004.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following script to update permissions and ownership on files in `/var/log`. \n\nAlthough the script is not destructive, ensure that the output of the audit procedure is captured in the event that the remediation causes issues. \n\n**Note:** You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions. \n\nIf there are services that log to other locations, ensure that those log files have the appropriate permissions.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=()\n f_file_test_fix()\n {\n a_out2=()\n maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\"\n if [ $(( $l_mode & $perm_mask )) -gt 0 ]; then\n a_out2+=(\" o Mode: \\\"$l_mode\\\" should be \\\"$maxperm\\\" or more restrictive\" \" x Removing excess permissions\")\n chmod \"$l_rperms\" \"$l_fname\"\n fi\n if [[ ! \"$l_user\" =~ $l_auser ]]; then\n a_out2+=(\" o Owned by: \\\"$l_user\\\" and should be owned by \\\"${l_auser//|/ or }\\\"\" \" x Changing ownership to: \\\"$l_fix_account\\\"\")\n chown \"$l_fix_account\" \"$l_fname\"\n fi\n if [[ ! \"$l_group\" =~ $l_agroup ]]; then\n a_out2+=(\" o Group owned by: \\\"$l_group\\\" and should be group owned by \\\"${l_agroup//|/ or }\\\"\" \" x Changing group ownership to: \\\"$l_fix_account\\\"\")\n chgrp \"$l_fix_account\" \"$l_fname\"\n fi\n [ \"${#a_out2[@]}\" -gt 0 ] && a_output2+=(\" - File: \\\"$l_fname\\\" is:\" \"${a_out2[@]}\")\n }\n l_fix_account='root'\n while IFS= read -r -d $'\\0' l_file; do\n while IFS=: read -r l_fname l_mode l_user l_group; do\n if grep -Pq -- '\\/(apt)\\h*$' <<< \"$(dirname \"$l_fname\")\"; then\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"root\" l_agroup=\"(root|adm)\"; f_file_test_fix\n else\n case \"$(basename \"$l_fname\")\" in\n lastlog | lastlog.* | wtmp | wtmp.* | wtmp-* | btmp | btmp.* | btmp-* | README)\n perm_mask='0113' l_rperms=\"ug-x,o-wx\" l_auser=\"root\" l_agroup=\"(root|utmp)\"\n f_file_test_fix ;;\n cloud-init.log* | localmessages* | waagent.log*)\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n file_test_fix ;;\n secure | auth.log | syslog | messages)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n f_file_test_fix ;;\n SSSD | sssd)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"(root|SSSD)\" l_agroup=\"(root|SSSD)\"\n f_file_test_fix ;;\n gdm | gdm3)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"root\" l_agroup=\"(root|gdm|gdm3)\"\n f_file_test_fix ;;\n *.journal | *.journal~)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"root\" l_agroup=\"(root|systemd-journal)\"\n f_file_test_fix ;;\n *)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n if [ \"$l_user\" = \"root\" ] || ! grep -Pq -- \"^\\h*$(awk -F: '$1==\"'\"$l_user\"'\" {print $7}' /etc/passwd)\\b\" /etc/shells; then\n ! grep -Pq -- \"$l_auser\" <<< \"$l_user\" && l_auser=\"(root|syslog|$l_user)\"\n ! grep -Pq -- \"$l_agroup\" <<< \"$l_group\" && l_agroup=\"(root|adm|$l_group)\"\n fi\n f_file_test_fix ;;\n esac\n fi\n done < <(stat -Lc '%n:%#a:%U:%G' \"$l_file\")\n done < <(find -L /var/log -type f \\( -perm /0137 -o ! -user root -o ! -group root \\) -print0)\n if [ \"${#a_output2[@]}\" -le 0 ]; then # If all files passed, then we report no changes\n a_output+=(\" - All files in \\\"/var/log/\\\" have appropriate permissions and ownership\")\n printf '\\n%s' \"- All files in \\\"/var/log/\\\" have appropriate permissions and ownership\" \" o No changes required\" \"\"\n else\n printf '\\n%s' \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-006.001.004.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following script to update permissions and ownership on files in `/var/log`. \n\nAlthough the script is not destructive, ensure that the output of the audit procedure is captured in the event that the remediation causes issues. \n\n**Note:** You may also need to change the configuration for your logging software or services for any logs that had incorrect permissions. \n\nIf there are services that log to other locations, ensure that those log files have the appropriate permissions.\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=()\n f_file_test_fix()\n {\n a_out2=()\n maxperm=\"$( printf '%o' $(( 0777 & ~$perm_mask)) )\"\n if [ $(( $l_mode & $perm_mask )) -gt 0 ]; then\n a_out2+=(\" o Mode: \\\"$l_mode\\\" should be \\\"$maxperm\\\" or more restrictive\" \" x Removing excess permissions\")\n chmod \"$l_rperms\" \"$l_fname\"\n fi\n if [[ ! \"$l_user\" =~ $l_auser ]]; then\n a_out2+=(\" o Owned by: \\\"$l_user\\\" and should be owned by \\\"${l_auser//|/ or }\\\"\" \" x Changing ownership to: \\\"$l_fix_account\\\"\")\n chown \"$l_fix_account\" \"$l_fname\"\n fi\n if [[ ! \"$l_group\" =~ $l_agroup ]]; then\n a_out2+=(\" o Group owned by: \\\"$l_group\\\" and should be group owned by \\\"${l_agroup//|/ or }\\\"\" \" x Changing group ownership to: \\\"$l_fix_account\\\"\")\n chgrp \"$l_fix_account\" \"$l_fname\"\n fi\n [ \"${#a_out2[@]}\" -gt 0 ] && a_output2+=(\" - File: \\\"$l_fname\\\" is:\" \"${a_out2[@]}\")\n }\n l_fix_account='root'\n while IFS= read -r -d $'\\0' l_file; do\n while IFS=: read -r l_fname l_mode l_user l_group; do\n if grep -Pq -- '\\/(apt)\\h*$' <<< \"$(dirname \"$l_fname\")\"; then\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"root\" l_agroup=\"(root|adm)\"; f_file_test_fix\n else\n case \"$(basename \"$l_fname\")\" in\n lastlog | lastlog.* | wtmp | wtmp.* | wtmp-* | btmp | btmp.* | btmp-* | README)\n perm_mask='0113' l_rperms=\"ug-x,o-wx\" l_auser=\"root\" l_agroup=\"(root|utmp)\"\n f_file_test_fix ;;\n cloud-init.log* | localmessages* | waagent.log*)\n perm_mask='0133' l_rperms=\"u-x,go-wx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n file_test_fix ;;\n secure | auth.log | syslog | messages)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n f_file_test_fix ;;\n SSSD | sssd)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"(root|SSSD)\" l_agroup=\"(root|SSSD)\"\n f_file_test_fix ;;\n gdm | gdm3)\n perm_mask='0117' l_rperms=\"ug-x,o-rwx\" l_auser=\"root\" l_agroup=\"(root|gdm|gdm3)\"\n f_file_test_fix ;;\n *.journal | *.journal~)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"root\" l_agroup=\"(root|systemd-journal)\"\n f_file_test_fix ;;\n *)\n perm_mask='0137' l_rperms=\"u-x,g-wx,o-rwx\" l_auser=\"(root|syslog)\" l_agroup=\"(root|adm)\"\n if [ \"$l_user\" = \"root\" ] || ! grep -Pq -- \"^\\h*$(awk -F: '$1==\"'\"$l_user\"'\" {print $7}' /etc/passwd)\\b\" /etc/shells; then\n ! grep -Pq -- \"$l_auser\" <<< \"$l_user\" && l_auser=\"(root|syslog|$l_user)\"\n ! grep -Pq -- \"$l_agroup\" <<< \"$l_group\" && l_agroup=\"(root|adm|$l_group)\"\n fi\n f_file_test_fix ;;\n esac\n fi\n done < <(stat -Lc '%n:%#a:%U:%G' \"$l_file\")\n done < <(find -L /var/log -type f \\( -perm /0137 -o ! -user root -o ! -group root \\) -print0)\n if [ \"${#a_output2[@]}\" -le 0 ]; then # If all files passed, then we report no changes\n a_output+=(\" - All files in \\\"/var/log/\\\" have appropriate permissions and ownership\")\n printf '\\n%s' \"- All files in \\\"/var/log/\\\" have appropriate permissions and ownership\" \" o No changes required\" \"\"\n else\n printf '\\n%s' \"${a_output2[@]}\" \"\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-006.001.004.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.001.004.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"6.1.4.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.1.4.1_Ensure_access_to_all_logfiles_has_been_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure access to all logfiles has been configured"}]}]},{"id":"cisb-ubnt24.04lts-006.002_grp","parts":[{"id":"cisb-ubnt24.04lts-006.002_ovrvw","name":"overview","prose":"The Linux Auditing System operates on a set of rules that collects certain types of system activity to facilitate incident investigation, detect unauthorized access or modification of data. By default events will be logged to `/var/log/audit/audit.log`, which can be configured in `/etc/audit/auditd.conf`.\n\nThe following types of audit rules can be specified:\n\n- Control rules: Configuration of the auditing system.\n- File system rules: Allow the auditing of access to a particular file or a directory. Also known as file watches.\n- System call rules: Allow logging of system calls that any specified program makes.\n\nAudit rules can be set:\n\n- On the command line using the `auditctl` utility. These rules are not persistent across reboots.\n- In `/etc/audit/audit.rules`. These rules have to be merged and loaded before they are active.\n\n**Notes:**\n\n- For 64 bit systems that have `arch` as a rule parameter, you will need two rules: one for 64 bit and one for 32 bit systems calls.\n- If the auditing system is configured to be locked (`-e 2`), a system reboot will be required in order to load any changes.\n- Key names are optional on the rules and will not be used as a compliance auditing. The usage of key names is highly recommended as it facilitates organization and searching, as such, all remediation steps will have key names supplied.\n- It is best practice to store the rules, in number prepended files, in `/etc/audit/rules.d/`. Rules must end in a `.rules` suffix. This then requires the use of `augenrules` to merge all the rules into `/etc/audit/audit.rules` based on their their alphabetical (lexical) sort order. All benchmark recommendations follow this best practice for remediation, specifically using the prefix of `50` which is centre weighed if all rule sets make use of the number prepending naming convention.\n- Your system may have been customized to change the default `UID_MIN`. All samples output uses `1000`, but this value will not be used in compliance auditing. To confirm the `UID_MIN` for your system, run the following command: `awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs`\n\n**Normalization**\n\nThe Audit system normalizes some entries, so when you look at the sample output keep in mind that:\n\n- With regards to users whose login UID is not set, the values `-1` / `unset` / `4294967295` are equivalent and normalized to `-1`.\n- When comparing field types and both sides of the comparison is valid fields types, such as`euid!=uid`, then the auditing system may normalize such that the output is `uid!=euid`.\n- Some parts of the rule may be rearranged whilst others are dependant on previous syntax. For example, the following two statements are the same:\n\n```\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F auid!=-1 -F key=user_emulation\n```\n\nand\n\n```\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n```\n\n**Capacity planning**\n\nThe recommendations in this section implement auditing policies that not only produces large quantities of logged data, but may also negatively impact system performance. Capacity planning is critical in order not to adversely impact production environments.\n\n- Disk space. If a significantly large set of events are captured, additional on system or off system storage may need to be allocated. If the logs are not sent to a remote log server, ensure that log rotation is implemented else the disk will fill up and the system will halt. Even when logs are sent to a log server, ensure sufficient disk space to allow caching of logs in the case of temporary network outages.\n- Disk IO. It is not just the amount of data collected that should be considered, but the rate at which logs are generated.\n- CPU overhead. System call rules might incur considerable CPU overhead. Test the systems open/close syscalls per second with and without the rules to gauge the impact of the rules."}],"props":[{"name":"label","value":"6.2"}],"title":"System Auditing","groups":[{"id":"cisb-ubnt24.04lts-006.002.001_grp","parts":[{"id":"cisb-ubnt24.04lts-006.002.001_ovrvw","name":"overview","prose":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring."}],"props":[{"name":"label","value":"6.2.1"}],"title":"Configure auditd Service","controls":[{"id":"cisb-ubnt24.04lts-006.002.001.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk"},{"id":"cisb-ubnt24.04lts-006.002.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring."},{"id":"cisb-ubnt24.04lts-006.002.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to Install `auditd` and `audispd-plugins`\n\n```\n# apt install auditd audispd-plugins\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to Install `auditd` and `audispd-plugins`\n\n```\n# apt install auditd audispd-plugins\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.1.1_Ensure_auditd_packages_are_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure auditd packages are installed"},{"id":"cisb-ubnt24.04lts-006.002.001.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Turn on the `auditd` daemon to record system events."},{"id":"cisb-ubnt24.04lts-006.002.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The capturing of system events provides system administrators with information to allow them to determine if unauthorized access to their system is occurring."},{"id":"cisb-ubnt24.04lts-006.002.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to unmask, enable and start `auditd`:\n\n```\n# systemctl unmask auditd\n# systemctl enable auditd\n# systemctl start auditd\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to unmask, enable and start `auditd`:\n\n```\n# systemctl unmask auditd\n# systemctl enable auditd\n# systemctl start auditd\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.1.2_Ensure_auditd_service_is_enabled_and_active"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure auditd service is enabled and active"},{"id":"cisb-ubnt24.04lts-006.002.001.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure `grub2` so that processes that are capable of being audited can be audited even if they start up prior to `auditd` startup."},{"id":"cisb-ubnt24.04lts-006.002.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Audit events need to be captured on processes that start up prior to `auditd` , so that potential malicious activity cannot go undetected."},{"id":"cisb-ubnt24.04lts-006.002.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/default/grub` and add `audit=1` to `GRUB_CMDLINE_LINUX`: \n\nExample: \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"audit=1\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/default/grub` and add `audit=1` to `GRUB_CMDLINE_LINUX`: \n\nExample: \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"audit=1\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12"}]}],"props":[{"name":"label","value":"6.2.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.1.3_Ensure_auditing_for_processes_that_start_prior_to_auditd_is_enabled"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure auditing for processes that start prior to auditd is enabled"},{"id":"cisb-ubnt24.04lts-006.002.001.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"In the kernel\\-level audit subsystem, a socket buffer queue is used to hold audit events. Whenever a new audit event is received, it is logged and prepared to be added to this queue.\n\nThe kernel boot parameter `audit_backlog_limit=N`, with `N` representing the amount of messages, will ensure that a queue cannot grow beyond a certain size. If an audit event is logged which would grow the queue beyond this limit, then a failure occurs and is handled according to the system configuration"},{"id":"cisb-ubnt24.04lts-006.002.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If an audit event is logged which would grow the queue beyond the `audit_backlog_limit`, then a failure occurs, auditd records will be lost, and potential malicious activity could go undetected."},{"id":"cisb-ubnt24.04lts-006.002.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit `/etc/default/grub` and add `audit_backlog_limit=N` to GRUB\\_CMDLINE\\_LINUX. The recommended size for `N` is `8192` or larger. \n\nExample: \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"audit_backlog_limit=8192\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit `/etc/default/grub` and add `audit_backlog_limit=N` to GRUB\\_CMDLINE\\_LINUX. The recommended size for `N` is `8192` or larger. \n\nExample: \n\nRun the following command to update the `grub2` configuration:\n\n```\n# update-grub\n```\n\n```\nGRUB_CMDLINE_LINUX=\"audit_backlog_limit=8192\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-3, AU-12"}]}],"props":[{"name":"label","value":"6.2.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.1.4_Ensure_audit_backlog_limit_is_sufficient"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit_backlog_limit is sufficient"}]},{"id":"cisb-ubnt24.04lts-006.002.002_grp","parts":[{"id":"cisb-ubnt24.04lts-006.002.002_ovrvw","name":"overview","prose":"When auditing, it is important to carefully configure the storage requirements for audit logs. By default, auditd will max out the log files at 5MB and retain only 4 copies of them. Older versions will be deleted. It is possible on a system that the 20 MBs of audit logs may fill up the system causing loss of audit data. While the recommendations here provide guidance, check your site policy for audit storage requirements."}],"props":[{"name":"label","value":"6.2.2"}],"title":"Configure Data Retention","controls":[{"id":"cisb-ubnt24.04lts-006.002.002.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Configure the maximum size of the audit log file. Once the log reaches the maximum size, it will be rotated and a new log file will be started."},{"id":"cisb-ubnt24.04lts-006.002.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is important that an appropriate size is determined for log files so that they do not impact the system and audit data is not lost."},{"id":"cisb-ubnt24.04lts-006.002.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/audit/auditd.conf` in accordance with site policy:\n\n```\nmax_log_file =\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/audit/auditd.conf` in accordance with site policy:\n\n```\nmax_log_file =\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-8"}]}],"props":[{"name":"label","value":"6.2.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.2.1_Ensure_audit_log_storage_size_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit log storage size is configured"},{"id":"cisb-ubnt24.04lts-006.002.002.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `max_log_file_action` setting determines how to handle the audit log file reaching the max file size. A value of `keep_logs` will rotate the logs but never delete old logs."},{"id":"cisb-ubnt24.04lts-006.002.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"In high security contexts, the benefits of maintaining a long audit history exceed the cost of storing the audit history."},{"id":"cisb-ubnt24.04lts-006.002.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the following parameter in `/etc/audit/auditd.conf:`\n\n```\nmax_log_file_action = keep_logs\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the following parameter in `/etc/audit/auditd.conf:`\n\n```\nmax_log_file_action = keep_logs\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-8"}]}],"props":[{"name":"label","value":"6.2.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.2.2_Ensure_audit_logs_are_not_automatically_deleted"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit logs are not automatically deleted"},{"id":"cisb-ubnt24.04lts-006.002.002.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `auditd` daemon can be configured to halt the system or put the system in single user mode, if no free space is available or an error is detected on the partition that holds the audit log files.\n\nThe `disk_full_action` parameter tells the system what action to take when no free space is available on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `rotate`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will issue a syslog message but no other action is taken\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `exec`, /path\\-to\\-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `disk_error_action` parameter tells the system what action to take when an error is detected on the partition that holds the audit log files. Valid values are `ignore`, `syslog`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon will not take any action\n- `syslog`, the audit daemon will issue no more than 5 consecutive warnings to syslog\n- `exec`, /path\\-to\\-script will execute the script. You cannot pass parameters to the script\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system"},{"id":"cisb-ubnt24.04lts-006.002.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability."},{"id":"cisb-ubnt24.04lts-006.002.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set one of the following parameters in `/etc/audit/auditd.conf` depending on your local security policies. \n\n*Example:* \n\nImpact: \n\n`disk_full_action` parameter: \n\n- Set to `halt` \\- the `auditd` daemon will shutdown the system when the disk partition containing the audit logs becomes full.\n- Set to `single` \\- the `auditd` daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.\n\n`disk_error_action` parameter: \n\n- Set to `halt` \\- the `auditd` daemon will shutdown the system when an error is detected on the partition that holds the audit log files.\n- Set to `single` \\- the `auditd` daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files.\n- Set to `syslog` \\- the `auditd` daemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files.\n\n```\ndisk_full_action = halt\ndisk_error_action = halt\n```\n\n```\ndisk_full_action =\ndisk_error_action =\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set one of the following parameters in `/etc/audit/auditd.conf` depending on your local security policies. \n\n*Example:* \n\nImpact: \n\n`disk_full_action` parameter: \n\n- Set to `halt` \\- the `auditd` daemon will shutdown the system when the disk partition containing the audit logs becomes full.\n- Set to `single` \\- the `auditd` daemon will put the computer system in single user mode when the disk partition containing the audit logs becomes full.\n\n`disk_error_action` parameter: \n\n- Set to `halt` \\- the `auditd` daemon will shutdown the system when an error is detected on the partition that holds the audit log files.\n- Set to `single` \\- the `auditd` daemon will put the computer system in single user mode when an error is detected on the partition that holds the audit log files.\n- Set to `syslog` \\- the `auditd` daemon will issue no more than 5 consecutive warnings to syslog when an error is detected on the partition that holds the audit log files.\n\n```\ndisk_full_action = halt\ndisk_error_action = halt\n```\n\n```\ndisk_full_action =\ndisk_error_action =\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"AUDITD.CONF(5)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-8, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.2.3_Ensure_system_is_disabled_when_audit_logs_are_full"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure system is disabled when audit logs are full"},{"id":"cisb-ubnt24.04lts-006.002.002.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `auditd` daemon can be configured to halt the system, put the system in single user mode or send a warning message, if the partition that holds the audit log files is low on space.\n\nThe `space_left_action` parameter tells the system what action to take when the system has detected that it is starting to get low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path\\-to\\-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system\n\nThe `admin_space_left_action` parameter tells the system what action to take when the system has detected that it is low on disk space. Valid values are `ignore`, `syslog`, `rotate`, `email`, `exec`, `suspend`, `single`, and `halt`.\n\n- `ignore`, the audit daemon does nothing\n- `syslog`, the audit daemon will issue a warning to syslog\n- `rotate`, the audit daemon will rotate logs, losing the oldest to free up space\n- `email`, the audit daemon will send a warning to the email account specified in `action_mail_acct` as well as sending the message to syslog\n- `exec`, /path\\-to\\-script will execute the script. You cannot pass parameters to the script. The script is also responsible for telling the auditd daemon to resume logging once its completed its action\n- `suspend`, the audit daemon will stop writing records to the disk\n- `single`, the audit daemon will put the computer system in single user mode\n- `halt`, the audit daemon will shut down the system"},{"id":"cisb-ubnt24.04lts-006.002.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"In high security contexts, the risk of detecting unauthorized access or nonrepudiation exceeds the benefit of the system's availability."},{"id":"cisb-ubnt24.04lts-006.002.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Set the `space_left_action` parameter in `/etc/audit/auditd.conf` to `email`, `exec`, `single`, or `halt`: \n\n*Example:* \n\nSet the `admin_space_left_action` parameter in `/etc/audit/auditd.conf` to `single` or `halt`: \n\n*Example:* \n\n**Note:** A Mail Transfer Agent (MTA) must be installed and configured properly to set `space_left_action = email` \n\nImpact: \n\nIf the `admin_space_left_action` is set to `single` the audit daemon will put the computer system in single user mode.\n\n```\nadmin_space_left_action = single\n```\n\n```\nspace_left_action = email\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Set the `space_left_action` parameter in `/etc/audit/auditd.conf` to `email`, `exec`, `single`, or `halt`: \n\n*Example:* \n\nSet the `admin_space_left_action` parameter in `/etc/audit/auditd.conf` to `single` or `halt`: \n\n*Example:* \n\n**Note:** A Mail Transfer Agent (MTA) must be installed and configured properly to set `space_left_action = email` \n\nImpact: \n\nIf the `admin_space_left_action` is set to `single` the audit daemon will put the computer system in single user mode.\n\n```\nadmin_space_left_action = single\n```\n\n```\nspace_left_action = email\n```"},{"id":"cisb-ubnt24.04lts-006.002.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#24ef9463-3c0b-434c-9da1-f4bec7791491"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"AUDITD.CONF(5)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-8, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.2.4_Ensure_system_warns_when_audit_logs_are_low_on_space"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure system warns when audit logs are low on space"}]},{"id":"cisb-ubnt24.04lts-006.002.003_grp","parts":[{"id":"cisb-ubnt24.04lts-006.002.003_ovrvw","name":"overview","prose":"The Audit system operates on a set of rules that define what is to be captured in the log files.\n\nThe following types of Audit rules can be specified:\n\n- Control rules: Allow the Audit system's behavior and some of its configuration to be modified.\n- File system rules: Allow the auditing of access to a particular file or a directory. (Also known as file watches)\n- System call rules: Allow logging of system calls that any specified program makes.\n\nAudit rules can be set:\n\n- on the command line using the auditctl utility. Note that these rules are not persistent across reboots.\n- in a file ending in `.rules` in the `/etc/audit/rules.d/` directory.\n\n**Note:** The Linux Benchmarks are written and tested against x86\\_64 processor architecture. If you are running a different processor type, please review and update the audit rules for the processor architecture of the system"}],"props":[{"name":"label","value":"6.2.3"}],"title":"Configure auditd Rules","controls":[{"id":"cisb-ubnt24.04lts-006.002.003.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor scope changes for system administrators. If the system has been properly configured to force system administrators to log in as themselves first and then use the `sudo` command to execute privileged commands, it is possible to monitor changes in scope. The file `/etc/sudoers`, or files in `/etc/sudoers.d`, will be written to when the file(s) or related attributes have changed. The audit records will be tagged with the identifier \"scope\"."},{"id":"cisb-ubnt24.04lts-006.002.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Changes in the `/etc/sudoers` and `/etc/sudoers.d` files can indicate that an unauthorized change has been made to the scope of system administrator activity."},{"id":"cisb-ubnt24.04lts-006.002.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor scope changes for system administrators. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n\" >> /etc/audit/rules.d/50-scope.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor scope changes for system administrators. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/sudoers -p wa -k scope\n-w /etc/sudoers.d -p wa -k scope\n\" >> /etc/audit/rules.d/50-scope.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#9e444207-45c1-4c7e-a5c3-7c92f4919564"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.1_Ensure_changes_to_system_administration_scope_sudoers_is_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure changes to system administration scope (sudoers) is collected"},{"id":"cisb-ubnt24.04lts-006.002.003.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`sudo` provides users with temporary elevated privileges to perform operations, either as the superuser or another user."},{"id":"cisb-ubnt24.04lts-006.002.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Creating an audit log of users with temporary elevated privileges and the operation(s) they performed is essential to reporting. Administrators will want to correlate the events written to the audit trail with the records written to `sudo`'s logfile to verify if unauthorized commands have been executed."},{"id":"cisb-ubnt24.04lts-006.002.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor elevated privileges. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n\" >> /etc/audit/rules.d/50-user_emulation.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor elevated privileges. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation\n\" >> /etc/audit/rules.d/50-user_emulation.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#2adc0f62-07fc-411e-bbf0-2146e9789019"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.2_Ensure_actions_as_another_user_are_always_logged"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure actions as another user are always logged"},{"id":"cisb-ubnt24.04lts-006.002.003.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor the `sudo` log file. If the system has been properly configured to disable the use of the `su` command and force all administrators to have to log in first and then use `sudo` to execute privileged commands, then all administrator commands will be logged to `/var/log/sudo.log` . Any time a command is executed, an audit event will be triggered as the `/var/log/sudo.log` file will be opened for write and the executed administration command will be written to the log."},{"id":"cisb-ubnt24.04lts-006.002.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Changes in `/var/log/sudo.log` indicate that an administrator has executed a command or the log file itself has been tampered with. Administrators will want to correlate the events written to the audit trail with the records written to `/var/log/sudo.log` to verify if unauthorized commands have been executed."},{"id":"cisb-ubnt24.04lts-006.002.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Note:** This recommendation requires that the sudo logfile is configured. See guidance provided in the recommendation \"Ensure sudo log file exists\" \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the sudo log file. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nSUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g')\n[ -n \"${SUDO_LOG_FILE}\" ] && printf \"\n-w ${SUDO_LOG_FILE} -p wa -k sudo_log_file\n\" >> /etc/audit/rules.d/50-sudo.rules || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Note:** This recommendation requires that the sudo logfile is configured. See guidance provided in the recommendation \"Ensure sudo log file exists\" \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the sudo log file. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nSUDO_LOG_FILE=$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//' -e 's/\"//g')\n[ -n \"${SUDO_LOG_FILE}\" ] && printf \"\n-w ${SUDO_LOG_FILE} -p wa -k sudo_log_file\n\" >> /etc/audit/rules.d/50-sudo.rules || printf \"ERROR: Variable 'SUDO_LOG_FILE' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#2adc0f62-07fc-411e-bbf0-2146e9789019"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"6.2.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.3_Ensure_events_that_modify_the_sudo_log_file_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure events that modify the sudo log file are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the;\n\n- `adjtimex` \\- tune kernel clock\n- `settimeofday` \\- set time using `timeval` and `timezone` structures\n- `stime` \\- using seconds since 1/1/1970\n- `clock_settime` \\- allows for the setting of several internal clocks and timers\n\nsystem calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as \"time\\-change\"."},{"id":"cisb-ubnt24.04lts-006.002.003.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unexpected changes in system date and/or time could be a sign of malicious activity on the system."},{"id":"cisb-ubnt24.04lts-006.002.003.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify date and time information. \n\nExample: \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change\n-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change\n-w /etc/localtime -p wa -k time-change\n\" >> /etc/audit/rules.d/50-time-change.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify date and time information. \n\nExample: \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change\n-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change\n-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change\n-w /etc/localtime -p wa -k time-change\n\" >> /etc/audit/rules.d/50-time-change.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#d4aa4e81-f9d3-4f3f-8b09-a0af9289b606"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, CM-6"}]}],"props":[{"name":"label","value":"6.2.3.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.4_Ensure_events_that_modify_date_and_time_information_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure events that modify date and time information are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.005_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Record changes to network environment files or system calls. The below parameters monitors the following system calls, and write an audit event on system call exit:\n\n- `sethostname` \\- set the systems host name\n- `setdomainname` \\- set the systems domain name\n\nThe files being monitored are:\n\n- `/etc/issue` and `/etc/issue.net` \\- messages displayed pre\\-login\n- `/etc/hosts` \\- file containing host names and associated IP addresses\n- `/etc/networks` \\- symbolic names for networks\n- `/etc/network/` \\- directory containing network interface scripts and configurations files\n- `/etc/netplan/` \\- central location for YAML networking configurations files"},{"id":"cisb-ubnt24.04lts-006.002.003.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring system events that change network environments, such as `sethostname` and `setdomainname`, helps identify unauthorized alterations to host and domain names, which could compromise security settings reliant on these names. Changes to `/etc/hosts` can signal unauthorized attempts to alter machine associations with IP addresses, potentially redirecting users and processes to unintended destinations. Surveillance of `/etc/issue` and `/etc/issue.net` is crucial to detect intruders inserting false information to deceive users. Monitoring `/etc/network/` reveals modifications to network interfaces or scripts that may jeopardize system availability or security. Additionally, tracking changes in the `/etc/netplan/` directory ensures swift detection of unauthorized adjustments to network configurations. All audit records should be appropriately tagged for relevance"},{"id":"cisb-ubnt24.04lts-006.002.003.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's network environment. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale\n-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale\n-w /etc/issue -p wa -k system-locale\n-w /etc/issue.net -p wa -k system-locale\n-w /etc/hosts -p wa -k system-locale\n-w /etc/networks -p wa -k system-locale\n-w /etc/network/ -p wa -k system-locale\n-w /etc/netplan/ -p wa -k system-locale\n\" >> /etc/audit/rules.d/50-system_locale.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's network environment. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale\n-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale\n-w /etc/issue -p wa -k system-locale\n-w /etc/issue.net -p wa -k system-locale\n-w /etc/hosts -p wa -k system-locale\n-w /etc/networks -p wa -k system-locale\n-w /etc/network/ -p wa -k system-locale\n-w /etc/netplan/ -p wa -k system-locale\n\" >> /etc/audit/rules.d/50-system_locale.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#d4aa4e81-f9d3-4f3f-8b09-a0af9289b606"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.005_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#71a6084a-98e7-401b-88ce-841ca299b9cd"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, CM-6"}]}],"props":[{"name":"label","value":"6.2.3.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.5_Ensure_events_that_modify_the_systems_network_environment_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure events that modify the system's network environment are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.006_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor privileged programs, those that have the `setuid` and/or `setgid` bit set on execution, to determine if unprivileged users are running these commands."},{"id":"cisb-ubnt24.04lts-006.002.003.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Execution of privileged commands by non\\-privileged users could be an indication of someone trying to gain unauthorized access to the system."},{"id":"cisb-ubnt24.04lts-006.002.003.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor the use of privileged commands. \n\n*Example script:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required. \n\n**Special mount points** \n\nIf there are any special mount points that are not visible by default from just scanning `/`, change the `PARTITION` variable to the appropriate partition and re\\-run the remediation. \n\nImpact: \n\nBoth the audit and remediation section of this recommendation will traverse all mounted file systems that is not mounted with either `noexec` or `nosuid` mount options. If there are large file systems without these mount options, **such traversal will be significantly detrimental to the performance of the system.** \n\nBefore running either the audit or remediation section, inspect the output of the following command to determine exactly which file systems will be traversed: \n\nTo exclude a particular file system due to adverse performance impacts, update the audit and remediation sections by adding a sufficiently unique string to the `grep` statement. The above command can be used to test the modified exclusions.\n\n```\n# findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\"\n```\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n AUDIT_RULE_FILE=\"/etc/audit/rules.d/50-privileged.rules\"\n NEW_DATA=()\n for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\" | awk '{print $1}'); do\n readarray -t DATA < <(find \"${PARTITION}\" -xdev -perm /6000 -type f | awk -v UID_MIN=${UID_MIN} '{print \"-a always,exit -F path=\" $1 \" -F perm=x -F auid>=\"UID_MIN\" -F auid!=unset -k privileged\" }')\n for ENTRY in \"${DATA[@]}\"; do\n NEW_DATA+=(\"${ENTRY}\")\n done\n done\n readarray &> /dev/null -t OLD_DATA < \"${AUDIT_RULE_FILE}\"\n COMBINED_DATA=( \"${OLD_DATA[@]}\" \"${NEW_DATA[@]}\" )\n printf '%s\\n' \"${COMBINED_DATA[@]}\" | sort -u > \"${AUDIT_RULE_FILE}\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor the use of privileged commands. \n\n*Example script:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required. \n\n**Special mount points** \n\nIf there are any special mount points that are not visible by default from just scanning `/`, change the `PARTITION` variable to the appropriate partition and re\\-run the remediation. \n\nImpact: \n\nBoth the audit and remediation section of this recommendation will traverse all mounted file systems that is not mounted with either `noexec` or `nosuid` mount options. If there are large file systems without these mount options, **such traversal will be significantly detrimental to the performance of the system.** \n\nBefore running either the audit or remediation section, inspect the output of the following command to determine exactly which file systems will be traversed: \n\nTo exclude a particular file system due to adverse performance impacts, update the audit and remediation sections by adding a sufficiently unique string to the `grep` statement. The above command can be used to test the modified exclusions.\n\n```\n# findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\"\n```\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n AUDIT_RULE_FILE=\"/etc/audit/rules.d/50-privileged.rules\"\n NEW_DATA=()\n for PARTITION in $(findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,) | grep -Pv \"noexec|nosuid\" | awk '{print $1}'); do\n readarray -t DATA < <(find \"${PARTITION}\" -xdev -perm /6000 -type f | awk -v UID_MIN=${UID_MIN} '{print \"-a always,exit -F path=\" $1 \" -F perm=x -F auid>=\"UID_MIN\" -F auid!=unset -k privileged\" }')\n for ENTRY in \"${DATA[@]}\"; do\n NEW_DATA+=(\"${ENTRY}\")\n done\n done\n readarray &> /dev/null -t OLD_DATA < \"${AUDIT_RULE_FILE}\"\n COMBINED_DATA=( \"${OLD_DATA[@]}\" \"${NEW_DATA[@]}\" )\n printf '%s\\n' \"${COMBINED_DATA[@]}\" | sort -u > \"${AUDIT_RULE_FILE}\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, AU-3(1)"}]}],"props":[{"name":"label","value":"6.2.3.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.6_Ensure_use_of_privileged_commands_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure use of privileged commands are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.007_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor for unsuccessful attempts to access files. The following parameters are associated with system calls that control files:\n\n- creation \\- `creat`\n- opening \\- `open` , `openat`\n- truncation \\- `truncate` , `ftruncate`\n\nAn audit log record will only be written if all of the following criteria is met for the user when trying to access a file:\n\n- a non\\-privileged user (auid\\>=UID\\_MIN)\n- is not a Daemon event (auid=4294967295/unset/\\-1)\n- if the system call returned EACCES (permission denied) or EPERM (some other permanent error associated with the specific system call)"},{"id":"cisb-ubnt24.04lts-006.002.003.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Failed attempts to open, create or truncate files could be an indication that an individual or process is trying to gain unauthorized access to the system."},{"id":"cisb-ubnt24.04lts-006.002.003.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor unsuccessful file access attempts. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n\" >> /etc/audit/rules.d/50-access.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor unsuccessful file access attempts. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=${UID_MIN} -F auid!=unset -k access\n-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=${UID_MIN} -F auid!=unset -k access\n\" >> /etc/audit/rules.d/50-access.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#56b32ac3-31da-4fc5-993d-09f1ededcd20"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.7_Ensure_unsuccessful_file_access_attempts_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure unsuccessful file access attempts are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.008_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Record events affecting the modification of user or group information, including that of passwords and old passwords if in use.\n\n- `/etc/group` \\- system groups\n- `/etc/passwd` \\- system users\n- `/etc/gshadow` \\- encrypted password for each group\n- `/etc/shadow` \\- system user passwords\n- `/etc/security/opasswd` \\- storage of old passwords if the relevant PAM module is in use\n- `/etc/nsswitch.conf` \\- file configures how the system uses various databases and name resolution mechanisms\n- `/etc/pam.conf` \\- file determines the authentication services to be used, and the order in which the services are used.\n- `/etc/pam.d` \\- directory contains the PAM configuration files for each PAM\\-aware application.\n\nThe parameters in this section will watch the files to see if they have been opened for write or have had attribute changes (e.g. permissions) and tag them with the identifier \"identity\" in the audit log file."},{"id":"cisb-ubnt24.04lts-006.002.003.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Unexpected changes to these files could be an indication that the system has been compromised and that an unauthorized user is attempting to hide their activities or compromise additional accounts."},{"id":"cisb-ubnt24.04lts-006.002.003.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify user/group information. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/nsswitch.conf -p wa -k identity\n-w /etc/pam.conf -p wa -k identity\n-w /etc/pam.d -p wa -k identity\n\" >> /etc/audit/rules.d/50-identity.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify user/group information. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/group -p wa -k identity\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/nsswitch.conf -p wa -k identity\n-w /etc/pam.conf -p wa -k identity\n-w /etc/pam.d -p wa -k identity\n\" >> /etc/audit/rules.d/50-identity.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#9e444207-45c1-4c7e-a5c3-7c92f4919564"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.008_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#32d7097f-52ea-487b-ac5b-a39489d424fe"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.8_Ensure_events_that_modify_usergroup_information_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure events that modify user/group information are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.009_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor changes to file permissions, attributes, ownership and group. The parameters in this section track changes for system calls that affect file permissions and attributes. The following commands and system calls effect the permissions, ownership and various attributes of files.\n\n- `chmod`\n- `fchmod`\n- `fchmodat`\n- `chown`\n- `fchown`\n- `fchownat`\n- `lchown`\n- `setxattr`\n- `lsetxattr`\n- `fsetxattr`\n- `removexattr`\n- `lremovexattr`\n- `fremovexattr`\n\nIn all cases, an audit record will only be written for non\\-system user ids and will ignore Daemon events. All audit records will be tagged with the identifier \"perm\\_mod.\""},{"id":"cisb-ubnt24.04lts-006.002.003.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring for changes in file attributes could alert a system administrator to activity that could indicate intruder activity or policy violation."},{"id":"cisb-ubnt24.04lts-006.002.003.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor discretionary access control permission modification events. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n\" >> /etc/audit/rules.d/50-perm_mod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor discretionary access control permission modification events. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=${UID_MIN} -F auid!=unset -F key=perm_mod\n\" >> /etc/audit/rules.d/50-perm_mod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#d4aa4e81-f9d3-4f3f-8b09-a0af9289b606"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, CM-6"}]}],"props":[{"name":"label","value":"6.2.3.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.9_Ensure_discretionary_access_control_permission_modification_events_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure discretionary access control permission modification events are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.010_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor the use of the `mount` system call. The `mount` (and `umount` ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non\\-privileged user"},{"id":"cisb-ubnt24.04lts-006.002.003.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is highly unusual for a non privileged user to `mount` file systems to the system. While tracking `mount` commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful `open`, `creat` and `truncate` system calls requiring write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it, would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media is beyond the scope of this document."},{"id":"cisb-ubnt24.04lts-006.002.003.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful file system mounts. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b32 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n-a always,exit -F arch=b64 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n\" >> /etc/audit/rules.d/50-mounts.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful file system mounts. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b32 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n-a always,exit -F arch=b64 -S mount -F auid>=$UID_MIN -F auid!=unset -k mounts\n\" >> /etc/audit/rules.d/50-mounts.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-6"}]}],"props":[{"name":"label","value":"6.2.3.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.10_Ensure_successful_file_system_mounts_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure successful file system mounts are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.011_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.011_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.011_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor session initiation events. The parameters in this section track changes to the files associated with session events.\n\n- `/var/run/utmp` \\- tracks all currently logged in users.\n- `/var/log/wtmp` \\- file tracks logins, logouts, shutdown, and reboot events.\n- `/var/log/btmp` \\- keeps track of failed login attempts and can be read by entering the command `/usr/bin/last -f /var/log/btmp`.\n\nAll audit records will be tagged with the identifier \"session.\""},{"id":"cisb-ubnt24.04lts-006.002.003.011_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in)."},{"id":"cisb-ubnt24.04lts-006.002.003.011_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor session initiation information. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n\" >> /etc/audit/rules.d/50-session.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.011_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor session initiation information. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /var/run/utmp -p wa -k session\n-w /var/log/wtmp -p wa -k session\n-w /var/log/btmp -p wa -k session\n\" >> /etc/audit/rules.d/50-session.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.011_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#5edafcb0-bd77-4520-a465-310bc53735ba"},{"rel":"reference","href":"#2adc0f62-07fc-411e-bbf0-2146e9789019"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.011_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.11"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.11_Ensure_session_initiation_information_is_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure session initiation information is collected"},{"id":"cisb-ubnt24.04lts-006.002.003.012_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.012_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.012_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor login and logout events. The parameters below track changes to files associated with login/logout events.\n\n- `/var/log/lastlog` \\- maintain records of the last time a user successfully logged in.\n- `/var/run/faillock` \\- directory maintains records of login failures via the `pam_faillock` module."},{"id":"cisb-ubnt24.04lts-006.002.003.012_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring login/logout events could provide a system administrator with information associated with brute force attacks against user logins."},{"id":"cisb-ubnt24.04lts-006.002.003.012_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor login and logout events. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock -p wa -k logins\n\" >> /etc/audit/rules.d/50-login.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.012_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor login and logout events. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /var/log/lastlog -p wa -k logins\n-w /var/run/faillock -p wa -k logins\n\" >> /etc/audit/rules.d/50-login.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.012_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#5edafcb0-bd77-4520-a465-310bc53735ba"},{"rel":"reference","href":"#cf7d770e-dfe9-4d35-9ff2-f09c88ca1443"},{"rel":"reference","href":"#2adc0f62-07fc-411e-bbf0-2146e9789019"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.012_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.12"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.12_Ensure_login_and_logout_events_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure login and logout events are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.013_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.013_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.013_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor the use of system calls associated with the deletion or renaming of files and file attributes. This configuration statement sets up monitoring for:\n\n- `unlink` \\- remove a file\n- `unlinkat` \\- remove a file attribute\n- `rename` \\- rename a file\n- `renameat` rename a file attribute\nsystem calls and tags them with the identifier \"delete\"."},{"id":"cisb-ubnt24.04lts-006.002.003.013_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring these calls from non\\-privileged users could provide a system administrator with evidence that inappropriate removal of files and file attributes associated with protected files is occurring. While this audit option will look at all events, system administrators will want to look for specific privileged files that are being deleted or altered."},{"id":"cisb-ubnt24.04lts-006.002.003.013_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor file deletion events by users. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n\" >> /etc/audit/rules.d/50-delete.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.013_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor file deletion events by users. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\nUID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n[ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${UID_MIN} -F auid!=unset -F key=delete\n\" >> /etc/audit/rules.d/50-delete.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.013_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.013_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-12, SC-7"}]}],"props":[{"name":"label","value":"6.2.3.13"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.13_Ensure_file_deletion_events_by_users_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure file deletion events by users are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.014_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.014_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.014_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor AppArmor, an implementation of mandatory access controls. The parameters below monitor any write access (potential additional, deletion or modification of files in the directory) or attribute changes to the `/etc/apparmor/` and `/etc/apparmor.d/` directories.\n\n**Note:** If a different Mandatory Access Control method is used, changes to the corresponding directories should be audited."},{"id":"cisb-ubnt24.04lts-006.002.003.014_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Changes to files in the `/etc/apparmor/` and `/etc/apparmor.d/` directories could indicate that an unauthorized user is attempting to modify access controls and change security contexts, leading to a compromise of the system."},{"id":"cisb-ubnt24.04lts-006.002.003.014_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/apparmor/ -p wa -k MAC-policy\n-w /etc/apparmor.d/ -p wa -k MAC-policy\n\" >> /etc/audit/rules.d/50-MAC-policy.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.014_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor events that modify the system's Mandatory Access Controls. \n\n*Example:* \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf \"\n-w /etc/apparmor/ -p wa -k MAC-policy\n-w /etc/apparmor.d/ -p wa -k MAC-policy\n\" >> /etc/audit/rules.d/50-MAC-policy.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.014_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#d4aa4e81-f9d3-4f3f-8b09-a0af9289b606"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.014_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, CM-6"}]}],"props":[{"name":"label","value":"6.2.3.14"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.14_Ensure_events_that_modify_the_systems_Mandatory_Access_Controls_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure events that modify the system's Mandatory Access Controls are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.015_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.015_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.015_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must generate audit records for successful/unsuccessful uses of the `chcon` command."},{"id":"cisb-ubnt24.04lts-006.002.003.015_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `chcon` command is used to change file security context. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter)."},{"id":"cisb-ubnt24.04lts-006.002.003.015_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chcon` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.015_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chcon` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.015_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.015_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.3.15"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.15_Ensure_successful_and_unsuccessful_attempts_to_use_the_chcon_command_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure successful and unsuccessful attempts to use the chcon command are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.016_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.016_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.016_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must generate audit records for successful/unsuccessful uses of the `setfacl` command"},{"id":"cisb-ubnt24.04lts-006.002.003.016_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"This utility sets Access Control Lists (ACLs) of files and directories. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter)."},{"id":"cisb-ubnt24.04lts-006.002.003.016_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `setfacl` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.016_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `setfacl` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.016_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.016_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.3.16"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.16_Ensure_successful_and_unsuccessful_attempts_to_use_the_setfacl_command_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure successful and unsuccessful attempts to use the setfacl command are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.017_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.017_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.017_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must generate audit records for successful/unsuccessful uses of the `chacl` command.\n\n`chacl` is an IRIX\\-compatibility command, and is maintained for those users who are familiar with its use from either XFS or IRIX."},{"id":"cisb-ubnt24.04lts-006.002.003.017_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"`chacl` changes the ACL(s) for a file or directory. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter)."},{"id":"cisb-ubnt24.04lts-006.002.003.017_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chacl` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.017_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `chacl` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k perm_chng\n\" >> /etc/audit/rules.d/50-perm_chng.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.017_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.017_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.3.17"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.17_Ensure_successful_and_unsuccessful_attempts_to_use_the_chacl_command_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure successful and unsuccessful attempts to use the chacl command are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.018_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.018_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.018_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The operating system must generate audit records for successful/unsuccessful uses of the `usermod` command."},{"id":"cisb-ubnt24.04lts-006.002.003.018_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `usermod` command modifies the system account files to reflect the changes that are specified on the command line. Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter)."},{"id":"cisb-ubnt24.04lts-006.002.003.018_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `usermod` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k usermod\n\" >> /etc/audit/rules.d/50-usermod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.018_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor successful and unsuccessful attempts to use the `usermod` command. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# {\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k usermod\n\" >> /etc/audit/rules.d/50-usermod.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.018_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#7d1c70e1-6675-4be1-bb92-709198071391"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.018_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2, AU-12, SI-5"}]}],"props":[{"name":"label","value":"6.2.3.18"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.18_Ensure_successful_and_unsuccessful_attempts_to_use_the_usermod_command_are_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure successful and unsuccessful attempts to use the usermod command are collected"},{"id":"cisb-ubnt24.04lts-006.002.003.019_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.019_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.019_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Monitor the loading and unloading of kernel modules. All the loading / listing / dependency checking of modules is done by `kmod` via symbolic links.\n\nThe following system calls control loading and unloading of modules:\n\n- `init_module` \\- load a module\n- `finit_module` \\- load a module (used when the overhead of using cryptographically signed modules to determine the authenticity of a module can be avoided)\n- `delete_module` \\- delete a module\n- `create_module` \\- create a loadable module entry\n- `query_module` \\- query the kernel for various bits pertaining to modules\n\nAny execution of the loading and unloading module programs and system calls will trigger an audit record with an identifier of `modules`."},{"id":"cisb-ubnt24.04lts-006.002.003.019_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Monitoring the use of all the various ways to manipulate kernel modules could provide system administrators with evidence that an unauthorized change was made to a kernel module, possibly compromising the security of the system."},{"id":"cisb-ubnt24.04lts-006.002.003.019_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor kernel module modification. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n -a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n \" >> /etc/audit/rules.d/50-kernel_modules.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.019_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"**Create audit rules** \n\nEdit or create a file in the `/etc/audit/rules.d/` directory, ending in `.rules` extension, with the relevant rules to monitor kernel module modification. \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n#!/usr/bin/env bash\n\n{\n UID_MIN=$(awk '/^\\s*UID_MIN/{print $2}' /etc/login.defs)\n [ -n \"${UID_MIN}\" ] && printf \"\n -a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n -a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=${UID_MIN} -F auid!=unset -k kernel_modules\n \" >> /etc/audit/rules.d/50-kernel_modules.rules || printf \"ERROR: Variable 'UID_MIN' is unset.\\n\"\n}\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.019_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.019_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3, CM-6"}]}],"props":[{"name":"label","value":"6.2.3.19"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.19_Ensure_kernel_module_loading_unloading_and_modification_is_collected"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure kernel module loading unloading and modification is collected"},{"id":"cisb-ubnt24.04lts-006.002.003.020_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.020_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.020_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Set system audit so that audit rules cannot be modified with `auditctl` . Setting the flag \"\\-e 2\" forces audit to be put in immutable mode. Audit changes can only be made on system reboot.\n\n**Note:** This setting will require the system to be rebooted to update the active `auditd` configuration settings."},{"id":"cisb-ubnt24.04lts-006.002.003.020_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"In immutable mode, unauthorized users cannot execute changes to the audit system to potentially hide malicious activity and then put the audit rules back. Users would most likely notice a system reboot and that could alert administrators of an attempt to make unauthorized audit changes."},{"id":"cisb-ubnt24.04lts-006.002.003.020_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Edit or create the file `/etc/audit/rules.d/99-finalize.rules` and add the line `-e 2` at the end of the file: \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf '\\n%s' \"-e 2\" >> /etc/audit/rules.d/99-finalize.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.020_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Edit or create the file `/etc/audit/rules.d/99-finalize.rules` and add the line `-e 2` at the end of the file: \n\n*Example:* \n\n**Load audit rules** \n\nMerge and load the rules into active configuration: \n\nCheck if reboot is required.\n\n```\n# if [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then printf \"Reboot required to load rules\\n\"; fi\n```\n\n```\n# augenrules --load\n```\n\n```\n# printf '\\n%s' \"-e 2\" >> /etc/audit/rules.d/99-finalize.rules\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.020_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#7bf51a1a-b4ce-4881-a2f6-485ac81e3381"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.020_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, AU-3, AU-12, MP-2"}]}],"props":[{"name":"label","value":"6.2.3.20"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.20_Ensure_the_audit_configuration_is_immutable"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure the audit configuration is immutable"},{"id":"cisb-ubnt24.04lts-006.002.003.021_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.003.021_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.003.021_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The Audit system have both on disk and running configuration. It is possible for these configuration settings to differ.\n\n**Note:** Due to the limitations of `augenrules` and `auditctl`, it is not absolutely guaranteed that loading the rule sets via `augenrules --load` will result in all rules being loaded or even that the user will be informed if there was a problem loading the rules."},{"id":"cisb-ubnt24.04lts-006.002.003.021_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Configuration differences between what is currently running and what is on disk could cause unexpected problems or may give a false impression of compliance requirements."},{"id":"cisb-ubnt24.04lts-006.002.003.021_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"If the rules are not aligned across all three () areas, run the following command to merge and load all rules: \n\nCheck if reboot is required.\n\n```\nif [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then echo \"Reboot required to load rules\"; fi\n```\n\n```\n# augenrules --load\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.021_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"If the rules are not aligned across all three () areas, run the following command to merge and load all rules: \n\nCheck if reboot is required.\n\n```\nif [[ $(auditctl -s | grep \"enabled\") =~ \"2\" ]]; then echo \"Reboot required to load rules\"; fi\n```\n\n```\n# augenrules --load\n```"},{"id":"cisb-ubnt24.04lts-006.002.003.021_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#0d285252-67f9-420d-a890-07ee36a57ce1"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.003.021_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.3.21"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.3.21_Ensure_the_running_and_on_disk_configuration_is_the_same"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure the running and on disk configuration is the same"}]},{"id":"cisb-ubnt24.04lts-006.002.004_grp","parts":[{"id":"cisb-ubnt24.04lts-006.002.004_ovrvw","name":"overview","prose":"Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events."}],"props":[{"name":"label","value":"6.2.4"}],"title":"Configure auditd File Access","controls":[{"id":"cisb-ubnt24.04lts-006.002.004.001_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit log files contain information about the system and system activity."},{"id":"cisb-ubnt24.04lts-006.002.004.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality."},{"id":"cisb-ubnt24.04lts-006.002.004.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove more permissive mode than `0640` from audit log files:\n\n```\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove more permissive mode than `0640` from audit log files:\n\n```\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.1_Ensure_audit_log_files_mode_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit log files mode is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.002_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit log files contain information about the system and system activity."},{"id":"cisb-ubnt24.04lts-006.002.004.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality."},{"id":"cisb-ubnt24.04lts-006.002.004.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to configure the audit log files to be owned by the `root` user:\n\n```\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f ! -user root -exec chown root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to configure the audit log files to be owned by the `root` user:\n\n```\n# [ -f /etc/audit/auditd.conf ] && find \"$(dirname $(awk -F \"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))\" -type f ! -user root -exec chown root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.2_Ensure_audit_log_files_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit log files owner is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit log files contain information about the system and system activity."},{"id":"cisb-ubnt24.04lts-006.002.004.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality."},{"id":"cisb-ubnt24.04lts-006.002.004.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to configure the audit log files to be group owned by `adm`: \n\nRun the following command to set the `log_group` parameter in the audit configuration file to `log_group = adm`: \n\nRun the following command to restart the audit daemon to reload the configuration file:\n\n```\n# systemctl restart auditd\n```\n\n```\n# sed -ri 's/^\\s*#?\\s*log_group\\s*=\\s*\\S+(\\s*#.*)?.*$/log_group = adm\\1/' /etc/audit/auditd.conf\n```\n\n```\n# find $(dirname $(awk -F\"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \\( ! -group adm -a ! -group root \\) -exec chgrp adm {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to configure the audit log files to be group owned by `adm`: \n\nRun the following command to set the `log_group` parameter in the audit configuration file to `log_group = adm`: \n\nRun the following command to restart the audit daemon to reload the configuration file:\n\n```\n# systemctl restart auditd\n```\n\n```\n# sed -ri 's/^\\s*#?\\s*log_group\\s*=\\s*\\S+(\\s*#.*)?.*$/log_group = adm\\1/' /etc/audit/auditd.conf\n```\n\n```\n# find $(dirname $(awk -F\"=\" '/^\\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \\( ! -group adm -a ! -group root \\) -exec chgrp adm {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.3_Ensure_audit_log_files_group_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit log files group owner is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.004_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The audit log directory contains audit log files."},{"id":"cisb-ubnt24.04lts-006.002.004.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Audit information includes all information including: audit records, audit settings and audit reports. This information is needed to successfully audit system activity. This information must be protected from unauthorized modification or deletion. If this information were to be compromised, forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve."},{"id":"cisb-ubnt24.04lts-006.002.004.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to configure the audit log directory to have a mode of \"0750\" or less permissive:\n\n```\n# chmod g-w,o-rwx \"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to configure the audit log directory to have a mode of \"0750\" or less permissive:\n\n```\n# chmod g-w,o-rwx \"$(dirname \"$(awk -F= '/^\\s*log_file\\s*/{print $2}' /etc/audit/auditd.conf | xargs)\")\"\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.4_Ensure_the_audit_log_file_directory_mode_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure the audit log file directory mode is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.005_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit configuration files control auditd and what events are audited."},{"id":"cisb-ubnt24.04lts-006.002.004.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."},{"id":"cisb-ubnt24.04lts-006.002.004.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove more permissive mode than `0640` from the audit configuration files:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) -exec chmod u-x,g-wx,o-rwx {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove more permissive mode than `0640` from the audit configuration files:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) -exec chmod u-x,g-wx,o-rwx {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.5_Ensure_audit_configuration_files_mode_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit configuration files mode is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.006_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit configuration files control auditd and what events are audited."},{"id":"cisb-ubnt24.04lts-006.002.004.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."},{"id":"cisb-ubnt24.04lts-006.002.004.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to change ownership to `root` user:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -user root -exec chown root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to change ownership to `root` user:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -user root -exec chown root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.6_Ensure_audit_configuration_files_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit configuration files owner is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.007_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit configuration files control auditd and what events are audited."},{"id":"cisb-ubnt24.04lts-006.002.004.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.\n\nMisconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident."},{"id":"cisb-ubnt24.04lts-006.002.004.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to change group to `root`:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -group root -exec chgrp root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to change group to `root`:\n\n```\n# find /etc/audit/ -type f \\( -name '*.conf' -o -name '*.rules' \\) ! -group root -exec chgrp root {} +\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.7_Ensure_audit_configuration_files_group_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit configuration files group owner is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.008_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit tools include, but are not limited to, vendor\\-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"id":"cisb-ubnt24.04lts-006.002.004.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."},{"id":"cisb-ubnt24.04lts-006.002.004.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove more permissive mode from the audit tools:\n\n```\n# chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove more permissive mode from the audit tools:\n\n```\n# chmod go-w /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.8_Ensure_audit_tools_mode_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit tools mode is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.009_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit tools include, but are not limited to, vendor\\-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"id":"cisb-ubnt24.04lts-006.002.004.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."},{"id":"cisb-ubnt24.04lts-006.002.004.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to change the owner of the audit tools to the `root` user:\n\n```\n# chown root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to change the owner of the audit tools to the `root` user:\n\n```\n# chown root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.9_Ensure_audit_tools_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit tools owner is configured"},{"id":"cisb-ubnt24.04lts-006.002.004.010_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.002.004.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.002.004.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit tools include, but are not limited to, vendor\\-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators."},{"id":"cisb-ubnt24.04lts-006.002.004.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Protecting audit information includes identifying and protecting the tools used to view and manipulate log data. Protecting audit tools is necessary to prevent unauthorized operation on audit information."},{"id":"cisb-ubnt24.04lts-006.002.004.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to change group ownership to the groop `root`:\n\n```\n# chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to change group ownership to the groop `root`:\n\n```\n# chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules\n```"},{"id":"cisb-ubnt24.04lts-006.002.004.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.002.004.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-3"}]}],"props":[{"name":"label","value":"6.2.4.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.2.4.10_Ensure_audit_tools_group_owner_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure audit tools group owner is configured"}]}]},{"id":"cisb-ubnt24.04lts-006.003_grp","parts":[{"id":"cisb-ubnt24.04lts-006.003_ovrvw","name":"overview","prose":"AIDE is a file integrity checking tool, similar in nature to Tripwire. While it cannot prevent intrusions, it can detect unauthorized changes to configuration files by alerting when the files are changed. When setting up AIDE, decide internally what the site policy will be concerning integrity checking. Review the AIDE quick start guide and AIDE documentation before proceeding."}],"props":[{"name":"label","value":"6.3"}],"title":"Configure Integrity Checking","controls":[{"id":"cisb-ubnt24.04lts-006.003.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.003.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.003.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"AIDE takes a snapshot of filesystem state including modification times, permissions, and file hashes which can then be used to compare against the current state of the filesystem to detect modifications to the system."},{"id":"cisb-ubnt24.04lts-006.003.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"By monitoring the filesystem state compromised files can be detected to prevent or limit the exposure of accidental or malicious misconfigurations or modified binaries."},{"id":"cisb-ubnt24.04lts-006.003.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Install AIDE using the appropriate package manager or manual installation: \n\nConfigure AIDE as appropriate for your environment. Consult the AIDE documentation for options. \n\nRun the following commands to initialize AIDE:\n\n```\n# aideinit\n# mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db\n```\n\n```\n# apt install aide aide-common\n```"},{"id":"cisb-ubnt24.04lts-006.003.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Install AIDE using the appropriate package manager or manual installation: \n\nConfigure AIDE as appropriate for your environment. Consult the AIDE documentation for options. \n\nRun the following commands to initialize AIDE:\n\n```\n# aideinit\n# mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db\n```\n\n```\n# apt install aide aide-common\n```"},{"id":"cisb-ubnt24.04lts-006.003.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#56b32ac3-31da-4fc5-993d-09f1ededcd20"},{"rel":"reference","href":"#5c4f90ec-a1e4-4140-865c-e3a87694b13f"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.003.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2"}]}],"props":[{"name":"label","value":"6.3.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.3.1_Ensure_AIDE_is_installed"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure AIDE is installed"},{"id":"cisb-ubnt24.04lts-006.003.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.003.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.003.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Periodic checking of the filesystem integrity is needed to detect changes to the filesystem."},{"id":"cisb-ubnt24.04lts-006.003.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion."},{"id":"cisb-ubnt24.04lts-006.003.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to unmask `dailyaidecheck.timer` and `dailyaidecheck.service`: \n\nRun the following command to enable and start `dailyaidecheck.timer`:\n\n```\n# systemctl --now enable dailyaidecheck.timer\n```\n\n```\n# systemctl unmask dailyaidecheck.timer dailyaidecheck.service\n```"},{"id":"cisb-ubnt24.04lts-006.003.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to unmask `dailyaidecheck.timer` and `dailyaidecheck.service`: \n\nRun the following command to enable and start `dailyaidecheck.timer`:\n\n```\n# systemctl --now enable dailyaidecheck.timer\n```\n\n```\n# systemctl unmask dailyaidecheck.timer dailyaidecheck.service\n```"},{"id":"cisb-ubnt24.04lts-006.003.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#56b32ac3-31da-4fc5-993d-09f1ededcd20"},{"rel":"reference","href":"#1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-006.003.002_ref","name":"guidance","class":"References","links":[{"rel":"reference","href":"#201a216f-0fb3-4579-8278-4fc0654162ac"}],"props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AU-2"}]}],"props":[{"name":"label","value":"6.3.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.3.2_Ensure_filesystem_integrity_is_regularly_checked"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure filesystem integrity is regularly checked"},{"id":"cisb-ubnt24.04lts-006.003.003_ctrl","links":[{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-006.003.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-006.003.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Audit tools include, but are not limited to, vendor\\-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\n`aide.conf` is case\\-sensitive. Leading and trailing white spaces are ignored. Each config lines must end with new line.\n\n`AIDE` uses the backslash character `\\` as escape character for '` `' (space), '@' and '' (backslash) (e.g. '\\\\ ' or '@'). To literally match a '' in a file path with a regular expression you have to escape the backslash twice (i.e. '\\\\\\\\').\n\nThere are three types of lines in `aide.conf`:\n\n- The configuration options which are used to set configuration parameters and define groups.\n- (restricted) rules that are used to indicate which files are added to the database.\n- Macro lines define or undefine variables within the config file.\n\n**Note:** Lines beginning with `#` are ignored as comments.\n\n`@@include` ** \\- Include **.\n\n- The content of the file is used as if it were inserted in this part of the config file.\n- The maximum depth of nested includes is 16.\n\n\\`@@include ** ** \\- \\[RULE\\_PREFIX] (added in AIDE v0.17)\n\n- Include all (regular) files found in matching regular expression (sub\\-directories are ignored).\n- The file are included in lexical sort order.\n- If `RULE_PREFIX` is set, all rules included by the statement are prefixed with given (added in AIDE v0.18). Prefixes from nested include statements are concatenated.\n- The content of the files is used as if it were inserted in this part of the config file.\n\n`@x_include`:\n\n- is identical to `@@include`, except that if a config file is executable is is run and the output is used as config.\n- If the executable file exits with status greater than zero or writes to stderr aide stops with an error.\n- For security reasons ** and each executable config file must be owned by the current user or root. They must not be group\\- or world\\-writable.\n- `@@x_include __` (added in AIDE v0.17):\n- \\`@@x\\_include ** ** \\[RULE\\_PREFIX] (added in AIDE v0.17)\n\n`@@x_include_setenv` ** ** (added in AIDE v0.17)\n\n- Adds the variable ** with the value ** to the environment used for config file execution.\n- Environment variable names are limited to alphanumeric characters (A\\-Za\\-z0\\-9) and the underscore '\\_' and must not begin with a digit."},{"id":"cisb-ubnt24.04lts-006.003.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Protecting the integrity of the tools used for auditing purposes is a critical step toward ensuring the integrity of audit information. Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nAttackers may replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs.\n\nAudit tools should be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated, or replaced. An example is a checksum hash of the file or files."},{"id":"cisb-ubnt24.04lts-006.003.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to determine the absolute path to the non\\-symlinked version on the audit tools: \n\nThe output will be either `/usr/sbin` **\\- OR \\-** `/sbin`. Ensure the correct path is used. \n\nEdit `/etc/aide/aide.conf` and add or update the following selection lines replacing `` with the correct path returned in the command above: \n\n*Example* \n\n**Note: \\- IF \\-** `/etc/aide/aide.conf` includes a `@@x_include` statement: \n\n- ** and each executable config file must be owned by the current user or root\n- They must not be group or world\\-writable\n\n*Example:*\n\n```\n@@x_include /etc/aide.conf.d ^[a-zA-Z0-9_-]+$\n```\n\n```\n# printf '%s\\n' \"\" \"# Audit Tools\" \"$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/auditd) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/ausearch) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/aureport) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/autrace) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/augenrules) p+i+n+u+g+s+b+acl+xattrs+sha512\" >> /etc/aide/aide.conf\n```\n\n```\n# Audit Tools\n/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n```\n\n```\n# readlink -f /sbin\n```"},{"id":"cisb-ubnt24.04lts-006.003.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to determine the absolute path to the non\\-symlinked version on the audit tools: \n\nThe output will be either `/usr/sbin` **\\- OR \\-** `/sbin`. Ensure the correct path is used. \n\nEdit `/etc/aide/aide.conf` and add or update the following selection lines replacing `` with the correct path returned in the command above: \n\n*Example* \n\n**Note: \\- IF \\-** `/etc/aide/aide.conf` includes a `@@x_include` statement: \n\n- ** and each executable config file must be owned by the current user or root\n- They must not be group or world\\-writable\n\n*Example:*\n\n```\n@@x_include /etc/aide.conf.d ^[a-zA-Z0-9_-]+$\n```\n\n```\n# printf '%s\\n' \"\" \"# Audit Tools\" \"$(readlink -f /sbin/auditctl) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/auditd) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/ausearch) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/aureport) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/autrace) p+i+n+u+g+s+b+acl+xattrs+sha512\" \"$(readlink -f /sbin/augenrules) p+i+n+u+g+s+b+acl+xattrs+sha512\" >> /etc/aide/aide.conf\n```\n\n```\n# Audit Tools\n/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512\n/auditd p+i+n+u+g+s+b+acl+xattrs+sha512\n/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512\n/aureport p+i+n+u+g+s+b+acl+xattrs+sha512\n/autrace p+i+n+u+g+s+b+acl+xattrs+sha512\n/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512\n```\n\n```\n# readlink -f /sbin\n```"},{"id":"cisb-ubnt24.04lts-006.003.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"AIDE.CONF(5)"}]}],"props":[{"name":"label","value":"6.3.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_6.3.3_Ensure_cryptographic_mechanisms_are_used_to_protect_the_integrity_of_audit_tools"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure cryptographic mechanisms are used to protect the integrity of audit tools"}]}]},{"id":"cisb-ubnt24.04lts-007_grp","parts":[{"id":"cisb-ubnt24.04lts-007_ovrvw","name":"overview","prose":"Recommendations in this section are intended as maintenance and are intended to be checked on a frequent basis to ensure system stability. Many recommendations do not have quick remediations and require investigation into the cause and best fix available and may indicate an attempted breach of system security."}],"props":[{"name":"label","value":"7"}],"title":"System Maintenance","groups":[{"id":"cisb-ubnt24.04lts-007.001_grp","parts":[{"id":"cisb-ubnt24.04lts-007.001_ovrvw","name":"overview","prose":"This section provides guidance on securing aspects of system files and directories."}],"props":[{"name":"label","value":"7.1"}],"title":"System File Permissions","controls":[{"id":"cisb-ubnt24.04lts-007.001.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/passwd` file contains user account information that is used by many system utilities and therefore must be readable for these utilities to operate."},{"id":"cisb-ubnt24.04lts-007.001.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/passwd` file is protected from unauthorized write access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd`:\n\n```\n# chmod u-x,go-wx /etc/passwd\n# chown root:root /etc/passwd\n```"},{"id":"cisb-ubnt24.04lts-007.001.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd`:\n\n```\n# chmod u-x,go-wx /etc/passwd\n# chown root:root /etc/passwd\n```"},{"id":"cisb-ubnt24.04lts-007.001.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.1_Ensure_permissions_on_etcpasswd_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/passwd are configured"},{"id":"cisb-ubnt24.04lts-007.001.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/passwd-` file contains backup user account information."},{"id":"cisb-ubnt24.04lts-007.001.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/passwd-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd-`:\n\n```\n# chmod u-x,go-wx /etc/passwd-\n# chown root:root /etc/passwd-\n```"},{"id":"cisb-ubnt24.04lts-007.001.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/passwd-`:\n\n```\n# chmod u-x,go-wx /etc/passwd-\n# chown root:root /etc/passwd-\n```"},{"id":"cisb-ubnt24.04lts-007.001.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.2_Ensure_permissions_on_etcpasswd-_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/passwd- are configured"},{"id":"cisb-ubnt24.04lts-007.001.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/group` file contains a list of all the valid groups defined in the system. The command below allows read/write access for root and read access for everyone else."},{"id":"cisb-ubnt24.04lts-007.001.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `/etc/group` file needs to be protected from unauthorized changes by non\\-privileged users, but needs to be readable as this information is used with many non\\-privileged programs."},{"id":"cisb-ubnt24.04lts-007.001.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group`:\n\n```\n# chmod u-x,go-wx /etc/group\n# chown root:root /etc/group\n```"},{"id":"cisb-ubnt24.04lts-007.001.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group`:\n\n```\n# chmod u-x,go-wx /etc/group\n# chown root:root /etc/group\n```"},{"id":"cisb-ubnt24.04lts-007.001.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.3_Ensure_permissions_on_etcgroup_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/group are configured"},{"id":"cisb-ubnt24.04lts-007.001.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/group-` file contains a backup list of all the valid groups defined in the system."},{"id":"cisb-ubnt24.04lts-007.001.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/group-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group-`:\n\n```\n# chmod u-x,go-wx /etc/group-\n# chown root:root /etc/group-\n```"},{"id":"cisb-ubnt24.04lts-007.001.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/group-`:\n\n```\n# chmod u-x,go-wx /etc/group-\n# chown root:root /etc/group-\n```"},{"id":"cisb-ubnt24.04lts-007.001.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.4_Ensure_permissions_on_etcgroup-_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/group- are configured"},{"id":"cisb-ubnt24.04lts-007.001.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/shadow` file is used to store the information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."},{"id":"cisb-ubnt24.04lts-007.001.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If attackers can gain read access to the `/etc/shadow` file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the `/etc/shadow` file (such as expiration) could also be useful to subvert the user accounts."},{"id":"cisb-ubnt24.04lts-007.001.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run **one** of the following commands to set ownership of `/etc/shadow` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/shadow`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/shadow\n```\n\n```\n# chown root:shadow /etc/shadow\n -OR-\n# chown root:root /etc/shadow\n```"},{"id":"cisb-ubnt24.04lts-007.001.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run **one** of the following commands to set ownership of `/etc/shadow` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/shadow`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/shadow\n```\n\n```\n# chown root:shadow /etc/shadow\n -OR-\n# chown root:root /etc/shadow\n```"},{"id":"cisb-ubnt24.04lts-007.001.005_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.5_Ensure_permissions_on_etcshadow_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/shadow are configured"},{"id":"cisb-ubnt24.04lts-007.001.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/shadow-` file is used to store backup information about user accounts that is critical to the security of those accounts, such as the hashed password and other security information."},{"id":"cisb-ubnt24.04lts-007.001.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/shadow-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run **one** of the following commands to set ownership of `/etc/shadow-` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/shadow-`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/shadow-\n```\n\n```\n# chown root:shadow /etc/shadow-\n -OR-\n# chown root:root /etc/shadow-\n```"},{"id":"cisb-ubnt24.04lts-007.001.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run **one** of the following commands to set ownership of `/etc/shadow-` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/shadow-`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/shadow-\n```\n\n```\n# chown root:shadow /etc/shadow-\n -OR-\n# chown root:root /etc/shadow-\n```"},{"id":"cisb-ubnt24.04lts-007.001.006_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.6_Ensure_permissions_on_etcshadow-_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/shadow- are configured"},{"id":"cisb-ubnt24.04lts-007.001.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/gshadow` file is used to store the information about groups that is critical to the security of those accounts, such as the hashed password and other security information."},{"id":"cisb-ubnt24.04lts-007.001.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If attackers can gain read access to the `/etc/gshadow` file, they can easily run a password cracking program against the hashed password to break it. Other security information that is stored in the `/etc/gshadow` file (such as group administrators) could also be useful to subvert the group."},{"id":"cisb-ubnt24.04lts-007.001.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run **one** of the following commands to set ownership of `/etc/gshadow` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/gshadow`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/gshadow\n```\n\n```\n# chown root:shadow /etc/gshadow\n -OR-\n# chown root:root /etc/gshadow\n```"},{"id":"cisb-ubnt24.04lts-007.001.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run **one** of the following commands to set ownership of `/etc/gshadow` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/gshadow`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/gshadow\n```\n\n```\n# chown root:shadow /etc/gshadow\n -OR-\n# chown root:root /etc/gshadow\n```"},{"id":"cisb-ubnt24.04lts-007.001.007_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.7_Ensure_permissions_on_etcgshadow_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/gshadow are configured"},{"id":"cisb-ubnt24.04lts-007.001.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The `/etc/gshadow-` file is used to store backup information about groups that is critical to the security of those accounts, such as the hashed password and other security information."},{"id":"cisb-ubnt24.04lts-007.001.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/gshadow-` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run **one** of the following commands to set ownership of `/etc/gshadow-` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/gshadow-`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/gshadow-\n```\n\n```\n# chown root:shadow /etc/gshadow-\n -OR-\n# chown root:root /etc/gshadow-\n```"},{"id":"cisb-ubnt24.04lts-007.001.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run **one** of the following commands to set ownership of `/etc/gshadow-` to `root` and group to either `root` or `shadow`: \n\nRun the following command to remove excess permissions form `/etc/gshadow-`:\n\n```\n# chmod u-x,g-wx,o-rwx /etc/gshadow-\n```\n\n```\n# chown root:shadow /etc/gshadow-\n -OR-\n# chown root:root /etc/gshadow-\n```"},{"id":"cisb-ubnt24.04lts-007.001.008_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.8_Ensure_permissions_on_etcgshadow-_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/gshadow- are configured"},{"id":"cisb-ubnt24.04lts-007.001.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`/etc/shells` is a text file which contains the full pathnames of valid login shells. This file is consulted by `chsh` and available to be queried by other programs."},{"id":"cisb-ubnt24.04lts-007.001.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that the `/etc/shells` file is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/shells`:\n\n```\n# chmod u-x,go-wx /etc/shells\n# chown root:root /etc/shells\n```"},{"id":"cisb-ubnt24.04lts-007.001.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/shells`:\n\n```\n# chmod u-x,go-wx /etc/shells\n# chown root:root /etc/shells\n```"},{"id":"cisb-ubnt24.04lts-007.001.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.9_Ensure_permissions_on_etcshells_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/shells are configured"},{"id":"cisb-ubnt24.04lts-007.001.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"`/etc/security/opasswd` and it's backup `/etc/security/opasswd.old` hold user's previous passwords if `pam_unix` or `pam_pwhistory` is in use on the system"},{"id":"cisb-ubnt24.04lts-007.001.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"It is critical to ensure that `/etc/security/opasswd` is protected from unauthorized access. Although it is protected by default, the file permissions could be changed either inadvertently or through malicious actions."},{"id":"cisb-ubnt24.04lts-007.001.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/security/opasswd` and `/etc/security/opasswd.old` is they exist:\n\n```\n# [ -e \"/etc/security/opasswd\" ] && chmod u-x,go-rwx /etc/security/opasswd\n# [ -e \"/etc/security/opasswd\" ] && chown root:root /etc/security/opasswd\n# [ -e \"/etc/security/opasswd.old\" ] && chmod u-x,go-rwx /etc/security/opasswd.old\n# [ -e \"/etc/security/opasswd.old\" ] && chown root:root /etc/security/opasswd.old\n```"},{"id":"cisb-ubnt24.04lts-007.001.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following commands to remove excess permissions, set owner, and set group on `/etc/security/opasswd` and `/etc/security/opasswd.old` is they exist:\n\n```\n# [ -e \"/etc/security/opasswd\" ] && chmod u-x,go-rwx /etc/security/opasswd\n# [ -e \"/etc/security/opasswd\" ] && chown root:root /etc/security/opasswd\n# [ -e \"/etc/security/opasswd.old\" ] && chmod u-x,go-rwx /etc/security/opasswd.old\n# [ -e \"/etc/security/opasswd.old\" ] && chown root:root /etc/security/opasswd.old\n```"},{"id":"cisb-ubnt24.04lts-007.001.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.10_Ensure_permissions_on_etcsecurityopasswd_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure permissions on /etc/security/opasswd are configured"},{"id":"cisb-ubnt24.04lts-007.001.011_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.011_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.011_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"World writable files are the least secure. Data in world\\-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity. See the `chmod(2)` man page for more information.\n\nSetting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them."},{"id":"cisb-ubnt24.04lts-007.001.011_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Data in world\\-writable files can be modified and compromised by any user on the system. World writable files may also indicate an incorrectly written script or program that could potentially be the cause of a larger compromise to the system's integrity.\n\nThis feature prevents the ability to delete or rename files in world writable directories (such as `/tmp` ) that are owned by another user."},{"id":"cisb-ubnt24.04lts-007.001.011_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"- World Writable Files:\n - It is recommended that write access is removed from `other` with the command ( `chmod o-w ` ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file.\n - It is recommended that write access is removed from `other` with the command ( `chmod o-w ` ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file.\n- World Writable Directories:\n - Set the sticky bit on all world writable directories with the command ( `chmod a+t ` )\n - Set the sticky bit on all world writable directories with the command ( `chmod a+t ` )\n\nRun the following script to: \n\n- Remove other write permission from any world writable files\n- Add the sticky bit to all world writable directories\n\n```\n#!/usr/bin/env bash\n\n{\n l_smask='01000'\n a_file=(); a_dir=() # Initialize arrays\n a_path=(! -path \"/run/user/*\" -a ! -path \"/proc/*\" -a ! -path \"*/containerd/*\" -a ! -path \"*/kubelet/pods/*\" -a ! -path \"*/kubelet/plugins/*\" -a ! -path \"/sys/*\" -a ! -path \"/snap/*\")\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n l_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n if [ -f \"$l_file\" ]; then # Remove excess permissions from WW files\n echo -e \" - File: \\\"$l_file\\\" is mode: \\\"$l_mode\\\"\\n - removing write permission on \\\"$l_file\\\" from \\\"other\\\"\"\n chmod o-w \"$l_file\"\n fi\n if [ -d \"$l_file\" ]; then # Add sticky bit\n if [ ! $(( $l_mode & $l_smask )) -gt 0 ]; then\n echo -e \" - Directory: \\\"$l_file\\\" is mode: \\\"$l_mode\\\" and doesn't have the sticky bit set\\n - Adding the sticky bit\"\n chmod a+t \"$l_file\"\n fi\n fi\n fi\n done < <(find \"$l_mount\" -xdev \\( \"${a_path[@]}\" \\) \\( -type f -o -type d \\) -perm -0002 -print0 2> /dev/null)\n done < <(findmnt -Dkerno fstype,target | awk '($1 !~ /^\\s*(nfs|proc|smb|vfat|iso9660|efivarfs|selinuxfs)/ && $2 !~ /^(\\/run\\/user\\/|\\/tmp|\\/var\\/tmp)/){print $2}')\n}\n```"},{"id":"cisb-ubnt24.04lts-007.001.011_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"- World Writable Files:\n - It is recommended that write access is removed from `other` with the command ( `chmod o-w ` ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file.\n - It is recommended that write access is removed from `other` with the command ( `chmod o-w ` ), but always consult relevant vendor documentation to avoid breaking any application dependencies on a given file.\n- World Writable Directories:\n - Set the sticky bit on all world writable directories with the command ( `chmod a+t ` )\n - Set the sticky bit on all world writable directories with the command ( `chmod a+t ` )\n\nRun the following script to: \n\n- Remove other write permission from any world writable files\n- Add the sticky bit to all world writable directories\n\n```\n#!/usr/bin/env bash\n\n{\n l_smask='01000'\n a_file=(); a_dir=() # Initialize arrays\n a_path=(! -path \"/run/user/*\" -a ! -path \"/proc/*\" -a ! -path \"*/containerd/*\" -a ! -path \"*/kubelet/pods/*\" -a ! -path \"*/kubelet/plugins/*\" -a ! -path \"/sys/*\" -a ! -path \"/snap/*\")\n while IFS= read -r l_mount; do\n while IFS= read -r -d $'\\0' l_file; do\n if [ -e \"$l_file\" ]; then\n l_mode=\"$(stat -Lc '%#a' \"$l_file\")\"\n if [ -f \"$l_file\" ]; then # Remove excess permissions from WW files\n echo -e \" - File: \\\"$l_file\\\" is mode: \\\"$l_mode\\\"\\n - removing write permission on \\\"$l_file\\\" from \\\"other\\\"\"\n chmod o-w \"$l_file\"\n fi\n if [ -d \"$l_file\" ]; then # Add sticky bit\n if [ ! $(( $l_mode & $l_smask )) -gt 0 ]; then\n echo -e \" - Directory: \\\"$l_file\\\" is mode: \\\"$l_mode\\\" and doesn't have the sticky bit set\\n - Adding the sticky bit\"\n chmod a+t \"$l_file\"\n fi\n fi\n fi\n done < <(find \"$l_mount\" -xdev \\( \"${a_path[@]}\" \\) \\( -type f -o -type d \\) -perm -0002 -print0 2> /dev/null)\n done < <(findmnt -Dkerno fstype,target | awk '($1 !~ /^\\s*(nfs|proc|smb|vfat|iso9660|efivarfs|selinuxfs)/ && $2 !~ /^(\\/run\\/user\\/|\\/tmp|\\/var\\/tmp)/){print $2}')\n}\n```"},{"id":"cisb-ubnt24.04lts-007.001.011_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.011_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.11"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.11_Ensure_world_writable_files_and_directories_are_secured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure world writable files and directories are secured"},{"id":"cisb-ubnt24.04lts-007.001.012_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.012_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.012_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Administrators may delete users or groups from the system and neglect to remove all files and/or directories owned by those users or groups."},{"id":"cisb-ubnt24.04lts-007.001.012_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"A new user or group who is assigned a deleted user's user ID or group ID may then end up \"owning\" a deleted user or group's files, and thus have more access on the system than was intended."},{"id":"cisb-ubnt24.04lts-007.001.012_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Remove or set ownership and group ownership of these files and/or directories to an active user on the system as appropriate."},{"id":"cisb-ubnt24.04lts-007.001.012_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Remove or set ownership and group ownership of these files and/or directories to an active user on the system as appropriate."},{"id":"cisb-ubnt24.04lts-007.001.012_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.012_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: AC-3. MP-2"}]}],"props":[{"name":"label","value":"7.1.12"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.12_Ensure_no_files_or_directories_without_an_owner_and_a_group_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure no files or directories without an owner and a group exist"},{"id":"cisb-ubnt24.04lts-007.001.013_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.001.013_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.001.013_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SUID or SGID program is to enable users to perform functions (such as changing their password) that require root privileges."},{"id":"cisb-ubnt24.04lts-007.001.013_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"There are valid reasons for SUID and SGID programs, but it is important to identify and review such programs to ensure they are legitimate. Review the files returned by the action in the audit section and check to see if system binaries have a different checksum than what from the package. This is an indication that the binary may have been replaced."},{"id":"cisb-ubnt24.04lts-007.001.013_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Ensure that no rogue SUID or SGID programs have been introduced into the system. Review the files returned by the action in the Audit section and confirm the integrity of these binaries."},{"id":"cisb-ubnt24.04lts-007.001.013_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Ensure that no rogue SUID or SGID programs have been introduced into the system. Review the files returned by the action in the Audit section and confirm the integrity of these binaries."},{"id":"cisb-ubnt24.04lts-007.001.013_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.001.013_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5, AC-3, MP-2"}]}],"props":[{"name":"label","value":"7.1.13"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.1.13_Ensure_SUID_and_SGID_files_are_reviewed"},{"name":"marking","class":"Assessment_Status","value":"manual"}],"title":"Ensure SUID and SGID files are reviewed"}]},{"id":"cisb-ubnt24.04lts-007.002_grp","parts":[{"id":"cisb-ubnt24.04lts-007.002_ovrvw","name":"overview","prose":"This section provides guidance on securing aspects of the local users and groups.\n\n**Note:** The recommendations in this section check local users and groups. Any users or groups from other sources such as LDAP will not be audited. In a domain environment similar checks should be performed against domain users and groups."}],"props":[{"name":"label","value":"7.2"}],"title":"Local User and Group Settings","controls":[{"id":"cisb-ubnt24.04lts-007.002.001_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.001_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.001_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Local accounts can uses shadowed passwords. With shadowed passwords, The passwords are saved in shadow password file, `/etc/shadow`, encrypted by a salted one\\-way hash. Accounts with a shadowed password have an `x` in the second field in `/etc/passwd`."},{"id":"cisb-ubnt24.04lts-007.002.001_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"The `/etc/passwd` file also contains information like user ID's and group ID's that are used by many system programs. Therefore, the `/etc/passwd` file must remain world readable. In spite of encoding the password with a randomly\\-generated one\\-way hash function, an attacker could still break the system if they got access to the `/etc/passwd` file. This can be mitigated by using shadowed passwords, thus moving the passwords in the `/etc/passwd` file to `/etc/shadow`. The `/etc/shadow` file is set so only root will be able to read and write. This helps mitigate the risk of an attacker gaining access to the encoded passwords with which to perform a dictionary attack.\n\n**Note:**\n\n- All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user.\n- A user account with an empty second field in `/etc/passwd` allows the account to be logged into by providing only the username."},{"id":"cisb-ubnt24.04lts-007.002.001_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to set accounts to use shadowed passwords and migrate passwords in `/etc/passwd` to `/etc/shadow`: \n\nInvestigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off.\n\n```\n# pwconv\n```"},{"id":"cisb-ubnt24.04lts-007.002.001_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to set accounts to use shadowed passwords and migrate passwords in `/etc/passwd` to `/etc/shadow`: \n\nInvestigate to determine if the account is logged in and what it is being used for, to determine if it needs to be forced off.\n\n```\n# pwconv\n```"},{"id":"cisb-ubnt24.04lts-007.002.001_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#446a0b78-3e00-4ef4-97b1-8081d2891ae7"},{"rel":"reference","href":"#d3620a46-f77d-4ee8-8713-ee9895a9aa39"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.001_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"PWCONV(8)"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"7.2.1"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.1_Ensure_accounts_in_etcpasswd_use_shadowed_passwords"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure accounts in /etc/passwd use shadowed passwords"},{"id":"cisb-ubnt24.04lts-007.002.002_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.002_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.002_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"An account with an empty password field means that anybody may log in as that user without providing a password."},{"id":"cisb-ubnt24.04lts-007.002.002_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"All accounts must have passwords or be locked to prevent the account from being used by an unauthorized user."},{"id":"cisb-ubnt24.04lts-007.002.002_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"If any accounts in the `/etc/shadow` file do not have a password, run the following command to lock the account until it can be determined why it does not have a password: \n\nAlso, check to see if the account is logged in and investigate what it is being used for to determine if it needs to be forced off.\n\n```\n# passwd -l\n```"},{"id":"cisb-ubnt24.04lts-007.002.002_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"If any accounts in the `/etc/shadow` file do not have a password, run the following command to lock the account until it can be determined why it does not have a password: \n\nAlso, check to see if the account is logged in and investigate what it is being used for to determine if it needs to be forced off.\n\n```\n# passwd -l\n```"},{"id":"cisb-ubnt24.04lts-007.002.002_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#6f7ad499-cc7b-44ad-8157-a798a88887ea"},{"rel":"reference","href":"#12478518-dd21-4070-9bab-c5816119d804"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.002_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"7.2.2"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.2_Ensure_etcshadow_password_fields_are_not_empty"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure /etc/shadow password fields are not empty"},{"id":"cisb-ubnt24.04lts-007.002.003_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.003_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.003_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Over time, system administration errors and changes can lead to groups being defined in `/etc/passwd` but not in `/etc/group` ."},{"id":"cisb-ubnt24.04lts-007.002.003_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Groups defined in the `/etc/passwd` file but not in the `/etc/group` file pose a threat to system security since group permissions are not properly managed."},{"id":"cisb-ubnt24.04lts-007.002.003_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found."},{"id":"cisb-ubnt24.04lts-007.002.003_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found."},{"id":"cisb-ubnt24.04lts-007.002.003_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#37ba6bd6-e6fa-41a0-9d86-9da2dc27054e"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.003_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.3"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.3_Ensure_all_groups_in_etcpasswd_exist_in_etcgroup"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure all groups in /etc/passwd exist in /etc/group"},{"id":"cisb-ubnt24.04lts-007.002.004_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.004_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.004_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group."},{"id":"cisb-ubnt24.04lts-007.002.004_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the `/etc/shadow` file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the `/etc/shadow` file (such as expiration) could also be useful to subvert additional user accounts."},{"id":"cisb-ubnt24.04lts-007.002.004_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Run the following command to remove all users from the shadow group \n\nChange the primary group of any users with shadow as their primary group.\n\n```\n# usermod -g\n```\n\n```\n# sed -ri 's/(^shadow:[^:]*:[^:]*:)([^:]+$)/\\1/' /etc/group\n```"},{"id":"cisb-ubnt24.04lts-007.002.004_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Run the following command to remove all users from the shadow group \n\nChange the primary group of any users with shadow as their primary group.\n\n```\n# usermod -g\n```\n\n```\n# sed -ri 's/(^shadow:[^:]*:[^:]*:)([^:]+$)/\\1/' /etc/group\n```"},{"id":"cisb-ubnt24.04lts-007.002.004_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.004_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: IA-5"}]}],"props":[{"name":"label","value":"7.2.4"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.4_Ensure_shadow_group_is_empty"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure shadow group is empty"},{"id":"cisb-ubnt24.04lts-007.002.005_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.005_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.005_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Although the `useradd` program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the `/etc/passwd` file and change the UID field."},{"id":"cisb-ubnt24.04lts-007.002.005_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Users must be assigned unique UIDs for accountability and to ensure appropriate access protections."},{"id":"cisb-ubnt24.04lts-007.002.005_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Based on the results of the audit script, establish unique UIDs and review all files owned by the shared UIDs to determine which UID they are supposed to belong to."},{"id":"cisb-ubnt24.04lts-007.002.005_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Based on the results of the audit script, establish unique UIDs and review all files owned by the shared UIDs to determine which UID they are supposed to belong to."},{"id":"cisb-ubnt24.04lts-007.002.005_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.5"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.5_Ensure_no_duplicate_UIDs_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure no duplicate UIDs exist"},{"id":"cisb-ubnt24.04lts-007.002.006_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.006_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.006_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Although the `groupadd` program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the `/etc/group` file and change the GID field."},{"id":"cisb-ubnt24.04lts-007.002.006_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections."},{"id":"cisb-ubnt24.04lts-007.002.006_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Based on the results of the audit script, establish unique GIDs and review all files owned by the shared GID to determine which group they are supposed to belong to."},{"id":"cisb-ubnt24.04lts-007.002.006_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Based on the results of the audit script, establish unique GIDs and review all files owned by the shared GID to determine which group they are supposed to belong to."},{"id":"cisb-ubnt24.04lts-007.002.006_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.6"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.6_Ensure_no_duplicate_GIDs_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure no duplicate GIDs exist"},{"id":"cisb-ubnt24.04lts-007.002.007_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.007_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.007_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Although the `useradd` program will not let you create a duplicate user name, it is possible for an administrator to manually edit the `/etc/passwd` file and change the user name."},{"id":"cisb-ubnt24.04lts-007.002.007_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a user is assigned a duplicate user name, it will create and have access to files with the first UID for that username in `/etc/passwd` . For example, if \"test4\" has a UID of 1000 and a subsequent \"test4\" entry has a UID of 2000, logging in as \"test4\" will use UID 1000. Effectively, the UID is shared, which is a security problem."},{"id":"cisb-ubnt24.04lts-007.002.007_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Based on the results of the audit script, establish unique user names for the users. File ownerships will automatically reflect the change as long as the users have unique UIDs."},{"id":"cisb-ubnt24.04lts-007.002.007_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Based on the results of the audit script, establish unique user names for the users. File ownerships will automatically reflect the change as long as the users have unique UIDs."},{"id":"cisb-ubnt24.04lts-007.002.007_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.7"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.7_Ensure_no_duplicate_user_names_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure no duplicate user names exist"},{"id":"cisb-ubnt24.04lts-007.002.008_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.008_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.008_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"Although the `groupadd` program will not let you create a duplicate group name, it is possible for an administrator to manually edit the `/etc/group` file and change the group name."},{"id":"cisb-ubnt24.04lts-007.002.008_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in `/etc/group` . Effectively, the GID is shared, which is a security problem."},{"id":"cisb-ubnt24.04lts-007.002.008_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Based on the results of the audit script, establish unique names for the user groups. File group ownerships will automatically reflect the change as long as the groups have unique GIDs."},{"id":"cisb-ubnt24.04lts-007.002.008_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Based on the results of the audit script, establish unique names for the user groups. File group ownerships will automatically reflect the change as long as the groups have unique GIDs."},{"id":"cisb-ubnt24.04lts-007.002.008_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.8"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.8_Ensure_no_duplicate_group_names_exist"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure no duplicate group names exist"},{"id":"cisb-ubnt24.04lts-007.002.009_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.009_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.009_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"The user home directory is space defined for the particular user to set local environment variables and to store personal files. While the system administrator can establish secure permissions for users' home directories, the users can easily override these. Users can be defined in `/etc/passwd` without a home directory or with a home directory that does not actually exist."},{"id":"cisb-ubnt24.04lts-007.002.009_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"Since the user is accountable for files stored in the user home directory, the user must be the owner of the directory. Group or world\\-writable user home directories may enable malicious users to steal or modify other users' data or to gain another user's system privileges. If the user's home directory does not exist or is unassigned, the user will be placed in \"/\" and will not be able to write any files or have local environment variables set."},{"id":"cisb-ubnt24.04lts-007.002.009_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"If a local interactive users' home directory is undefined and/or doesn't exist, follow local site policy and perform one of the following: \n\n- Lock the user account\n- Remove the user from the system\n- create a directory for the user. If undefined, edit `/etc/passwd` and add the absolute path to the directory to the last field of the user.\n\nRun the following script to: \n\n- Remove excessive permissions from local interactive users home directories\n- Update the home directory's owner\n\n```\n#!/usr/bin/env bash\n\n{\n l_output2=\"\"\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n unset a_uarr && a_uarr=() # Clear and initialize array\n while read -r l_epu l_eph; do # Populate array with users and user home location\n a_uarr+=(\"$l_epu $l_eph\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_uarr[@]}\" # Here if we want to look at number of users before proceeding\n [ \"$l_asize \" -gt \"10000\" ] && echo -e \"\\n ** INFO **\\n - \\\"$l_asize\\\" Local interactive users found on the system\\n - This may be a long running process\\n\"\n while read -r l_user l_home; do\n if [ -d \"$l_home\" ]; then\n l_mask='0027'\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n while read -r l_own l_mode; do\n if [ \"$l_user\" != \"$l_own\" ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is owned by: \\\"$l_own\\\"\\n - changing ownership to: \\\"$l_user\\\"\\n\"\n chown \"$l_user\" \"$l_home\"\n fi\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is mode: \\\"$l_mode\\\" should be mode: \\\"$l_max\\\" or more restrictive\\n - removing excess permissions\\n\"\n chmod g-w,o-rwx \"$l_home\"\n fi\n done <<< \"$(stat -Lc '%U %#a' \"$l_home\")\"\n else\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" Doesn't exist\\n - Please create a home in accordance with local site policy\"\n fi\n done <<< \"$(printf '%s\\n' \"${a_uarr[@]}\")\"\n if [ -z \"$l_output2\" ]; then # If l_output2 is empty, we pass\n echo -e \" - No modification needed to local interactive users home directories\"\n else\n echo -e \"\\n$l_output2\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-007.002.009_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"If a local interactive users' home directory is undefined and/or doesn't exist, follow local site policy and perform one of the following: \n\n- Lock the user account\n- Remove the user from the system\n- create a directory for the user. If undefined, edit `/etc/passwd` and add the absolute path to the directory to the last field of the user.\n\nRun the following script to: \n\n- Remove excessive permissions from local interactive users home directories\n- Update the home directory's owner\n\n```\n#!/usr/bin/env bash\n\n{\n l_output2=\"\"\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n unset a_uarr && a_uarr=() # Clear and initialize array\n while read -r l_epu l_eph; do # Populate array with users and user home location\n a_uarr+=(\"$l_epu $l_eph\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_uarr[@]}\" # Here if we want to look at number of users before proceeding\n [ \"$l_asize \" -gt \"10000\" ] && echo -e \"\\n ** INFO **\\n - \\\"$l_asize\\\" Local interactive users found on the system\\n - This may be a long running process\\n\"\n while read -r l_user l_home; do\n if [ -d \"$l_home\" ]; then\n l_mask='0027'\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n while read -r l_own l_mode; do\n if [ \"$l_user\" != \"$l_own\" ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is owned by: \\\"$l_own\\\"\\n - changing ownership to: \\\"$l_user\\\"\\n\"\n chown \"$l_user\" \"$l_home\"\n fi\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" is mode: \\\"$l_mode\\\" should be mode: \\\"$l_max\\\" or more restrictive\\n - removing excess permissions\\n\"\n chmod g-w,o-rwx \"$l_home\"\n fi\n done <<< \"$(stat -Lc '%U %#a' \"$l_home\")\"\n else\n l_output2=\"$l_output2\\n - User: \\\"$l_user\\\" Home \\\"$l_home\\\" Doesn't exist\\n - Please create a home in accordance with local site policy\"\n fi\n done <<< \"$(printf '%s\\n' \"${a_uarr[@]}\")\"\n if [ -z \"$l_output2\" ]; then # If l_output2 is empty, we pass\n echo -e \" - No modification needed to local interactive users home directories\"\n else\n echo -e \"\\n$l_output2\"\n fi\n}\n```"},{"id":"cisb-ubnt24.04lts-007.002.009_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.009_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"}]}],"props":[{"name":"label","value":"7.2.9"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.9_Ensure_local_interactive_user_home_directories_are_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure local interactive user home directories are configured"},{"id":"cisb-ubnt24.04lts-007.002.010_ctrl","links":[{"rel":"reference","href":"#07380dfe-42b1-49f7-8183-42598ca8378e"},{"rel":"reference","href":"#6fd6253c-8ca4-4f3c-ab08-2153a343569d"},{"rel":"reference","href":"#5a3eea24-7695-410f-9a6f-92acd2e982c0"},{"rel":"reference","href":"#5dda2806-6ac4-4363-adda-403106e08a64"}],"parts":[{"id":"cisb-ubnt24.04lts-007.002.010_ctrl_stmt","name":"statement"},{"id":"cisb-ubnt24.04lts-007.002.010_ctrl_desc","name":"statement","class":"Description","props":[{"name":"label","value":"Description"}],"prose":"While the system administrator can establish secure permissions for users' \"dot\" files, the users can easily override these.\n\n- `.forward` file specifies an email address to forward the user's mail to.\n- `.rhost` file provides the \"remote authentication\" database for the rcp, rlogin, and rsh commands and the rcmd() function. These files bypass the standard password\\-based user authentication mechanism. They specify remote hosts and users that are considered trusted (i.e. are allowed to access the local system without supplying a password)\n- `.netrc` file contains data for logging into a remote host or passing authentication to an API.\n- `.bash_history` file keeps track of the user’s commands."},{"id":"cisb-ubnt24.04lts-007.002.010_ctrl_rtnl","name":"statement","class":"Rationale","props":[{"name":"label","value":"Rationale"}],"prose":"User configuration files with excessive or incorrect access may enable malicious users to steal or modify other users' data or to gain another user's system privileges."},{"id":"cisb-ubnt24.04lts-007.002.010_audt","name":"assessment-method","class":"Audit","props":[{"name":"label","value":"Audit"},{"name":"method","value":"TEST"}],"prose":"Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy. \n\nThe following script will: \n\n- remove excessive permissions on `dot` files within interactive users' home directories\n- change ownership of `dot` files within interactive users' home directories to the user\n- change group ownership of `dot` files within interactive users' home directories to the user's primary group\n- list `.forward` and `.rhost` files to be investigated and manually deleted\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=()\n l_maxsize=\"1000\" # Maximum number of local interactive users before warning (Default 1,000)\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n a_user_and_home=() # Create array with local users and their home directories\n while read -r l_local_user l_local_user_home; do # Populate array with users and user home location\n [[ -n \"$l_local_user\" && -n \"$l_local_user_home\" ]] && a_user_and_home+=(\"$l_local_user:$l_local_user_home\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_user_and_home[@]}\" # Here if we want to look at number of users before proceeding\n [ \"${#a_user_and_home[@]}\" -gt \"$l_maxsize\" ] && printf '%s\\n' \"\" \" ** INFO **\" \\\n \" - \\\"$l_asize\\\" Local interactive users found on the system\" \\\n \" - This may be a long running check\" \"\"\n file_access_fix()\n {\n a_access_out=()\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" is mode: \\\"$l_mode\\\" and should be mode: \\\"$l_max\\\" or more restrictive\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be mode: \\\"$l_max\\\" or more restrictive\"\n chmod \"$l_change\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_owner\" =~ ($l_user) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" owned by: \\\"$l_owner\\\" and should be owned by \\\"${l_user//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be owned by \\\"${l_user//|/ or }\\\"\"\n chown \"$l_user\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_gowner\" =~ ($l_group) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" group owned by: \\\"$l_gowner\\\" and should be group owned by \\\"${l_group//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be group owned by \\\"${l_group//|/ or }\\\"\"\n chgrp \"$l_group\" \"$l_hdfile\"\n fi\n }\n while IFS=: read -r l_user l_home; do\n a_dot_file=(); a_netrc=(); a_netrc_warn=(); a_bhout=(); a_hdirout=()\n if [ -d \"$l_home\" ]; then\n l_group=\"$(id -gn \"$l_user\" | xargs)\";l_group=\"${l_group// /|}\"\n while IFS= read -r -d $'\\0' l_hdfile; do\n while read -r l_mode l_owner l_gowner; do\n case \"$(basename \"$l_hdfile\")\" in\n .forward | .rhost )\n a_dot_file+=(\" - File: \\\"$l_hdfile\\\" exists\" \" Please review and manually delete this file\") ;;\n .netrc )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix\n a_netrc_warn+=(\" - File: \\\"$l_hdfile\\\" exists\") ;;\n .bash_history )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix ;;\n * )\n l_mask='0133'; l_change=\"u-x,go-wx\"; file_access_fix ;;\n esac\n done < <(stat -Lc '%#a %U %G' \"$l_hdfile\")\n done < <(find \"$l_home\" -xdev -type f -name '.*' -print0)\n fi\n [ \"${#a_dot_file[@]}\" -gt 0 ] && a_output2+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_dot_file[@]}\")\n [ \"${#a_netrc_warn[@]}\" -gt 0 ] && a_output3+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_netrc_warn[@]}\")\n done <<< \"$(printf '%s\\n' \"${a_user_and_home[@]}\")\"\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" ** WARNING **\" \"${a_output3[@]}\" \"\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\"\n}\n```"},{"id":"cisb-ubnt24.04lts-007.002.010_rmd","name":"guidance","class":"Remediation","props":[{"name":"label","value":"Remediation"}],"prose":"Making global modifications to users' files without alerting the user community can result in unexpected outages and unhappy users. Therefore, it is recommended that a monitoring policy be established to report user dot file permissions and determine the action to be taken in accordance with site policy. \n\nThe following script will: \n\n- remove excessive permissions on `dot` files within interactive users' home directories\n- change ownership of `dot` files within interactive users' home directories to the user\n- change group ownership of `dot` files within interactive users' home directories to the user's primary group\n- list `.forward` and `.rhost` files to be investigated and manually deleted\n\n```\n#!/usr/bin/env bash\n\n{\n a_output2=(); a_output3=()\n l_maxsize=\"1000\" # Maximum number of local interactive users before warning (Default 1,000)\n l_valid_shells=\"^($( awk -F\\/ '$NF != \"nologin\" {print}' /etc/shells | sed -rn '/^\\//{s,/,\\\\\\\\/,g;p}' | paste -s -d '|' - ))$\"\n a_user_and_home=() # Create array with local users and their home directories\n while read -r l_local_user l_local_user_home; do # Populate array with users and user home location\n [[ -n \"$l_local_user\" && -n \"$l_local_user_home\" ]] && a_user_and_home+=(\"$l_local_user:$l_local_user_home\")\n done <<< \"$(awk -v pat=\"$l_valid_shells\" -F: '$(NF) ~ pat { print $1 \" \" $(NF-1) }' /etc/passwd)\"\n l_asize=\"${#a_user_and_home[@]}\" # Here if we want to look at number of users before proceeding\n [ \"${#a_user_and_home[@]}\" -gt \"$l_maxsize\" ] && printf '%s\\n' \"\" \" ** INFO **\" \\\n \" - \\\"$l_asize\\\" Local interactive users found on the system\" \\\n \" - This may be a long running check\" \"\"\n file_access_fix()\n {\n a_access_out=()\n l_max=\"$( printf '%o' $(( 0777 & ~$l_mask)) )\"\n if [ $(( $l_mode & $l_mask )) -gt 0 ]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" is mode: \\\"$l_mode\\\" and should be mode: \\\"$l_max\\\" or more restrictive\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be mode: \\\"$l_max\\\" or more restrictive\"\n chmod \"$l_change\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_owner\" =~ ($l_user) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" owned by: \\\"$l_owner\\\" and should be owned by \\\"${l_user//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be owned by \\\"${l_user//|/ or }\\\"\"\n chown \"$l_user\" \"$l_hdfile\"\n fi\n if [[ ! \"$l_gowner\" =~ ($l_group) ]]; then\n printf '%s\\n' \"\" \" - File: \\\"$l_hdfile\\\" group owned by: \\\"$l_gowner\\\" and should be group owned by \\\"${l_group//|/ or }\\\"\" \\\n \" Updating file: \\\"$l_hdfile\\\" to be group owned by \\\"${l_group//|/ or }\\\"\"\n chgrp \"$l_group\" \"$l_hdfile\"\n fi\n }\n while IFS=: read -r l_user l_home; do\n a_dot_file=(); a_netrc=(); a_netrc_warn=(); a_bhout=(); a_hdirout=()\n if [ -d \"$l_home\" ]; then\n l_group=\"$(id -gn \"$l_user\" | xargs)\";l_group=\"${l_group// /|}\"\n while IFS= read -r -d $'\\0' l_hdfile; do\n while read -r l_mode l_owner l_gowner; do\n case \"$(basename \"$l_hdfile\")\" in\n .forward | .rhost )\n a_dot_file+=(\" - File: \\\"$l_hdfile\\\" exists\" \" Please review and manually delete this file\") ;;\n .netrc )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix\n a_netrc_warn+=(\" - File: \\\"$l_hdfile\\\" exists\") ;;\n .bash_history )\n l_mask='0177'; l_change=\"u-x,go-rwx\"; file_access_fix ;;\n * )\n l_mask='0133'; l_change=\"u-x,go-wx\"; file_access_fix ;;\n esac\n done < <(stat -Lc '%#a %U %G' \"$l_hdfile\")\n done < <(find \"$l_home\" -xdev -type f -name '.*' -print0)\n fi\n [ \"${#a_dot_file[@]}\" -gt 0 ] && a_output2+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_dot_file[@]}\")\n [ \"${#a_netrc_warn[@]}\" -gt 0 ] && a_output3+=(\" - User: \\\"$l_user\\\" Home Directory: \\\"$l_home\\\"\" \"${a_netrc_warn[@]}\")\n done <<< \"$(printf '%s\\n' \"${a_user_and_home[@]}\")\"\n [ \"${#a_output3[@]}\" -gt 0 ] && printf '%s\\n' \"\" \" ** WARNING **\" \"${a_output3[@]}\" \"\"\n [ \"${#a_output2[@]}\" -gt 0 ] && printf '%s\\n' \"\" \"${a_output2[@]}\"\n}\n```"},{"id":"cisb-ubnt24.04lts-007.002.010_cisc","name":"guidance","class":"CIS_Controls","links":[{"rel":"reference","href":"#8a3e6a71-d866-4036-92a2-532b35782004"},{"rel":"reference","href":"#19b586cf-560b-42e4-8346-7b416aa55265"}],"props":[{"name":"label","value":"CIS Controls"}]},{"id":"cisb-ubnt24.04lts-007.002.010_ref","name":"guidance","class":"References","props":[{"name":"label","value":"References"},{"name":"marking","class":"Reference","value":"NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5"}]}],"props":[{"name":"label","value":"7.2.10"},{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_rule_7.2.10_Ensure_local_interactive_user_dot_files_access_is_configured"},{"name":"marking","class":"Assessment_Status","value":"automated"}],"title":"Ensure local interactive user dot files access is configured"}]}]}]}],"back-matter":{"resources":[{"uuid":"9651ee78-952a-494b-901c-f6371566978f","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/terms-of-use.md"}]},{"uuid":"7d3206a6-70b5-460e-bc0f-7d7b645d64ad","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/overview.md"}]},{"uuid":"7b42ae75-f609-4be2-a7d5-f185b1f3f855","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/consensus-guidance.md"}]},{"uuid":"db0f7cba-8a05-4672-98f9-2f6342a37386","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/typographical-conventions.md"}]},{"uuid":"0509c93b-8c94-4243-bea8-f922719bb772","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/recommendation-definitions.md"}]},{"uuid":"d32c4db4-b568-48b4-9c29-c11cfda0d9f1","title":"Automated","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/assessment-status.md"}]},{"uuid":"89c1983e-c148-43e2-9ed1-d78d64316dee","title":"Manual","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-benchmarks-oscal/src/main/assessment-status.md"}]},{"uuid":"c19fcbb6-4d2b-4b19-aa66-fed4b24b52f4","title":"Profile Definitions","rlinks":[{"href":"#6535ce1d-5619-477d-bc5c-7ab0b303a6fe"}],"description":"The following configuration profiles are defined by this Benchmark:\nLevel 1 \\- Server\nItems in this profile intend to:\n\n- be practical and prudent;\n- provide a clear security benefit; and\n- not inhibit the utility of the technology beyond acceptable means.\n\nThis profile is intended for servers.\nLevel 2 \\- Server\nThis profile extends the \"Level 1 \\- Server\" profile. Items in this profile exhibit one or more of the following characteristics:\n\n- are intended for environments or use cases where security is paramount.\n- acts as defense in depth measure.\n- may negatively inhibit the utility or performance of the technology.\n\nThis profile is intended for servers.\nLevel 1 \\- Workstation\nItems in this profile intend to:\n\n- be practical and prudent;\n- provide a clear security benefit; and\n- not inhibit the utility of the technology beyond acceptable means.\n\nThis profile is intended for workstations.\nLevel 2 \\- Workstation\nThis profile extends the \"Level 1 \\- Workstation\" profile. Items in this profile exhibit one or more of the following characteristics:\n\n- are intended for environments or use cases where security is paramount.\n- acts as defense in depth measure.\n- may negatively inhibit the utility or performance of the technology.\n\nThis profile is intended for workstations."},{"uuid":"07380dfe-42b1-49f7-8183-42598ca8378e","props":[{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_profile_Level_1_-_Server"}],"title":"Level 1 \\- Server","rlinks":[{"href":"#6535ce1d-5619-477d-bc5c-7ab0b303a6fe"}],"description":"Items in this profile intend to:\n\n- be practical and prudent;\n- provide a clear security benefit; and\n- not inhibit the utility of the technology beyond acceptable means.\n\nThis profile is intended for servers."},{"uuid":"6fd6253c-8ca4-4f3c-ab08-2153a343569d","props":[{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_profile_Level_2_-_Server"}],"title":"Level 2 \\- Server","rlinks":[{"href":"#6535ce1d-5619-477d-bc5c-7ab0b303a6fe"}],"description":"This profile extends the \"Level 1 \\- Server\" profile. Items in this profile exhibit one or more of the following characteristics:\n\n- are intended for environments or use cases where security is paramount.\n- acts as defense in depth measure.\n- may negatively inhibit the utility or performance of the technology.\n\nThis profile is intended for servers."},{"uuid":"5a3eea24-7695-410f-9a6f-92acd2e982c0","props":[{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_profile_Level_1_-_Workstation"}],"title":"Level 1 \\- Workstation","rlinks":[{"href":"#6535ce1d-5619-477d-bc5c-7ab0b303a6fe"}],"description":"Items in this profile intend to:\n\n- be practical and prudent;\n- provide a clear security benefit; and\n- not inhibit the utility of the technology beyond acceptable means.\n\nThis profile is intended for workstations."},{"uuid":"5dda2806-6ac4-4363-adda-403106e08a64","props":[{"name":"marking","value":"xccdf_id: xccdf_org.cisecurity.benchmarks_profile_Level_2_-_Workstation"}],"title":"Level 2 \\- Workstation","rlinks":[{"href":"#6535ce1d-5619-477d-bc5c-7ab0b303a6fe"}],"description":"This profile extends the \"Level 1 \\- Workstation\" profile. Items in this profile exhibit one or more of the following characteristics:\n\n- are intended for environments or use cases where security is paramount.\n- acts as defense in depth measure.\n- may negatively inhibit the utility or performance of the technology.\n\nThis profile is intended for workstations."},{"uuid":"c8baf665-cf68-43d8-bec2-da8c1c891aa1","props":[{"name":"version","value":"7"}],"title":"IG1","rlinks":[{"href":"#ddfa30c0-94ca-40e3-bbee-f28e38cf3c17"}]},{"uuid":"0fbc446d-a307-4ab1-89f4-c80bbc0b1910","props":[{"name":"version","value":"7"}],"title":"IG2","rlinks":[{"href":"#ddfa30c0-94ca-40e3-bbee-f28e38cf3c17"}]},{"uuid":"2bae4151-4b94-41e7-ad34-938172691614","props":[{"name":"version","value":"7"}],"title":"IG3","rlinks":[{"href":"#ddfa30c0-94ca-40e3-bbee-f28e38cf3c17"}]},{"uuid":"f9096570-2501-419d-afdc-b34fb6bdd821","props":[{"name":"version","value":"8"}],"title":"IG1","rlinks":[{"href":"#3a02644e-5b64-4caf-a286-24fcd13affde"}]},{"uuid":"b282ff23-661e-46d4-a133-2361a8f5c5a7","props":[{"name":"version","value":"8"}],"title":"IG2","rlinks":[{"href":"#3a02644e-5b64-4caf-a286-24fcd13affde"}]},{"uuid":"75f5ec4a-468f-44e6-b5c1-92b053ab14c0","props":[{"name":"version","value":"8"}],"title":"IG3","rlinks":[{"href":"#3a02644e-5b64-4caf-a286-24fcd13affde"}]},{"uuid":"3a02644e-5b64-4caf-a286-24fcd13affde","props":[{"name":"version","class":"CIS_Cotrols","value":"8.1"}],"title":"CIS Controls","rlinks":[{"href":"https://bitbucket.org/cis-it-workspace/cis-controls-v8.1_oscal/src/main/src/catalogs/xml/cis-controls-v8.1_catalog.xml"}]},{"uuid":"ddfa30c0-94ca-40e3-bbee-f28e38cf3c17","props":[{"name":"version","class":"CIS_Controls","value":"7.1"}],"title":"CIS Controls","rlinks":[{"href":"https://workbench.cisecurity.org/files/2312/download/2608"}]},{"uuid":"6535ce1d-5619-477d-bc5c-7ab0b303a6fe","props":[{"name":"version","value":"1.0.0"}],"title":"CIS Ubuntu Linux 24.04 LTS Benchmark","rlinks":[{"href":"https://workbench.cisecurity.org/files/2312/download/2608"}]},{"uuid":"a49162d5-d194-4695-81c5-52c52a3b5e4f","props":[{"name":"marking","value":"13.7"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Manage USB Devices","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"c1873e2a-247c-4d65-af1d-3c8fff93c432","props":[{"name":"marking","value":"3.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Deploy Automated Operating System Patch Management Tools","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"c5848cf8-e858-43e9-8404-a08cd11ff80e","props":[{"name":"marking","value":"3.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Deploy Automated Software Patch Management Tools","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"80a840ce-b20b-4a5f-8ab4-6ef92cccc549","props":[{"name":"marking","value":"8.3"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Enable Operating System Anti\\-Exploitation Features/ Deploy Anti\\-Exploit Technologies","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"cccae7ba-38ea-4557-a8b4-bdf07f718ea1","props":[{"name":"marking","value":"8.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Configure Devices Not To Auto\\-run Content","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"bf712ff3-8edb-40bd-bb17-b10e10bc0964","props":[{"name":"marking","value":"2.6"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Respond"}],"title":"Address unapproved software","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"466cc196-941d-4751-8497-ab9b445b0e24","props":[{"name":"marking","value":"6.1"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Utilize Three Synchronized Time Sources","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"fe15df43-434e-4fa4-8fca-86196232e192","props":[{"name":"marking","value":"15.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Disable Wireless Access on Devices if Not Required","rlinks":[{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"03383be5-1d48-42ff-a72b-fc82ded82c5b","props":[{"name":"marking","value":"15.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Limit Wireless Access on Client Devices","rlinks":[{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"7ccf1517-16b4-42fc-a70b-924be9050aff","props":[{"name":"marking","value":"9.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Apply Host\\-based Firewalls or Port Filtering","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"a7df2870-fdbe-413f-bf4b-4a55f66ef459","props":[{"name":"marking","value":"14.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Encrypt All Sensitive Information in Transit","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"364f5526-13a5-497e-9e7e-bebdcb36f30c","props":[{"name":"marking","value":"16.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Encrypt Transmittal of Username and Authentication Credentials","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"6bdf43b6-91d2-4b67-8eae-bbaba76e7db5","props":[{"name":"marking","value":"4.3"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Ensure the Use of Dedicated Administrative Accounts","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"730f8d10-e772-4c7d-b2cf-8a730890b5e8","props":[{"name":"marking","value":"16.7"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Establish Process for Revoking Access","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"56efab4b-cc6a-4644-ae29-8bf5ef04239c","props":[{"name":"marking","value":"6.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Central Log Management","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"9091db95-46e6-432e-aa40-de4c5a398da8","props":[{"name":"marking","value":"5.1"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Establish Secure Configurations","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"fb274140-ae9f-4906-8368-cf3834a627ef","props":[{"name":"marking","value":"9.2"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Ensure Only Approved Ports, Protocols and Services Are Running","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"c8bb01d1-3f8b-4fa0-8bd8-1364d5ca5cea","props":[{"name":"marking","value":"6.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Ensure adequate storage for logs","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"9e444207-45c1-4c7e-a5c3-7c92f4919564","props":[{"name":"marking","value":"4.8"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Log and Alert on Changes to Administrative Group Membership","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"2adc0f62-07fc-411e-bbf0-2146e9789019","props":[{"name":"marking","value":"4.9"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Log and Alert on Unsuccessful Administrative Account Login","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"cf7d770e-dfe9-4d35-9ff2-f09c88ca1443","props":[{"name":"marking","value":"16.11"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Lock Workstation Sessions After Inactivity","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"5edafcb0-bd77-4520-a465-310bc53735ba","props":[{"name":"marking","value":"16.13"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Alert on Account Login Behavior Deviation","rlinks":[{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"d4aa4e81-f9d3-4f3f-8b09-a0af9289b606","props":[{"name":"marking","value":"5.5"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Implement Automated Configuration Monitoring Systems","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"7bf51a1a-b4ce-4881-a2f6-485ac81e3381","props":[{"name":"marking","value":"6.2"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Activate audit logging","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"0d285252-67f9-420d-a890-07ee36a57ce1","props":[{"name":"marking","value":"6.3"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Enable Detailed Logging","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"56b32ac3-31da-4fc5-993d-09f1ededcd20","props":[{"name":"marking","value":"14.9"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Enforce Detail Logging for Access or Changes to Sensitive Data","rlinks":[{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"446a0b78-3e00-4ef4-97b1-8081d2891ae7","props":[{"name":"marking","value":"16.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Encrypt or Hash all Authentication Credentials","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"6f7ad499-cc7b-44ad-8157-a798a88887ea","props":[{"name":"marking","value":"4.4"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Use Unique Passwords","rlinks":[{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"8a3e6a71-d866-4036-92a2-532b35782004","props":[{"name":"marking","value":"14.6"},{"name":"version","class":"CIS_Controls","value":"7"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Protect Information through Access Control Lists","rlinks":[{"href":"#c8baf665-cf68-43d8-bec2-da8c1c891aa1"},{"href":"#0fbc446d-a307-4ab1-89f4-c80bbc0b1910"},{"href":"#2bae4151-4b94-41e7-ad34-938172691614"}]},{"uuid":"4a7d2a45-05bb-4662-87b5-fc5ddf38d3e3","props":[{"name":"marking","value":"7.3"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Perform Automated Operating System Patch Management","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"bce69284-01e8-4d50-bee6-840a29cd42a1","props":[{"name":"marking","value":"7.4"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Perform Automated Application Patch Management","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"33fb37ab-f99e-4939-b208-a5995f021956","props":[{"name":"marking","value":"10.5"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Enable Anti\\-Exploitation Features","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"d3322cdd-c2af-44ce-9f5a-11222553f5a5","props":[{"name":"marking","value":"10.3"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Disable Autorun and Autoplay for Removable Media","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"c5bcd779-c481-49ed-9370-f7c3f0a29209","props":[{"name":"marking","value":"8.4"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Standardize Time Synchronization","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"895d5a1f-ef32-4d37-8919-5ae503146e18","props":[{"name":"marking","value":"4.4"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Implement and Manage a Firewall on Servers","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"77d94858-1921-4a05-af04-24298cab9636","props":[{"name":"marking","value":"4.5"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Implement and Manage a Firewall on End\\-User Devices","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"da74b7a3-70ce-4fae-8831-357a58b6b583","props":[{"name":"marking","value":"3.10"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Encrypt Sensitive Data in Transit","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"6c04cc0a-fd22-4342-aafc-0beb38c4e6ce","props":[{"name":"marking","value":"5.4"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Restrict Administrator Privileges to Dedicated Administrator Accounts","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"c5c18b06-cb1f-4be4-b612-b50ea3fdf080","props":[{"name":"marking","value":"6.2"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Establish an Access Revoking Process","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"8a85f869-e272-4c01-ba04-61b477317829","props":[{"name":"marking","value":"4.1"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Applications"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Establish and Maintain a Secure Configuration Process","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"9b7007f5-27f9-4e2e-a63f-1546ed368515","props":[{"name":"marking","value":"4.3"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Configure Automatic Session Locking on Enterprise Assets","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"938bb5d4-f89c-42ad-a774-ea82b61ce067","props":[{"name":"marking","value":"8.9"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Centralize Audit Logs","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"5eec8a4f-8bc3-4a46-8d7b-8afec033db20","props":[{"name":"marking","value":"4.8"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Devices"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Uninstall or Disable Unnecessary Services on Enterprise Assets and Software","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"24ef9463-3c0b-434c-9da1-f4bec7791491","props":[{"name":"marking","value":"8.3"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Ensure Adequate Audit Log Storage","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"7d1c70e1-6675-4be1-bb92-709198071391","props":[{"name":"marking","value":"8.2"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Collect Audit Logs","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"5c4f90ec-a1e4-4140-865c-e3a87694b13f","props":[{"name":"marking","value":"3.14"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Log Sensitive Data Access","rlinks":[{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"1c4d32f2-b79f-4b65-a8f8-9d8cccb0baae","props":[{"name":"marking","value":"8.5"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Network"},{"name":"marking","class":"Security_Function","value":"Detect"}],"title":"Collect Detailed Audit Logs","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"d3620a46-f77d-4ee8-8713-ee9895a9aa39","props":[{"name":"marking","value":"3.11"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Encrypt Sensitive Data at Rest","rlinks":[{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"12478518-dd21-4070-9bab-c5816119d804","props":[{"name":"marking","value":"5.2"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Users"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Use Unique Passwords","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"37ba6bd6-e6fa-41a0-9d86-9da2dc27054e","props":[{"name":"marking","value":"14.6"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Train Workforce Members on Recognizing and Reporting Security Incidents","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"19b586cf-560b-42e4-8346-7b416aa55265","props":[{"name":"marking","value":"3.3"},{"name":"version","class":"CIS_Controls","value":"8"},{"name":"marking","class":"Asset_Type","value":"Data"},{"name":"marking","class":"Security_Function","value":"Protect"}],"title":"Configure Data Access Control Lists","rlinks":[{"href":"#f9096570-2501-419d-afdc-b34fb6bdd821"},{"href":"#b282ff23-661e-46d4-a133-2361a8f5c5a7"},{"href":"#75f5ec4a-468f-44e6-b5c1-92b053ab14c0"}]},{"uuid":"201a216f-0fb3-4579-8278-4fc0654162ac","rlinks":[{"href":"https://github.com/konstruktoid/hardening/blob/master/config/aidecheck.timer"}]},{"uuid":"8b96ac73-8eee-4a49-a73d-5bada6ccf484","rlinks":[{"href":"https://github.com/konstruktoid/hardening/blob/master/config/aidecheck.service"}]},{"uuid":"32d7097f-52ea-487b-ac5b-a39489d424fe","rlinks":[{"href":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pam_configuration_files"}]},{"uuid":"f5642ba1-c92e-447a-95d5-45c77cd3047c","rlinks":[{"href":"https://manpages.debian.org/bookworm/manpages/nsswitch.conf.5.en.html"}]},{"uuid":"71a6084a-98e7-401b-88ce-841ca299b9cd","rlinks":[{"href":"https://netplan.io/faq"}]},{"uuid":"c2689211-d61e-42eb-a1c7-d22d241de36f","rlinks":[{"href":"https://www.rsyslog.com/doc/index.html"}]},{"uuid":"d3fb7d51-e3ac-4daa-a809-feba8099d5ee","rlinks":[{"href":"https://www.rsyslog.com/doc/"}]},{"uuid":"85a64565-1750-4c8b-a048-d250eb673bad","rlinks":[{"href":"https://www.cisecurity.org/insights/white-papers/cis-password-policy-guide"}]},{"uuid":"c9ebb72d-1c99-4cee-a2a3-06299ef26243","rlinks":[{"href":"https://packages.debian.org/buster/libpam-pwquality"}]},{"uuid":"cf266fbc-b182-4721-810b-4342db98fe7d","rlinks":[{"href":"https://www.sudo.ws/man/1.9.0/sudoers.man.html"}]},{"uuid":"e431fca9-93ec-4b2f-9f6c-cd3648b9b790","rlinks":[{"href":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795"}]},{"uuid":"cea6fa9e-1d37-4033-91c2-6e9418c6edbd","rlinks":[{"href":"https://www.ssh.com/ssh/sshd_config/"}]},{"uuid":"f09227a7-d5f3-400a-9312-69e95680007a","rlinks":[{"href":"https://ubuntu.com/server/docs/openssh-crypto-configuration"}]},{"uuid":"b2044d33-016c-4ce1-8844-5c15f4213c96","rlinks":[{"href":"https://www.openssh.com/txt/cbc.adv"}]},{"uuid":"13dc902e-bb79-411d-9374-8b35d569131c","rlinks":[{"href":"https://nvd.nist.gov/vuln/detail/CVE-2008-5161"}]},{"uuid":"df086c41-9eb5-4ab1-af98-125f25c66ff8","rlinks":[{"href":"https://nvd.nist.gov/vuln/detail/CVE-2016-2183"}]},{"uuid":"ccf26ba7-f2be-40de-bad3-25fa8d50b5f1","rlinks":[{"href":"https://nvd.nist.gov/vuln/detail/CVE-2019-1543"}]},{"uuid":"28607f87-d6ba-4a7a-a8a3-b3eb7273a22a","rlinks":[{"href":"https://manpages.ubuntu.com/manpages/jammy/en/man8/ufw-framework.8.html"}]},{"uuid":"f639e935-042b-4abb-ab87-86d1599bac88","rlinks":[{"href":"http://manpages.ubuntu.com/manpages/precise/en/man8/ufw.8.html"}]},{"uuid":"93e957b0-1019-4661-994a-19113f9abdc0","rlinks":[{"href":"https://www.debian.org/doc/manuals/debian-reference/debian-reference.en.pdf"}]},{"uuid":"15ca9afc-d8d4-481d-8c18-60d766f187a9","rlinks":[{"href":"https://assets.ubuntu.com/v1/544d9904-ubuntu-server-guide-2024-01-22.pdf"}]},{"uuid":"63a1bdb1-e323-4e83-a7a3-6c73c6873f49","rlinks":[{"href":"https://wiki.ubuntu.com/UncomplicatedFirewall"}]},{"uuid":"7a694276-b8bf-466e-91a4-92fef62e50af","rlinks":[{"href":"https://wiki.debian.org/DebianFirewall"}]},{"uuid":"e1607c58-78f4-451b-a2b0-fe279bc21b04","rlinks":[{"href":"https://www.cisa.gov/tips/st05-015"}]},{"uuid":"68dc16c1-5e67-4020-bbc8-f56ccd879161","rlinks":[{"href":"https://tf.nist.gov/tf-cgi/servers.cgi"}]},{"uuid":"1d7e9bf6-c4bf-4d71-b1e7-5786aa16e81d","rlinks":[{"href":"https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html"}]},{"uuid":"2ff11322-3ede-4336-a120-a67aff398a42","rlinks":[{"href":"http://www.cups.org"}]},{"uuid":"437b84bd-601c-44b3-b9b9-3bfc96ea80e1","rlinks":[{"href":"https://access.redhat.com/solutions/20107"}]},{"uuid":"8f4f4122-4e84-46a5-885e-9ea4a8b4867d","rlinks":[{"href":"https://manpages.ubuntu.com/manpages/trusty/man1/gsettings.1.html"}]},{"uuid":"1825fccd-8bad-4577-af9e-f9c64821462d","rlinks":[{"href":"https://help.gnome.org/admin/system-admin-guide/stable/dconf-lockdown.html.en"}]},{"uuid":"ff129dff-63ec-44a6-9659-668d37709d37","rlinks":[{"href":"https://help.gnome.org/admin/system-admin-guide/stable/desktop-lockscreen.html.en"}]},{"uuid":"c9d4919f-270b-4586-a56d-5c9c63cc7914","rlinks":[{"href":"https://help.gnome.org/admin/system-admin-guide/stable/login-userlist-disable.html.en"}]},{"uuid":"82d8f182-9446-4ec1-b986-5837a9ede529","rlinks":[{"href":"https://help.gnome.org/admin/system-admin-guide/stable/login-banner.html.en"}]},{"uuid":"2fdc7669-16b6-4b84-a97d-576340484c77","rlinks":[{"href":"https://github.com/raj3shp/termspy"}]},{"uuid":"d61c4df6-1020-47fe-8d58-8b024a4a5d28","rlinks":[{"href":"https://www.kernel.org/doc/Documentation/security/Yama.txt"}]},{"uuid":"db00b2ef-a817-4198-8483-c03ba67df366","rlinks":[{"href":"http://manpages.ubuntu.com/manpages/focal/man5/sysctl.d.5.html"}]},{"uuid":"14c7e817-8391-4839-bab7-e56fa4095b64","rlinks":[{"href":"https://manpages.debian.org/stretch/apt/sources.list.5.en.html"}]},{"uuid":"af98eab8-d0f5-49e0-b1bb-5bfab23f0728","rlinks":[{"href":"https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html"}]},{"uuid":"3d84d28b-df5a-4895-a98a-b621ac6567a4","rlinks":[{"href":"https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems/"}]},{"uuid":"969b5424-4ef4-46f0-96ed-1b87789f1d13","rlinks":[{"href":"https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt"}]},{"uuid":"793fab00-89a0-4fd6-959b-fc8fe679d274","rlinks":[{"href":"https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=filesystem"}]},{"uuid":"71f01caa-6548-44fd-baa6-52bf370ec097","rlinks":[{"href":"https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=overlayfs"}]},{"uuid":"867973bd-b014-4b20-9b9e-d5785ee931e4","rlinks":[{"href":"https://wiki.archlinux.org/title/Overlay_filesystem"}]},{"uuid":"752c8539-8d40-4f68-8a2c-cda02e875b8e","rlinks":[{"href":"https://docs.kernel.org/filesystems/overlayfs.html"}]}]}}}